statelyai 0.11.4 → 0.11.6

package/dist/cli-D8HHGEMs.mjs

@@ -1,3073 +0,0 @@
-import { Args, Command, Flags, flush, handle, run } from "@oclif/core";
-import fsPromises from "node:fs/promises";
-import * as path$1 from "node:path";
-import path from "node:path";
-import { z } from "zod";
-import { execFile, execFileSync, spawn } from "node:child_process";
-import { promisify } from "node:util";
-import * as crypto from "node:crypto";
-import fs, { promises, watch } from "node:fs";
-import { createInterface } from "node:readline/promises";
-import { Writable } from "node:stream";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import * as http from "node:http";
-import * as ts from "typescript";
-import { EditorHostWorkspaceSession, StudioApiError, buildAuthorizeUrl, createPkcePair, createRemoteEditorSyncBackend, createStatelyClient, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, findStatelyPragmaAttachments, getStatelyPragma, refreshToken, registerOAuthClient } from "@statelyai/sdk";
-import { WebSocket, WebSocketServer } from "ws";
-import os from "node:os";
-import { PullSourceReconciliationError, planSync, pullSync, pushLocalMachineLinks } from "@statelyai/sdk/sync";
-
-//#region ../api-contract/dist/verification.mjs
-const count = z.number().int().nonnegative();
-const metric = (value) => z.object({
-	value: z.union([value, z.literal("n/a")]),
-	detail: z.string()
-});
-const coverageBucket = z.object({
-	covered: count,
-	total: count,
-	uncovered: z.array(z.string())
-}).refine((bucket) => bucket.covered <= bucket.total, "Covered count exceeds total");
-const verificationCoverageSchema = z.object({
-	states: coverageBucket,
-	transitions: coverageBucket,
-	eventCases: coverageBucket,
-	percent: z.object({
-		states: z.number().min(0).max(100),
-		transitions: z.number().min(0).max(100),
-		eventCases: z.number().min(0).max(100),
-		overall: z.number().min(0).max(100)
-	})
-});
-const witnessStep = z.object({
-	index: count,
-	event: z.object({ type: z.string() }).catchall(z.unknown()),
-	expectedState: z.unknown()
-});
-const predicateResult = z.object({
-	state: z.string(),
-	status: z.enum(["passed", "failed"]),
-	signals: z.array(z.string()),
-	message: z.string().optional()
-});
-const verificationDivergenceSchema = z.object({
-	version: z.literal(1),
-	id: z.string(),
-	kind: z.enum(["expectation", "negative-probe"]),
-	classification: z.enum([
-		"unclassified",
-		"model-gap",
-		"behavior-gap",
-		"flake"
-	]),
-	pathId: z.string().optional(),
-	witness: z.object({
-		path: z.array(witnessStep),
-		stepCount: count
-	}),
-	minimalWitness: z.object({
-		steps: z.array(witnessStep),
-		pathLength: count,
-		candidatesTried: count,
-		reproduced: z.boolean()
-	}).optional(),
-	expected: z.object({
-		state: z.string(),
-		predicateResults: z.array(predicateResult),
-		refusal: z.object({
-			stateUnchanged: z.literal(true),
-			noNavigationOrMutation: z.literal(true)
-		}).optional()
-	}),
-	observed: z.object({
-		predicateResults: z.array(predicateResult),
-		snapshot: z.object({
-			url: z.string(),
-			title: z.string(),
-			visibleText: z.string(),
-			domHash: z.string(),
-			mutationCount: count.optional(),
-			requestCount: count.optional()
-		}),
-		error: z.string().optional()
-	}),
-	screenshotPath: z.string(),
-	provenance: z.object({
-		suite: z.string(),
-		modelVersion: z.string(),
-		modelHash: z.string(),
-		appBaseUrl: z.string(),
-		timestamp: z.string(),
-		traceFileRef: z.string()
-	}),
-	weakOracles: z.boolean()
-}).passthrough();
-const verificationPathSchema = z.object({
-	type: z.literal("path-result"),
-	id: z.string(),
-	status: z.enum(["passed", "failed"]),
-	witnessedStates: z.array(z.string()),
-	witnessedTransitions: z.array(z.string())
-}).passthrough();
-/** MBT version-one run report. Optional path/probe records support older reports. */
-const verificationRunReportSchema = z.object({
-	version: z.literal(1),
-	suite: z.string(),
-	status: z.enum(["passed", "failed"]),
-	verdict: z.enum([
-		"conformant",
-		"divergent",
-		"inconclusive"
-	]),
-	coverage: z.enum(["shortest", "simple"]),
-	scenario: z.string().optional(),
-	startedAt: z.iso.datetime({ offset: true }),
-	completedAt: z.iso.datetime({ offset: true }),
-	durationMs: z.number().nonnegative(),
-	exitCode: z.number().int(),
-	weakOracles: z.boolean(),
-	phases: z.array(z.object({
-		name: z.enum(["exploration", "verification"]),
-		status: z.enum(["completed", "skipped"]),
-		aiFree: z.boolean()
-	})),
-	probePlan: z.object({
-		cap: count,
-		totalCandidates: count,
-		samplingRule: z.string()
-	}),
-	metrics: z.object({
-		fitness: metric(z.number()).optional(),
-		precision: metric(z.number()),
-		soundnessRatio: metric(z.number()),
-		frontierSize: metric(z.number()),
-		determinism: metric(z.boolean())
-	}).passthrough(),
-	modelCoverage: verificationCoverageSchema,
-	executedCoverage: verificationCoverageSchema,
-	paths: z.array(verificationPathSchema).optional(),
-	probes: z.array(z.object({
-		type: z.literal("probe-result"),
-		id: z.string(),
-		state: z.string(),
-		event: z.string(),
-		status: z.enum(["passed", "failed"])
-	})).optional(),
-	divergences: z.array(verificationDivergenceSchema),
-	ledger: z.array(z.object({
-		type: z.literal("divergence"),
-		timestamp: z.string(),
-		divergence: verificationDivergenceSchema
-	}))
-}).passthrough().superRefine((report, context) => {
-	if (report.divergences.length > 0 !== (report.verdict === "divergent")) context.addIssue({
-		code: "custom",
-		path: ["verdict"],
-		message: "Verdict must agree with recorded divergences"
-	});
-	if (report.verdict === "conformant" && (report.status !== "passed" || report.exitCode !== 0 || report.paths?.some((item) => item.status === "failed") || report.probes?.some((item) => item.status === "failed") || report.metrics.determinism.value === false)) context.addIssue({
-		code: "custom",
-		path: ["verdict"],
-		message: "Conformant reports cannot contain failed execution results"
-	});
-	if (report.status === "passed" && (report.verdict !== "conformant" || report.exitCode !== 0)) context.addIssue({
-		code: "custom",
-		path: ["status"],
-		message: "A passed report requires a conformant verdict and zero exit code"
-	});
-});
-const verificationFailOnSchema = z.enum(["divergent", "inconclusive"]);
-/** References are inert data. The host resolves them inside its execution boundary. */
-const verificationRequestSchema = z.object({
-	model: z.discriminatedUnion("kind", [z.object({
-		kind: z.literal("source"),
-		content: z.string().min(1),
-		name: z.string().optional()
-	}), z.object({
-		kind: z.literal("machine"),
-		machineId: z.string().min(1)
-	})]),
-	bindings: z.object({
-		content: z.string(),
-		name: z.string().optional()
-	}).optional(),
-	baseline: z.discriminatedUnion("kind", [z.object({
-		kind: z.literal("report"),
-		report: verificationRunReportSchema
-	}), z.object({
-		kind: z.literal("reference"),
-		id: z.string().min(1)
-	})]).optional()
-});
-const verificationExecutionPolicy = {
-	aiFree: true,
-	network: "deny",
-	env: { MBT_VERIFY_AI_FREE: "1" }
-};
-/** Strict mode fails on divergences and inconclusive runs; default fails on divergences. */
-function verificationExitCode(report, failOn = "divergent") {
-	return report.verdict === "divergent" || failOn === "inconclusive" && report.verdict === "inconclusive" ? 1 : 0;
-}
-function verificationWitnessEvents(divergence) {
-	return (divergence.minimalWitness?.reproduced ? divergence.minimalWitness.steps : divergence.witness.path).map((step) => step.event.type);
-}
-function formatVerificationSummary(report) {
-	const violations = report.divergences.filter((item) => item.kind === "negative-probe").length;
-	return [`${report.verdict}: ${report.divergences.length} divergence(s), ${violations} negative-probe violation(s), ${report.executedCoverage.percent.overall}% executed coverage`, ...report.divergences.map((item) => `${item.id}: witness: [${verificationWitnessEvents(item).join(", ")}]`)].join("\n");
-}
-
-//#endregion
-//#region src/projectConfig.ts
-const STATELY_CONFIG_FILE = "statelyai.json";
-const STATELY_CONFIG_SCHEMA_URL = "https://stately.ai/schemas/statelyai.json";
-const STATELY_CONFIG_VERSION = "1.0.0";
-/**
-* Base URL of the deployment that hosts the owned resource contract
-* (`/api/v1/*`). Matches the SDK default.
-*/
-const DEFAULT_STATELY_API_BASE_URL = "https://editor.stately.ai";
-/**
-* Hosts of the legacy hosted Studio. `statelyai.json#studioUrl` values that
-* point at them predate the editor-hosted API and must be redirected.
-*/
-const HOSTED_STUDIO_HOSTNAMES = new Set(["stately.ai", "www.stately.ai"]);
-/**
-* Maps a configured `statelyai.json#studioUrl` (or a `--base-url` flag) to the
-* base URL of the editor API that serves our owned contract.
-*
-* Hosted legacy values (`https://stately.ai`, `http://www.stately.ai/`, ...)
-* resolve to {@link DEFAULT_STATELY_API_BASE_URL}. Anything else is used as-is
-* (minus trailing slashes): self-hosted editor deployments already point at the
-* server that hosts `/api/v1`.
-*
-* This is a read-only compatibility shim: the CLI never rewrites
-* `statelyai.json` because of it.
-*/
-function resolveApiBaseUrl(studioUrl) {
-	const trimmed = studioUrl?.trim();
-	if (!trimmed) return DEFAULT_STATELY_API_BASE_URL;
-	const parsed = tryParseUrl(trimmed) ?? tryParseUrl(`https://${trimmed}`);
-	if (parsed && HOSTED_STUDIO_HOSTNAMES.has(parsed.hostname.toLowerCase())) return DEFAULT_STATELY_API_BASE_URL;
-	return trimmed.replace(/\/+$/, "");
-}
-function tryParseUrl(value) {
-	try {
-		return new URL(value);
-	} catch {
-		return;
-	}
-}
-const DEFAULT_SOURCE_EXCLUDES = ["**/*.test.*", "**/*.spec.*"];
-const CODE_SOURCE_EXTENSIONS = new Set([
-	".ts",
-	".tsx",
-	".js",
-	".jsx",
-	".mts",
-	".cts",
-	".mjs",
-	".cjs"
-]);
-const execFileAsync$1 = promisify(execFile);
-const ALWAYS_IGNORED_DIRECTORIES = new Set([
-	".git",
-	"node_modules",
-	"dist",
-	"build",
-	"out",
-	"coverage",
-	".next"
-]);
-function createStatelyProjectConfig(options) {
-	const defaultXStateVersion = options.defaultXStateVersion ?? 5;
-	return {
-		$schema: STATELY_CONFIG_SCHEMA_URL,
-		version: STATELY_CONFIG_VERSION,
-		projectId: options.projectId ?? "",
-		studioUrl: options.studioUrl ?? "https://stately.ai",
-		defaultXStateVersion,
-		include: [],
-		exclude: [...DEFAULT_SOURCE_EXCLUDES]
-	};
-}
-async function writeStatelyProjectConfig(configPath, config) {
-	const serialized = { ...config };
-	if (!config.projectId) {
-		delete serialized.projectId;
-		delete serialized.studioUrl;
-	}
-	await fsPromises.writeFile(configPath, `${JSON.stringify(serialized, null, 2)}\n`, "utf8");
-}
-function normalizeProjectConfig(config) {
-	const firstSource = config.sources?.[0];
-	return {
-		$schema: config.$schema ?? STATELY_CONFIG_SCHEMA_URL,
-		version: config.version ?? STATELY_CONFIG_VERSION,
-		projectId: config.projectId ?? "",
-		studioUrl: config.studioUrl ?? "https://stately.ai",
-		defaultXStateVersion: Math.max(5, config.defaultXStateVersion ?? 5),
-		...config.sourceUpdateStrategy === "preserve" || config.sourceUpdateStrategy === "rewrite" ? { sourceUpdateStrategy: config.sourceUpdateStrategy } : {},
-		include: [...config.include ?? firstSource?.include ?? []],
-		exclude: config.exclude == null ? [...firstSource?.exclude ?? DEFAULT_SOURCE_EXCLUDES] : [...config.exclude],
-		...config.newMachinesDir ? { newMachinesDir: config.newMachinesDir } : {}
-	};
-}
-function getConfigRewriteStatus(config) {
-	if (!config.sources) return { needsRewrite: false };
-	if (config.sources.length > 1) return {
-		needsRewrite: true,
-		reason: "multiple-legacy-sources"
-	};
-	return {
-		needsRewrite: true,
-		reason: "legacy-sources"
-	};
-}
-async function readStatelyProjectConfig(options = {}) {
-	const rootDir = path.resolve(options.cwd ?? process.cwd());
-	const configPath = path.resolve(rootDir, options.configPath ?? STATELY_CONFIG_FILE);
-	const raw = await fsPromises.readFile(configPath, "utf8");
-	const parsed = JSON.parse(raw);
-	const config = normalizeProjectConfig(parsed);
-	const rewriteStatus = getConfigRewriteStatus(parsed);
-	if (options.rewriteIfNeeded && rewriteStatus.reason === "legacy-sources") {
-		await writeStatelyProjectConfig(configPath, config);
-		return {
-			config,
-			configPath,
-			rootDir,
-			rewriteStatus: {
-				needsRewrite: false,
-				rewritten: true
-			}
-		};
-	}
-	return {
-		config,
-		configPath,
-		rootDir,
-		rewriteStatus
-	};
-}
-async function walkFiles(rootDir, currentDir = rootDir) {
-	const entries = await fsPromises.readdir(currentDir, { withFileTypes: true });
-	const files = [];
-	for (const entry of entries) {
-		if (ALWAYS_IGNORED_DIRECTORIES.has(entry.name)) continue;
-		const absolutePath = path.join(currentDir, entry.name);
-		if (entry.isDirectory()) {
-			files.push(...await walkFiles(rootDir, absolutePath));
-			continue;
-		}
-		if (!entry.isFile()) continue;
-		files.push(path.relative(rootDir, absolutePath).replace(/\\/g, "/"));
-	}
-	return files;
-}
-async function filterGitIgnoredPaths(rootDir, relativeFiles) {
-	if (relativeFiles.length === 0) return relativeFiles;
-	try {
-		const { stdout } = await execFileAsync$1("git", ["check-ignore", ...relativeFiles], { cwd: rootDir });
-		const ignoredEntries = stdout.split(/\r?\n/).map((entry) => entry.trim()).filter(Boolean);
-		if (ignoredEntries.length === 0) return relativeFiles;
-		const ignoredPaths = new Set(ignoredEntries);
-		return relativeFiles.filter((relativePath) => {
-			return !ignoredPaths.has(relativePath);
-		});
-	} catch {
-		return relativeFiles;
-	}
-}
-function isCodeSourceFile(relativePath) {
-	return CODE_SOURCE_EXTENSIONS.has(path.extname(relativePath).toLowerCase());
-}
-function expandBraces(pattern) {
-	const match = pattern.match(/\{([^{}]+)\}/);
-	if (!match || match.index == null) return [pattern];
-	const [token, inner] = match;
-	return inner.split(",").flatMap((variant) => expandBraces(`${pattern.slice(0, match.index)}${variant}${pattern.slice(match.index + token.length)}`));
-}
-function globToRegExp(pattern) {
-	let regex = "^";
-	for (let index = 0; index < pattern.length; index += 1) {
-		const char = pattern[index];
-		const next = pattern[index + 1];
-		if (char === "*") {
-			if (next === "*") {
-				const slashAfterGlobstar = pattern[index + 2] === "/";
-				regex += slashAfterGlobstar ? "(?:.*/)?" : ".*";
-				index += slashAfterGlobstar ? 2 : 1;
-				continue;
-			}
-			regex += "[^/]*";
-			continue;
-		}
-		if (char === "?") {
-			regex += "[^/]";
-			continue;
-		}
-		if ("\\.[]{}()+-^$|".includes(char)) {
-			regex += `\\${char}`;
-			continue;
-		}
-		regex += char;
-	}
-	regex += "$";
-	return new RegExp(regex);
-}
-function matchesGlob(relativePath, pattern) {
-	return expandBraces(pattern).some((expanded) => globToRegExp(expanded).test(relativePath));
-}
-function matchesAny(patterns, relativePath) {
-	return (patterns ?? []).some((pattern) => matchesGlob(relativePath, pattern));
-}
-function isTrackedByStatelyProjectConfig(config, relativePath) {
-	return matchesAny(config.include, relativePath) && !matchesAny(config.exclude ?? DEFAULT_SOURCE_EXCLUDES, relativePath);
-}
-async function discoverCodeSourceFiles(options = {}) {
-	const rootDir = path.resolve(options.cwd ?? process.cwd());
-	return (await filterGitIgnoredPaths(rootDir, await walkFiles(rootDir))).filter((relativePath) => isCodeSourceFile(relativePath)).filter((relativePath) => !matchesAny(DEFAULT_SOURCE_EXCLUDES, relativePath)).sort((left, right) => left.localeCompare(right));
-}
-function createSuggestedConfig(include) {
-	return {
-		include: [include],
-		exclude: [...DEFAULT_SOURCE_EXCLUDES]
-	};
-}
-function toExtensionToken(extname) {
-	return extname.startsWith(".") ? extname.slice(1) : extname;
-}
-function formatExtensionPattern(extnames) {
-	const unique = [...new Set(extnames.map(toExtensionToken))].sort();
-	if (unique.length === 1) return `.${unique[0]}`;
-	return `.{${unique.join(",")}}`;
-}
-function getSuggestionRoot(relativePath) {
-	if (relativePath.startsWith("src/")) return "src/";
-	const packageMatch = relativePath.match(/^packages\/([^/]+)\/src\//);
-	if (packageMatch) return `packages/${packageMatch[1]}/src/`;
-	const appMatch = relativePath.match(/^apps\/([^/]+)\/src\//);
-	if (appMatch) return `apps/${appMatch[1]}/src/`;
-	return null;
-}
-function getCommonDirectory(relativePaths) {
-	const [firstDirectory, ...remainingDirectories] = relativePaths.map((relativePath) => path.posix.dirname(relativePath).split("/"));
-	if (!firstDirectory) return;
-	const commonSegments = [];
-	for (const [index, segment] of firstDirectory.entries()) {
-		if (!remainingDirectories.every((directory) => directory[index] === segment)) break;
-		commonSegments.push(segment);
-	}
-	return commonSegments.length > 0 ? commonSegments.join("/") : void 0;
-}
-function suggestGroupedInclude(relativePaths, root) {
-	const extPattern = formatExtensionPattern(relativePaths.map((relativePath) => path.posix.extname(relativePath)));
-	if (relativePaths.map((relativePath) => path.posix.basename(relativePath, path.posix.extname(relativePath))).every((basename) => basename.toLowerCase().endsWith("machine"))) return `${root}**/*machine${extPattern}`;
-	const commonDirectory = getCommonDirectory(relativePaths);
-	if (commonDirectory) return `${commonDirectory}/${relativePaths.every((relativePath) => path.posix.dirname(relativePath) === commonDirectory) ? "*" : "**/*"}${extPattern}`;
-	return `${root}**/*${extPattern}`;
-}
-function suggestStatelySourceConfigs(relativePaths) {
-	const pending = new Set(relativePaths.map((relativePath) => relativePath.replace(/\\/g, "/")).filter(Boolean));
-	const suggestions = [];
-	const addSuggestion = (include, predicate) => {
-		const matched = [...pending].filter(predicate);
-		if (matched.length === 0) return;
-		suggestions.push(createSuggestedConfig(include));
-		for (const matchedPath of matched) pending.delete(matchedPath);
-	};
-	const groupedRoots = /* @__PURE__ */ new Map();
-	for (const relativePath of pending) {
-		const root = getSuggestionRoot(relativePath);
-		if (!root) continue;
-		const bucket = groupedRoots.get(root) ?? [];
-		bucket.push(relativePath);
-		groupedRoots.set(root, bucket);
-	}
-	for (const [root, groupedPaths] of [...groupedRoots.entries()].sort((left, right) => left[0].localeCompare(right[0]))) addSuggestion(suggestGroupedInclude(groupedPaths, root), (relativePath) => groupedPaths.includes(relativePath));
-	const byDirectory = /* @__PURE__ */ new Map();
-	for (const relativePath of pending) {
-		const directory = path.posix.dirname(relativePath);
-		const key = directory === "." ? relativePath : directory;
-		const bucket = byDirectory.get(key) ?? [];
-		bucket.push(relativePath);
-		byDirectory.set(key, bucket);
-	}
-	for (const [key, matchedPaths] of [...byDirectory.entries()].sort((left, right) => left[0].localeCompare(right[0]))) {
-		if (matchedPaths.length > 1 && key !== "." && key !== matchedPaths[0]) {
-			addSuggestion(`${key}/**/*.{ts,tsx,js,jsx,mts,cts,mjs,cjs}`, (relativePath) => relativePath.startsWith(`${key}/`));
-			continue;
-		}
-		const exactPath = matchedPaths[0];
-		addSuggestion(exactPath, (relativePath) => relativePath === exactPath);
-	}
-	return suggestions;
-}
-async function discoverStatelySourceFiles(options = {}) {
-	const { config, rootDir } = options.config ? {
-		config: options.config,
-		rootDir: path.resolve(options.cwd ?? process.cwd())
-	} : await readStatelyProjectConfig(options);
-	const relativeFiles = await filterGitIgnoredPaths(rootDir, await walkFiles(rootDir));
-	const discovered = /* @__PURE__ */ new Map();
-	const source = {
-		include: config.include,
-		exclude: config.exclude ?? DEFAULT_SOURCE_EXCLUDES,
-		format: "xstate",
-		xstateVersion: config.defaultXStateVersion
-	};
-	for (const relativePath of relativeFiles) {
-		if (!matchesAny(source.include, relativePath)) continue;
-		if (matchesAny(source.exclude, relativePath)) continue;
-		const filePath = path.join(rootDir, relativePath);
-		if (!discovered.has(filePath)) discovered.set(filePath, {
-			filePath,
-			relativePath,
-			source
-		});
-	}
-	return [...discovered.values()].sort((left, right) => left.relativePath.localeCompare(right.relativePath));
-}
-
-//#endregion
-//#region src/verificationJUnit.ts
-function xml(text) {
-	return text.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\uFFFE\uFFFF]/gu, "�").replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&apos;");
-}
-/** One case per recorded path/probe. Unattributed divergences remain separate cases. */
-function formatVerificationJUnit(report) {
-	if (!report.paths) throw new Error("JUnit requires path records. This report predates path reporting.");
-	const records = [...report.paths, ...report.probes ?? []];
-	const counts = /* @__PURE__ */ new Map();
-	for (const record of records) counts.set(record.id, (counts.get(record.id) ?? 0) + 1);
-	const hasUniqueRecord = (id) => id !== void 0 && counts.get(id) === 1;
-	const cases = [];
-	let errors = 0;
-	const failures = (items) => items.map((item) => `<failure type="${xml(item.kind)}" message="${xml(`${item.id}; witness: [${verificationWitnessEvents(item).join(", ")}]`)}">${xml(item.observed.error ?? `Expected ${item.expected.state}`)}</failure>`).join("");
-	for (const record of records) {
-		const divergences = report.divergences.filter((item) => item.pathId === record.id && hasUniqueRecord(item.pathId));
-		const failedWithoutWitness = record.status === "failed" && !divergences.length;
-		if (failedWithoutWitness) errors++;
-		cases.push(`<testcase name="${xml(record.id)}" classname="${xml(report.suite)}">${failures(divergences)}${failedWithoutWitness ? "<error type=\"unattributed_path_failure\" message=\"Path failed without a linked divergence; consult the run report.\"/>" : ""}</testcase>`);
-	}
-	for (const item of report.divergences.filter((item) => !hasUniqueRecord(item.pathId))) cases.push(`<testcase name="${xml(item.id)}" classname="${xml(report.suite)}">${failures([item])}</testcase>`);
-	if (report.verdict === "inconclusive" || report.status === "failed" && !errors && !report.divergences.length) {
-		errors++;
-		cases.push("<testcase name=\"verification incomplete\"><error type=\"inconclusive\" message=\"Verification did not produce a conclusive successful run.\"/></testcase>");
-	}
-	return `<?xml version="1.0" encoding="UTF-8"?>\n<testsuite name="${xml(report.suite)}" tests="${cases.length}" failures="${report.divergences.length}" errors="${errors}" time="${report.durationMs / 1e3}">\n${cases.join("\n")}\n</testsuite>\n`;
-}
-
-//#endregion
-//#region src/verification.ts
-const maxInputBytes = 10 * 1024 * 1024;
-async function readInput(file) {
-	if ((await fsPromises.stat(file)).size > maxInputBytes) throw new Error(`Verification input exceeds ${maxInputBytes} bytes: ${file}`);
-	return fsPromises.readFile(file, "utf8");
-}
-async function localFile(root, reference) {
-	const file = path.resolve(root, reference);
-	try {
-		if (!(await fsPromises.stat(file)).isFile()) throw new Error(`Not a file: ${reference}`);
-		return file;
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-		if (reference.includes("/") || reference.includes("\\") || path.extname(reference) || reference.startsWith(".")) throw new Error(`Verification input not found: ${reference}`);
-		return;
-	}
-}
-/** Read local source as data; never import or execute model/bindings modules. */
-async function resolveVerificationRequest(options) {
-	const cwd = path.resolve(options.cwd ?? process.cwd());
-	const inputFiles = [];
-	let model = options.model;
-	if (!model) {
-		const project = await readStatelyProjectConfig({
-			cwd,
-			configPath: options.configPath
-		});
-		const files = await discoverStatelySourceFiles({
-			cwd: project.rootDir,
-			config: project.config
-		});
-		if (files.length !== 1) throw new Error(`Expected one configured model, found ${files.length}. Select one with --model.`);
-		model = files[0].filePath;
-	}
-	const modelFile = await localFile(cwd, model);
-	const request = { model: modelFile ? {
-		kind: "source",
-		content: await readInput(modelFile),
-		name: path.basename(modelFile)
-	} : {
-		kind: "machine",
-		machineId: model.replace(/^machine:/, "")
-	} };
-	if (modelFile) inputFiles.push(modelFile);
-	if (options.bindings) {
-		const file = path.resolve(cwd, options.bindings);
-		request.bindings = {
-			content: await readInput(file),
-			name: path.basename(file)
-		};
-		inputFiles.push(file);
-	}
-	if (options.baseline) {
-		const file = await localFile(cwd, options.baseline);
-		request.baseline = file ? {
-			kind: "report",
-			report: verificationRunReportSchema.parse(JSON.parse(await readInput(file)))
-		} : {
-			kind: "reference",
-			id: options.baseline
-		};
-		if (file) inputFiles.push(file);
-	}
-	return {
-		request: verificationRequestSchema.parse(request),
-		inputFiles
-	};
-}
-async function verifyProject(options = {}) {
-	const cwd = path.resolve(options.cwd ?? process.cwd());
-	let report;
-	let inputFiles;
-	if (options.fromReport) {
-		if (options.model || options.bindings || options.baseline || options.configPath) throw new Error("--from-report cannot be combined with model, bindings, baseline, or config inputs.");
-		const file = path.resolve(cwd, options.fromReport);
-		report = verificationRunReportSchema.parse(JSON.parse(await readInput(file)));
-		inputFiles = [file];
-	} else {
-		if (!options.execute) throw new Error("Live verification is not configured. Use --from-report <file> to process an existing run report, or supply a VerificationExecutor to verifyProject().");
-		const resolved = await resolveVerificationRequest(options);
-		inputFiles = resolved.inputFiles;
-		report = verificationRunReportSchema.parse(await options.execute(resolved.request, verificationExecutionPolicy));
-	}
-	const format = options.reportFormat ?? "json";
-	const output = format === "junit" ? formatVerificationJUnit(report) : `${JSON.stringify(report, null, 2)}\n`;
-	const destination = options.report ?? `statelyai-verify-report.${format === "junit" ? "xml" : "json"}`;
-	if (destination !== "-") {
-		const file = path.resolve(cwd, destination);
-		const existing = await fsPromises.realpath(file).catch((error) => {
-			if (error.code === "ENOENT") return file;
-			throw error;
-		});
-		for (const input of inputFiles) if (existing === await fsPromises.realpath(input)) throw new Error("Report output cannot overwrite a verification input.");
-		await fsPromises.mkdir(path.dirname(file), { recursive: true });
-		await fsPromises.writeFile(file, output, "utf8");
-	}
-	return {
-		report,
-		output,
-		destination,
-		summary: `${options.fromReport ? "Saved report: " : ""}${formatVerificationSummary(report)}`,
-		exitCode: verificationExitCode(report, options.failOn)
-	};
-}
-
-//#endregion
-//#region src/verifyCommand.ts
-var VerifyCommand = class VerifyCommand extends Command {
-	static enableJsonFlag = false;
-	static summary = "Validate a verification report, print its verdict, and export JSON or JUnit.";
-	static description = "Saved-report processing works offline. Live execution requires a configured verification adapter.";
-	static flags = {
-		model: Flags.string({ description: "Model file or registry machine ID (live execution)" }),
-		bindings: Flags.string({ description: "Bindings file (live execution)" }),
-		baseline: Flags.string({ description: "Baseline report file or reference ID (live execution)" }),
-		config: Flags.string({ description: "Path to statelyai.json (live execution)" }),
-		"from-report": Flags.string({ description: "Process an existing run report without executing verification" }),
-		report: Flags.string({ description: "Output file, or - for stdout; defaults to statelyai-verify-report.json/xml" }),
-		"report-format": Flags.string({
-			options: ["json", "junit"],
-			default: "json"
-		}),
-		"fail-on": Flags.string({
-			options: ["divergent", "inconclusive"],
-			default: "divergent",
-			description: "inconclusive also fails on divergences"
-		})
-	};
-	async run() {
-		const { flags } = await this.parse(VerifyCommand);
-		let result;
-		try {
-			result = await verifyProject({
-				model: flags.model,
-				bindings: flags.bindings,
-				baseline: flags.baseline,
-				configPath: flags.config,
-				fromReport: flags["from-report"],
-				report: flags.report,
-				reportFormat: flags["report-format"],
-				failOn: flags["fail-on"]
-			});
-		} catch (error) {
-			this.error(error instanceof Error ? error.message : String(error), { exit: 2 });
-		}
-		this.log(result.destination === "-" ? result.output.trimEnd() : result.summary);
-		if (result.exitCode) this.exit(result.exitCode);
-	}
-};
-
-//#endregion
-//#region src/version.ts
-const CLI_VERSION = "0.11.4";
-
-//#endregion
-//#region src/cliHost.ts
-const DEFAULT_SYNC_MAX_FILES = 150;
-const DEFAULT_SYNC_MAX_BYTES = 2e6;
-const supportedDocumentPattern = /\.(?:c|m)?(?:jsx?|tsx?)$|\.jsonc?$|\.ya?ml$|\.mmd$|\.mermaid$/i;
-var WebSocketClient = class {
-	listeners = /* @__PURE__ */ new Set();
-	constructor(socket) {
-		this.socket = socket;
-		socket.on("message", (data, isBinary) => {
-			if (isBinary) return;
-			let message;
-			try {
-				message = JSON.parse(rawDataToBuffer(data).toString("utf8"));
-			} catch {
-				socket.close(1007, "Invalid JSON payload");
-				return;
-			}
-			for (const listener of this.listeners) listener(message);
-		});
-	}
-	onMessage(listener) {
-		this.listeners.add(listener);
-	}
-	send(message) {
-		if (this.socket.readyState === WebSocket.OPEN) this.socket.send(JSON.stringify(message));
-	}
-	close() {
-		if (this.socket.readyState === WebSocket.OPEN || this.socket.readyState === WebSocket.CONNECTING) this.socket.close();
-	}
-};
-function rawDataToBuffer(data) {
-	if (Array.isArray(data)) return Buffer.concat(data);
-	if (data instanceof ArrayBuffer) return Buffer.from(data);
-	return Buffer.from(data);
-}
-var RemoteEditorSession = class {
-	session;
-	workspaceWatcher;
-	constructor(options, sendMessage) {
-		this.options = options;
-		const send = (message) => {
-			this.log("send", message.type, message);
-			sendMessage(message);
-		};
-		const machines = options.machines ?? [{
-			id: `${options.rootUri}#0`,
-			fileName: options.fileName,
-			machineIndex: 0
-		}];
-		this.workspaceWatcher = createSharedWorkspaceWatcher(options.rootDir);
-		this.session = new EditorHostWorkspaceSession({
-			machines: machines.map((machine) => ({
-				id: machine.id,
-				name: machine.name,
-				source: {
-					rootUri: fileNameToUri(machine.fileName),
-					rootFileName: machine.fileName,
-					rootDir: options.rootDir,
-					machineIndex: machine.machineIndex,
-					collectDocuments: (extraUris) => collectSourceDocuments({
-						rootFileName: machine.fileName,
-						extraUris: [...extraUris ?? []]
-					}),
-					applyReplacements: async (replacements, rootUri) => {
-						await applyFileReplacements(replacements, rootUri);
-						return [...new Set(replacements.map((replacement) => replacement.uri ?? rootUri))];
-					},
-					watchSavedDocuments: (listener) => this.workspaceWatcher.subscribe(listener)
-				}
-			})),
-			currentMachineId: machines[0]?.id,
-			workspaceName: path$1.basename(options.rootDir),
-			projectWorkspaceOpen: false,
-			sourceUpdateStrategy: options.sourceUpdateStrategy ?? "preserve",
-			sync: createRemoteEditorSyncBackend({
-				editorUrl: options.editorUrl,
-				apiKey: options.apiKey,
-				fetch: (input, init) => fetchEditorHost(input instanceof URL ? input : new URL(String(input)), init)
-			}),
-			send,
-			apiKey: options.apiKey,
-			client: {
-				name: "statelyai",
-				version: CLI_VERSION
-			},
-			showError: (message) => console.error(`Stately Editor: ${message}`)
-		});
-	}
-	receiveMessage(message) {
-		this.log("recv", message.type, message);
-		return this.session.receive(message);
-	}
-	dispose() {
-		this.session.dispose();
-		this.workspaceWatcher.dispose();
-	}
-	log(direction, type, payload) {
-		if (this.options.debug) console.error(`[${direction}] ${type}`, redactDebugPayload(payload) ?? "");
-	}
-};
-function redactDebugPayload(payload) {
-	if (Array.isArray(payload)) return payload.map(redactDebugPayload);
-	if (!payload || typeof payload !== "object") return payload;
-	return Object.fromEntries(Object.entries(payload).map(([key, value]) => [key, /^(?:apiKey|accessToken|refreshToken|token|authorization)$/i.test(key) ? "[REDACTED]" : redactDebugPayload(value)]));
-}
-async function openEditor(options) {
-	const fileName = path$1.resolve(options.fileName);
-	const machines = (options.machines ?? [{
-		id: `${fileNameToUri(fileName)}#0`,
-		fileName,
-		machineIndex: 0
-	}]).map((machine) => ({
-		...machine,
-		fileName: path$1.resolve(machine.fileName)
-	}));
-	await Promise.all([...new Set(machines.map((machine) => machine.fileName))].map((target) => fsPromises.access(target)));
-	await assertEditorHostAvailable(options.editorUrl);
-	const rootUri = fileNameToUri(fileName);
-	const rootDir = path$1.resolve(options.rootDir ?? path$1.dirname(fileName));
-	let activeClient;
-	let session;
-	const server = http.createServer((request, response) => {
-		if (new URL(request.url ?? "/", `http://${request.headers.host}`).pathname !== "/") {
-			response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-			response.end("Not found");
-			return;
-		}
-		response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-		response.end(getCliWebviewContent({ editorUrl: options.editorUrl }));
-	});
-	const webSocketServer = new WebSocketServer({ noServer: true });
-	server.on("upgrade", (request, socket, head) => {
-		if (request.url !== "/ws") {
-			socket.end("HTTP/1.1 404 Not Found\r\n\r\n");
-			return;
-		}
-		webSocketServer.handleUpgrade(request, socket, head, (webSocket) => {
-			activeClient?.close();
-			session?.dispose();
-			activeClient = new WebSocketClient(webSocket);
-			session = new RemoteEditorSession({
-				...options,
-				fileName,
-				machines,
-				rootUri,
-				rootDir
-			}, (message) => activeClient?.send(message));
-			activeClient.onMessage((message) => {
-				session?.receiveMessage(message);
-			});
-		});
-	});
-	await listen(server, options.port, options.host);
-	const address = server.address();
-	const port = typeof address === "object" && address ? address.port : options.port;
-	const editorPageUrl = `http://${options.host}:${port}`;
-	console.log(`Stately visual editor: ${editorPageUrl}`);
-	console.log(`Editing ${machines.length} machine${machines.length === 1 ? "" : "s"} in ${rootDir}`);
-	if (options.shouldOpen) openBrowser(editorPageUrl);
-	const shutdown = () => {
-		session?.dispose();
-		activeClient?.close();
-		webSocketServer.close();
-		server.close();
-	};
-	process.once("SIGINT", () => {
-		shutdown();
-		process.exit(0);
-	});
-	process.once("SIGTERM", () => {
-		shutdown();
-		process.exit(0);
-	});
-}
-async function collectSourceDocuments(options) {
-	const maxFiles = Number.parseInt(process.env.STATELY_SYNC_MAX_FILES ?? "", 10) || DEFAULT_SYNC_MAX_FILES;
-	const maxBytes = Number.parseInt(process.env.STATELY_SYNC_MAX_BYTES ?? "", 10) || DEFAULT_SYNC_MAX_BYTES;
-	const documents = /* @__PURE__ */ new Map();
-	const queue = [];
-	let totalBytes = 0;
-	for (const fileName of [options.rootFileName, ...(options.extraUris ?? []).map(sourceUriToFileName)]) {
-		const document = await openSourceDocument(fileName);
-		if (document) addDocument(document);
-	}
-	let packageDirectory = path$1.dirname(path$1.resolve(options.rootFileName));
-	while (true) {
-		const packageDocument = await openSourceDocument(path$1.join(packageDirectory, "package.json"));
-		if (packageDocument) addDocument(packageDocument);
-		const parent = path$1.dirname(packageDirectory);
-		if (parent === packageDirectory) break;
-		packageDirectory = parent;
-	}
-	for (let index = 0; index < queue.length; index++) {
-		const document = queue[index];
-		if (path$1.basename(document.fileName) === "package.json") continue;
-		for (const specifier of collectRelativeImportSpecifiers(document.text, document.fileName)) for (const candidate of resolveRelativeImportCandidates(document.fileName, specifier)) {
-			if (documents.has(path$1.resolve(candidate))) break;
-			const importedDocument = await openSourceDocument(candidate);
-			if (!importedDocument) continue;
-			addDocument(importedDocument);
-			break;
-		}
-	}
-	return [...documents.values()];
-	function addDocument(document) {
-		const normalizedFileName = path$1.resolve(document.fileName);
-		if (documents.has(normalizedFileName)) return;
-		if (documents.size >= maxFiles) throw new Error(`Source payload exceeds ${maxFiles} reachable files.`);
-		const byteLength = Buffer.byteLength(document.text);
-		if (totalBytes + byteLength > maxBytes) throw new Error(`Source payload exceeds ${maxBytes} bytes.`);
-		documents.set(normalizedFileName, document);
-		queue.push(document);
-		totalBytes += byteLength;
-	}
-}
-async function openSourceDocument(fileName) {
-	if (!isSupportedDocument(fileName)) return null;
-	const text = await fsPromises.readFile(fileName, "utf8").catch(() => null);
-	return text === null ? null : {
-		uri: fileNameToUri(fileName),
-		fileName,
-		text
-	};
-}
-function collectRelativeImportSpecifiers(text, fileName) {
-	const sourceFile = ts.createSourceFile(fileName, text, ts.ScriptTarget.Latest, true, getScriptKind(fileName));
-	const specifiers = [];
-	for (const statement of sourceFile.statements) {
-		const moduleSpecifier = ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement) ? statement.moduleSpecifier : void 0;
-		if (moduleSpecifier && ts.isStringLiteral(moduleSpecifier) && moduleSpecifier.text.startsWith(".")) specifiers.push(moduleSpecifier.text);
-	}
-	return specifiers;
-}
-const importExtensions = [
-	".ts",
-	".tsx",
-	".js",
-	".jsx",
-	".mjs",
-	".cjs",
-	".mts",
-	".cts"
-];
-function resolveRelativeImportCandidates(fromFileName, specifier) {
-	const basePath = path$1.resolve(path$1.dirname(fromFileName), specifier);
-	if (path$1.extname(basePath)) return [basePath];
-	return [
-		basePath,
-		...importExtensions.map((extension) => `${basePath}${extension}`),
-		...importExtensions.map((extension) => path$1.join(basePath, `index${extension}`))
-	];
-}
-function getScriptKind(fileName) {
-	if (fileName.endsWith(".tsx")) return ts.ScriptKind.TSX;
-	if (fileName.endsWith(".jsx")) return ts.ScriptKind.JSX;
-	if (/\.(?:c|m)?js$/.test(fileName)) return ts.ScriptKind.JS;
-	return ts.ScriptKind.TS;
-}
-function isSupportedDocument(fileName) {
-	return supportedDocumentPattern.test(fileName);
-}
-async function applyFileReplacements(replacements, defaultUri) {
-	const replacementsByUri = /* @__PURE__ */ new Map();
-	for (const replacement of replacements) {
-		const uri = replacement.uri ?? defaultUri;
-		const existing = replacementsByUri.get(uri) ?? [];
-		existing.push(replacement);
-		replacementsByUri.set(uri, existing);
-	}
-	for (const [uri, uriReplacements] of replacementsByUri) {
-		const fileName = sourceUriToFileName(uri);
-		const nextText = applyReplacementsToText(await fsPromises.readFile(fileName, "utf8"), uriReplacements);
-		await fsPromises.writeFile(fileName, nextText, "utf8");
-	}
-}
-function applyReplacementsToText(text, replacements) {
-	let updated = text;
-	const sorted = [...replacements].sort(compareReplacementRangesDescending);
-	for (const replacement of sorted) {
-		const lineStarts = getLineStarts(updated);
-		const start = offsetAt(lineStarts, replacement.range.startLine, replacement.range.startChar);
-		const end = offsetAt(lineStarts, replacement.range.endLine, replacement.range.endChar);
-		updated = `${updated.slice(0, start)}${replacement.newText}${updated.slice(end)}`;
-	}
-	return updated;
-}
-function watchWorkspace(rootDir, listener) {
-	let watcher;
-	const timers = /* @__PURE__ */ new Map();
-	const queue = (fileName) => {
-		const existing = timers.get(fileName);
-		if (existing) clearTimeout(existing);
-		timers.set(fileName, setTimeout(() => {
-			timers.delete(fileName);
-			listener(fileNameToUri(fileName));
-		}, 75));
-	};
-	try {
-		watcher = watch(rootDir, { recursive: true }, (_event, fileName) => {
-			if (fileName) queue(path$1.join(rootDir, fileName.toString()));
-		});
-	} catch {
-		watcher = watch(rootDir, (_event, fileName) => {
-			if (fileName) queue(path$1.join(rootDir, fileName.toString()));
-		});
-	}
-	return { dispose() {
-		watcher?.close();
-		for (const timer of timers.values()) clearTimeout(timer);
-		timers.clear();
-	} };
-}
-function createSharedWorkspaceWatcher(rootDir) {
-	const listeners = /* @__PURE__ */ new Set();
-	const watcher = watchWorkspace(rootDir, (uri) => {
-		for (const listener of listeners) listener(uri);
-	});
-	return {
-		subscribe(listener) {
-			listeners.add(listener);
-			return { dispose: () => listeners.delete(listener) };
-		},
-		dispose() {
-			listeners.clear();
-			watcher.dispose();
-		}
-	};
-}
-function getCliWebviewContent(options) {
-	const baseUrl = normalizedBaseUrl(options.editorUrl);
-	const url = new URL(`${baseUrl}/embed`);
-	url.searchParams.set("auth", "message");
-	return `<!DOCTYPE html>
-<html lang="en" style="height:100%;margin:0">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <style>
-    body { margin: 0; padding: 0; height: 100vh; overflow: hidden; }
-    iframe { border: 0; width: 100%; height: 100%; display: block; }
-  </style>
-</head>
-<body>
-  <iframe
-    id="stately-editor"
-    src="${escapeAttribute(url.toString())}"
-    allow="clipboard-read; clipboard-write"
-  ></iframe>
-  <script>
-    const iframe = document.getElementById('stately-editor');
-    const socket = new WebSocket(
-      (location.protocol === 'https:' ? 'wss:' : 'ws:') + '//' + location.host + '/ws'
-    );
-    const pending = [];
-
-    function sendToCli(message) {
-      if (socket.readyState === WebSocket.OPEN) {
-        socket.send(JSON.stringify(message));
-        return;
-      }
-      pending.push(message);
-    }
-
-    socket.addEventListener('open', () => {
-      while (pending.length > 0) {
-        socket.send(JSON.stringify(pending.shift()));
-      }
-    });
-
-    socket.addEventListener('message', (event) => {
-      iframe.contentWindow?.postMessage(JSON.parse(event.data), '*');
-    });
-
-    window.addEventListener('message', (event) => {
-      if (!event.data?.type?.startsWith?.('@statelyai.')) {
-        return;
-      }
-      sendToCli(event.data);
-    });
-  <\/script>
-</body>
-</html>`;
-}
-function listen(server, port, host) {
-	return new Promise((resolve) => {
-		server.listen(port, host, resolve);
-	});
-}
-async function fetchEditorHost(input, init) {
-	const url = typeof input === "string" ? new URL(input) : input;
-	return fetch(url, init);
-}
-async function assertEditorHostAvailable(editorUrl) {
-	const baseUrl = normalizedBaseUrl(editorUrl);
-	const embedUrl = new URL("/embed", baseUrl);
-	let response;
-	try {
-		response = await fetchEditorHost(embedUrl, { redirect: "manual" });
-	} catch (error) {
-		throw new Error(formatEditorHostError(baseUrl, void 0, error));
-	}
-	if (response.status === 404) throw new Error(formatEditorHostError(baseUrl, response.status));
-}
-function formatEditorHostError(baseUrl, status, cause) {
-	return `Cannot reach a usable editor host at ${baseUrl}.${status ? ` HTTP ${status} from /embed.` : ""}${cause instanceof Error && cause.message ? ` ${cause.message}` : ""} The CLI loads editor URL defaults from your environment, including \`.env.local\`. Start the editor host, set \`STATELY_EDITOR_URL\`, or pass \`--editor-url <url>\`.`;
-}
-function openBrowser(url) {
-	spawn(process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open", process.platform === "win32" ? [
-		"/c",
-		"start",
-		"",
-		url
-	] : [url], {
-		detached: true,
-		stdio: "ignore"
-	}).unref();
-}
-function fileNameToUri(fileName) {
-	return pathToFileURL(path$1.resolve(fileName)).toString();
-}
-function sourceUriToFileName(uriOrPath) {
-	if (uriOrPath.startsWith("file://")) return fileURLToPath(uriOrPath);
-	if (/^[a-z][a-z\d+.-]*:/i.test(uriOrPath)) throw new Error(`Unsupported non-file URI: ${uriOrPath}`);
-	return path$1.resolve(uriOrPath);
-}
-function getLineStarts(text) {
-	const lineStarts = [0];
-	for (let index = 0; index < text.length; index += 1) if (text.charCodeAt(index) === 10) lineStarts.push(index + 1);
-	return lineStarts;
-}
-function offsetAt(lineStarts, line, character) {
-	const lineStart = lineStarts[line];
-	if (lineStart === void 0) return lineStarts[lineStarts.length - 1] + character;
-	return lineStart + character;
-}
-function compareReplacementRangesDescending(left, right) {
-	if (left.range.startLine !== right.range.startLine) return right.range.startLine - left.range.startLine;
-	return right.range.startChar - left.range.startChar;
-}
-function normalizedBaseUrl(value) {
-	return value.replace(/\/+$/, "");
-}
-function escapeAttribute(value) {
-	return value.replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-}
-
-//#endregion
-//#region src/oauthCallbackServer.ts
-async function createLocalOAuthCallbackServer(options) {
-	let resolveCode;
-	let rejectCode;
-	const codePromise = new Promise((resolve, reject) => {
-		resolveCode = resolve;
-		rejectCode = reject;
-	});
-	const server = http.createServer((req, res) => {
-		const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
-		const code = requestUrl.searchParams.get("code");
-		const state = requestUrl.searchParams.get("state");
-		const error = requestUrl.searchParams.get("error");
-		res.setHeader("Content-Type", "text/html; charset=utf-8");
-		res.setHeader("Connection", "close");
-		if (error) {
-			res.statusCode = 400;
-			res.end("<!doctype html><title>Sign in failed</title><p>Sign in failed. Return to the terminal.</p>");
-			rejectCode(new Error(error));
-			return;
-		}
-		if (!code || state !== options.state) {
-			res.statusCode = 400;
-			res.end("<!doctype html><title>Sign in failed</title><p>Invalid sign-in callback. Return to the terminal.</p>");
-			rejectCode(/* @__PURE__ */ new Error("Invalid OAuth callback."));
-			return;
-		}
-		res.end("<!doctype html><title>Signed in</title><p>Signed in. You can close this window.</p>");
-		resolveCode(code);
-	});
-	await new Promise((resolve) => {
-		server.listen(0, "127.0.0.1", resolve);
-	});
-	const address = server.address();
-	if (!address || typeof address === "string") throw new Error("Could not start OAuth callback server.");
-	return {
-		redirectUri: `http://127.0.0.1:${address.port}/callback`,
-		waitForCode: () => codePromise,
-		close: () => new Promise((resolve) => {
-			server.close(() => resolve());
-		})
-	};
-}
-
-//#endregion
-//#region src/credentials.ts
-const execFile$1 = promisify(execFile);
-const SERVICE_NAME = "statelyai";
-const ACCOUNT_NAME = "api-key";
-const CREDENTIALS_FILE_NAME = "credentials.json";
-function getConfigDir() {
-	const override = process.env.STATELYAI_CONFIG_DIR;
-	if (override) return path.resolve(override);
-	if (process.platform === "darwin") return path.join(os.homedir(), "Library", "Application Support", SERVICE_NAME);
-	if (process.platform === "win32") return path.join(process.env.APPDATA ?? path.join(os.homedir(), "AppData", "Roaming"), SERVICE_NAME);
-	return path.join(process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), SERVICE_NAME);
-}
-function getCredentialsFilePath() {
-	return path.join(getConfigDir(), CREDENTIALS_FILE_NAME);
-}
-function shouldUseFileBackendOnly() {
-	return process.env.STATELYAI_CREDENTIALS_BACKEND === "file" || process.env.STATELYAI_CONFIG_DIR !== void 0;
-}
-function parseStoredCredential(raw, backend, location) {
-	try {
-		const parsed = JSON.parse(raw);
-		if (typeof parsed.apiKey === "string" && parsed.apiKey.length > 0) return {
-			credential: {
-				type: "api_key",
-				token: parsed.apiKey
-			},
-			backend,
-			location
-		};
-		if (parsed.authMode === "none") return {
-			authMode: "none",
-			backend,
-			location
-		};
-		if (typeof parsed.credential === "object" && parsed.credential !== null && "type" in parsed.credential) {
-			const credential = parsed.credential;
-			if (credential.type === "api_key" && typeof credential.token === "string" && credential.token.length > 0) return {
-				credential: {
-					type: "api_key",
-					token: credential.token
-				},
-				backend,
-				location
-			};
-			if (credential.type === "oauth" && typeof credential.accessToken === "string" && credential.accessToken.length > 0) return {
-				credential: {
-					type: "oauth",
-					accessToken: credential.accessToken,
-					...typeof credential.refreshToken === "string" ? { refreshToken: credential.refreshToken } : {},
-					...typeof credential.expiresAt === "number" ? { expiresAt: credential.expiresAt } : {},
-					...typeof credential.clientId === "string" ? { clientId: credential.clientId } : {},
-					...typeof credential.tokenEndpoint === "string" ? { tokenEndpoint: credential.tokenEndpoint } : {}
-				},
-				backend,
-				location
-			};
-		}
-		return;
-	} catch {
-		const token = raw.trim();
-		if (!token) return;
-		return {
-			credential: {
-				type: "api_key",
-				token
-			},
-			backend,
-			location
-		};
-	}
-}
-async function readFileStoredCredential() {
-	try {
-		const credentialsPath = getCredentialsFilePath();
-		return parseStoredCredential(await promises.readFile(credentialsPath, "utf8"), "file", credentialsPath);
-	} catch {
-		return;
-	}
-}
-async function writeFileCredentials(apiKey) {
-	const stored = await writeFileStoredCredential({
-		type: "api_key",
-		token: apiKey
-	});
-	return {
-		apiKey,
-		backend: stored.backend,
-		location: stored.location
-	};
-}
-async function writeFileStoredCredential(credential) {
-	const configDir = getConfigDir();
-	const credentialsPath = getCredentialsFilePath();
-	const payload = {
-		version: 1,
-		credential
-	};
-	await promises.mkdir(configDir, {
-		recursive: true,
-		mode: 448
-	});
-	await promises.writeFile(credentialsPath, `${JSON.stringify(payload, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: 384
-	});
-	await promises.chmod(credentialsPath, 384);
-	return {
-		...credential ? { credential } : {},
-		backend: "file",
-		location: credentialsPath
-	};
-}
-async function deleteFileCredentials() {
-	try {
-		await promises.unlink(getCredentialsFilePath());
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function readMacOSStoredCredential() {
-	if (process.platform !== "darwin") return;
-	try {
-		const { stdout } = await execFile$1("security", [
-			"find-generic-password",
-			"-s",
-			SERVICE_NAME,
-			"-a",
-			ACCOUNT_NAME,
-			"-w"
-		]);
-		return parseStoredCredential(stdout, "macos-keychain", "macOS Keychain");
-	} catch {
-		return;
-	}
-}
-async function writeMacOSKeychain(apiKey) {
-	const stored = await writeMacOSStoredCredential({
-		type: "api_key",
-		token: apiKey
-	});
-	return stored ? {
-		apiKey,
-		backend: stored.backend,
-		location: stored.location
-	} : void 0;
-}
-async function writeMacOSStoredCredential(credential) {
-	if (process.platform !== "darwin") return;
-	const payload = {
-		version: 1,
-		credential
-	};
-	try {
-		await execFile$1("security", [
-			"add-generic-password",
-			"-U",
-			"-s",
-			SERVICE_NAME,
-			"-a",
-			ACCOUNT_NAME,
-			"-w",
-			JSON.stringify(payload)
-		]);
-		return {
-			...credential ? { credential } : {},
-			backend: "macos-keychain",
-			location: "macOS Keychain"
-		};
-	} catch {
-		return;
-	}
-}
-async function deleteMacOSKeychain() {
-	if (process.platform !== "darwin") return false;
-	try {
-		await execFile$1("security", [
-			"delete-generic-password",
-			"-s",
-			SERVICE_NAME,
-			"-a",
-			ACCOUNT_NAME
-		]);
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function readLinuxStoredCredential() {
-	if (process.platform !== "linux") return;
-	try {
-		const { stdout } = await execFile$1("secret-tool", [
-			"lookup",
-			"service",
-			SERVICE_NAME,
-			"account",
-			ACCOUNT_NAME
-		]);
-		return parseStoredCredential(stdout, "linux-secret-tool", "Secret Service (secret-tool)");
-	} catch {
-		return;
-	}
-}
-async function writeLinuxSecretTool(apiKey) {
-	const stored = await writeLinuxStoredCredential({
-		type: "api_key",
-		token: apiKey
-	});
-	return stored ? {
-		apiKey,
-		backend: stored.backend,
-		location: stored.location
-	} : void 0;
-}
-async function writeLinuxStoredCredential(credential) {
-	if (process.platform !== "linux") return;
-	const payload = {
-		version: 1,
-		credential
-	};
-	try {
-		execFileSync("secret-tool", [
-			"store",
-			"--label",
-			"statelyai API key",
-			"service",
-			SERVICE_NAME,
-			"account",
-			ACCOUNT_NAME
-		], { input: JSON.stringify(payload) });
-		return {
-			...credential ? { credential } : {},
-			backend: "linux-secret-tool",
-			location: "Secret Service (secret-tool)"
-		};
-	} catch {
-		return;
-	}
-}
-async function deleteLinuxSecretTool() {
-	if (process.platform !== "linux") return false;
-	try {
-		await execFile$1("secret-tool", [
-			"clear",
-			"service",
-			SERVICE_NAME,
-			"account",
-			ACCOUNT_NAME
-		]);
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function getStoredCredential() {
-	if (shouldUseFileBackendOnly()) return readFileStoredCredential();
-	return await readMacOSStoredCredential() ?? await readLinuxStoredCredential() ?? await readFileStoredCredential();
-}
-async function setStoredApiKey(apiKey) {
-	if (shouldUseFileBackendOnly()) return writeFileCredentials(apiKey);
-	return await writeMacOSKeychain(apiKey) ?? await writeLinuxSecretTool(apiKey) ?? await writeFileCredentials(apiKey);
-}
-async function setStoredCredential(credential) {
-	if (shouldUseFileBackendOnly()) return writeFileStoredCredential(credential);
-	return await writeMacOSStoredCredential(credential) ?? await writeLinuxStoredCredential(credential) ?? await writeFileStoredCredential(credential);
-}
-async function deleteStoredApiKey() {
-	if (shouldUseFileBackendOnly()) {
-		const deleted = await deleteFileCredentials();
-		return {
-			deleted,
-			locations: deleted ? [getCredentialsFilePath()] : []
-		};
-	}
-	const locations = [];
-	if (await deleteMacOSKeychain()) locations.push("macOS Keychain");
-	if (await deleteLinuxSecretTool()) locations.push("Secret Service (secret-tool)");
-	if (await deleteFileCredentials()) locations.push(getCredentialsFilePath());
-	return {
-		deleted: locations.length > 0,
-		locations
-	};
-}
-function describeCredentialBackend(backend, location) {
-	switch (backend) {
-		case "macos-keychain": return location;
-		case "linux-secret-tool": return location;
-		case "file": return `file (${location})`;
-	}
-}
-
-//#endregion
-//#region src/cli.ts
-const execFileAsync = promisify(execFile);
-const STATELY_API_KEY_SETTINGS_URL = "https://stately.ai/registry/user/my-settings?tab=API+Key";
-const DEFAULT_NEW_MACHINE_FILE_SUFFIX = ".machine.ts";
-const ANSI_RESET = "\x1B[0m";
-const ANSI_BOLD = "\x1B[1m";
-const ANSI_DIM = "\x1B[2m";
-const ANSI_CYAN = "\x1B[36m";
-const ANSI_GREEN = "\x1B[32m";
-const ANSI_YELLOW = "\x1B[33m";
-function loadLocalEnv() {
-	if (typeof process.loadEnvFile !== "function") return;
-	const cwdEnvPath = path.join(process.cwd(), ".env.local");
-	try {
-		process.loadEnvFile(cwdEnvPath);
-	} catch {}
-}
-loadLocalEnv();
-function getEnvApiKey() {
-	const accessToken = process.env.STATELY_ACCESS_TOKEN;
-	if (accessToken) return {
-		apiKey: accessToken,
-		variable: "STATELY_ACCESS_TOKEN"
-	};
-	const statelyApiKey = process.env.STATELY_API_KEY;
-	if (statelyApiKey) return {
-		apiKey: statelyApiKey,
-		variable: "STATELY_API_KEY"
-	};
-	const publicApiKey = process.env.NEXT_PUBLIC_STATELY_API_KEY;
-	if (publicApiKey) return {
-		apiKey: publicApiKey,
-		variable: "NEXT_PUBLIC_STATELY_API_KEY"
-	};
-}
-function getEnvCredential() {
-	const accessToken = process.env.STATELY_ACCESS_TOKEN;
-	if (accessToken) return {
-		credential: {
-			type: "oauth",
-			accessToken
-		},
-		variable: "STATELY_ACCESS_TOKEN"
-	};
-	const statelyApiKey = process.env.STATELY_API_KEY;
-	if (statelyApiKey) return {
-		credential: {
-			type: "api_key",
-			token: statelyApiKey
-		},
-		variable: "STATELY_API_KEY"
-	};
-	const publicApiKey = process.env.NEXT_PUBLIC_STATELY_API_KEY;
-	if (publicApiKey) return {
-		credential: {
-			type: "api_key",
-			token: publicApiKey
-		},
-		variable: "NEXT_PUBLIC_STATELY_API_KEY"
-	};
-}
-const OAUTH_EXPIRY_SKEW_MS = 6e4;
-function decodeJwtPayload(token) {
-	const [, payload] = token.split(".");
-	if (!payload) return;
-	try {
-		const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
-	} catch {
-		return;
-	}
-}
-function getOAuthExpiresAt(credential) {
-	if (credential.expiresAt !== void 0) return credential.expiresAt;
-	const exp = decodeJwtPayload(credential.accessToken)?.exp;
-	return typeof exp === "number" ? exp * 1e3 : void 0;
-}
-function isTerminalOAuthRefreshError(error) {
-	return error instanceof Error && /Token refresh failed with HTTP (?:400|401|403)\b/.test(error.message);
-}
-async function invalidateExpiredOAuthCredential() {
-	await deleteStoredApiKey();
-	throw new Error("Your Stately session expired. Run `npx statelyai login` to continue.");
-}
-async function refreshStoredOAuthCredential(credential, options) {
-	if (!credential.refreshToken) return invalidateExpiredOAuthCredential();
-	const claims = decodeJwtPayload(credential.accessToken);
-	const clientId = credential.clientId ?? (typeof claims?.client_id === "string" ? claims.client_id : void 0) ?? getConfiguredOauthClientId();
-	if (!clientId) return invalidateExpiredOAuthCredential();
-	let tokenEndpoint = credential.tokenEndpoint;
-	try {
-		if (!tokenEndpoint) tokenEndpoint = (await discoverAuthorizationServer(typeof claims?.iss === "string" ? claims.iss : getDefaultOAuthIssuer(), { fetch: options.fetch })).token_endpoint;
-	} catch (error) {
-		throw new Error("Could not refresh your expired Stately session. Retry, or run `npx statelyai login`.", { cause: error });
-	}
-	if (!tokenEndpoint) return invalidateExpiredOAuthCredential();
-	try {
-		const refreshedCredential = createOAuthCredential(await refreshToken({
-			clientId,
-			fetch: options.fetch,
-			refreshToken: credential.refreshToken,
-			tokenEndpoint
-		}), {
-			clientId,
-			fallbackRefreshToken: credential.refreshToken,
-			now: options.now,
-			tokenEndpoint
-		});
-		await setStoredCredential(refreshedCredential);
-		return refreshedCredential;
-	} catch (error) {
-		if (isTerminalOAuthRefreshError(error)) return invalidateExpiredOAuthCredential();
-		throw new Error("Could not refresh your expired Stately session. Retry, or run `npx statelyai login`.", { cause: error });
-	}
-}
-async function resolveApiKey(options = {}) {
-	const envApiKey = getEnvApiKey();
-	if (envApiKey) return {
-		apiKey: envApiKey.apiKey,
-		source: "env",
-		detail: envApiKey.variable
-	};
-	const storedCredential = await getStoredCredential();
-	if (storedCredential?.credential) {
-		let credential = storedCredential.credential;
-		const now = options.now ?? Date.now();
-		if (credential.type === "oauth" && (getOAuthExpiresAt(credential) ?? Infinity) <= now + OAUTH_EXPIRY_SKEW_MS) credential = await refreshStoredOAuthCredential(credential, {
-			...options,
-			now
-		});
-		return {
-			apiKey: credential.type === "oauth" ? credential.accessToken : credential.token,
-			source: "stored",
-			detail: describeCredentialBackend(storedCredential.backend, storedCredential.location)
-		};
-	}
-	return { source: "missing" };
-}
-function getDefaultBaseUrl() {
-	return process.env.STATELY_API_URL ?? process.env.NEXT_PUBLIC_BASE_URL ?? process.env.NEXT_PUBLIC_STATELY_API_URL;
-}
-function getDefaultEditorUrl() {
-	return process.env.STATELY_EDITOR_URL ?? process.env.NEXT_PUBLIC_BETA_EDITOR_URL ?? process.env.NEXT_PUBLIC_BASE_URL ?? "https://editor.stately.ai";
-}
-function getResolvedStudioUrl(baseUrl) {
-	return baseUrl ?? getDefaultBaseUrl() ?? "https://stately.ai";
-}
-function getDefaultOAuthIssuer() {
-	return process.env.STATELY_OAUTH_ISSUER ?? process.env.NEXT_PUBLIC_STATELY_OAUTH_ISSUER ?? "https://stately.ai";
-}
-function normalizeLoginResourceUrl(baseUrl) {
-	const raw = baseUrl;
-	const url = new URL(raw);
-	if (url.pathname === "/" || url.pathname === "") url.pathname = "/api/mcp";
-	return url.toString();
-}
-function getConfiguredOauthClientId() {
-	return process.env.STATELY_OAUTH_CLIENT_ID ?? process.env.NEXT_PUBLIC_STATELY_OAUTH_CLIENT_ID;
-}
-async function discoverOAuthLogin(options = {}) {
-	const resourceUrl = options.baseUrl ? normalizeLoginResourceUrl(options.baseUrl) : getDefaultOAuthIssuer();
-	const protectedResource = options.baseUrl ? await discoverProtectedResource(resourceUrl, { fetch: options.fetch }) : void 0;
-	const issuer = protectedResource ? protectedResource.authorization_servers?.[0] : resourceUrl;
-	if (!issuer) throw new Error(`No OAuth authorization server advertised by ${resourceUrl}. Pass --base-url for a Stately OAuth-enabled resource or set STATELY_OAUTH_ISSUER.`);
-	const authorizationServer = await discoverAuthorizationServer(issuer, { fetch: options.fetch });
-	const authorizationEndpoint = authorizationServer.authorization_endpoint;
-	const tokenEndpoint = authorizationServer.token_endpoint;
-	if (!authorizationEndpoint || !tokenEndpoint) throw new Error(`Authorization server ${issuer} did not advertise authorization and token endpoints.`);
-	const configuredClientId = options.clientId ?? getConfiguredOauthClientId();
-	const scopes = protectedResource?.scopes_supported ?? [];
-	let clientId = configuredClientId;
-	if (!clientId && authorizationServer.registration_endpoint && options.redirectUri) try {
-		clientId = (await registerOAuthClient({
-			registrationEndpoint: authorizationServer.registration_endpoint,
-			redirectUri: options.redirectUri,
-			scopes,
-			fetch: options.fetch
-		})).client_id;
-	} catch (error) {
-		throw new Error(`OAuth dynamic client registration failed for ${authorizationServer.registration_endpoint}. Enable dynamic client registration on the OAuth authorization server, or set STATELY_OAUTH_CLIENT_ID to a registered OAuth client id.`, { cause: error });
-	}
-	if (!clientId) throw new Error(`Authorization server ${issuer} did not advertise dynamic client registration. Set STATELY_OAUTH_CLIENT_ID to a registered OAuth client id.`);
-	return {
-		authorizationServer,
-		authorizationEndpoint,
-		clientId,
-		...protectedResource ? { protectedResource } : {},
-		resourceUrl,
-		scopes,
-		tokenEndpoint
-	};
-}
-function parseGitHubRemote(remoteUrl) {
-	const httpsMatch = remoteUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?$/);
-	if (httpsMatch) {
-		const [, owner, repo] = httpsMatch;
-		if (!owner || !repo) return null;
-		return {
-			url: `https://github.com/${owner}/${repo}`,
-			owner,
-			repo,
-			branch: "",
-			treeSha: ""
-		};
-	}
-	const sshMatch = remoteUrl.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
-	if (sshMatch) {
-		const [, owner, repo] = sshMatch;
-		if (!owner || !repo) return null;
-		return {
-			url: `https://github.com/${owner}/${repo}`,
-			owner,
-			repo,
-			branch: "",
-			treeSha: ""
-		};
-	}
-	return null;
-}
-async function inferConnectedRepoFromCwd(cwd) {
-	try {
-		const [{ stdout: remoteStdout }, { stdout: branchStdout }, { stdout: treeShaStdout }] = await Promise.all([
-			execFileAsync("git", [
-				"remote",
-				"get-url",
-				"origin"
-			], { cwd }),
-			execFileAsync("git", ["branch", "--show-current"], { cwd }),
-			execFileAsync("git", ["rev-parse", "HEAD"], { cwd })
-		]);
-		const parsedRemote = parseGitHubRemote(remoteStdout.trim());
-		if (!parsedRemote) return;
-		return {
-			...parsedRemote,
-			branch: branchStdout.trim(),
-			treeSha: treeShaStdout.trim()
-		};
-	} catch {
-		return;
-	}
-}
-function inferInitProjectName(cwd, repo) {
-	if (repo?.repo) return repo.repo;
-	return path.basename(cwd);
-}
-async function readApiKeyFromStdin() {
-	const chunks = [];
-	for await (const chunk of process.stdin) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-	return Buffer.concat(chunks).toString("utf8").trim();
-}
-async function promptForApiKey() {
-	if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("No interactive terminal available. Pipe the API key to `statelyai login --stdin`.");
-	const maskedOutput = new Writable({ write(chunk, _encoding, callback) {
-		if (!maskedOutput.muted) process.stdout.write(chunk);
-		callback();
-	} });
-	maskedOutput.muted = false;
-	const rl = createInterface({
-		input: process.stdin,
-		output: maskedOutput,
-		terminal: true
-	});
-	try {
-		process.stdout.write("Enter your Stately API key: ");
-		maskedOutput.muted = true;
-		const apiKey = (await rl.question("")).trim();
-		maskedOutput.muted = false;
-		process.stdout.write("\n");
-		return apiKey;
-	} finally {
-		rl.close();
-	}
-}
-async function promptForOAuthCallback() {
-	if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("No interactive terminal available to paste the OAuth callback URL.");
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stdout,
-		terminal: true
-	});
-	try {
-		return (await rl.question("Paste the callback URL or code: ")).trim();
-	} finally {
-		rl.close();
-	}
-}
-function parseOAuthCallback(value) {
-	try {
-		const url = new URL(value);
-		const code = url.searchParams.get("code");
-		const state = url.searchParams.get("state") ?? void 0;
-		if (!code) throw new Error("Callback URL did not include a code parameter.");
-		return {
-			code,
-			state
-		};
-	} catch (error) {
-		if (error instanceof Error && error.message.includes("code parameter")) throw error;
-		if (!value) throw new Error("OAuth code cannot be empty.");
-		return { code: value };
-	}
-}
-function createOAuthCredential(tokenResponse, options = {}) {
-	if (!tokenResponse.access_token) throw new Error("Token response did not include an access_token.");
-	const now = options.now ?? Date.now();
-	const expiresAt = typeof tokenResponse.expires_at === "number" ? tokenResponse.expires_at * 1e3 : typeof tokenResponse.expires_in === "number" ? now + tokenResponse.expires_in * 1e3 : void 0;
-	return {
-		type: "oauth",
-		accessToken: tokenResponse.access_token,
-		...tokenResponse.refresh_token ?? options.fallbackRefreshToken ? { refreshToken: tokenResponse.refresh_token ?? options.fallbackRefreshToken } : {},
-		...expiresAt ? { expiresAt } : {},
-		...options.clientId ? { clientId: options.clientId } : {},
-		...options.tokenEndpoint ? { tokenEndpoint: options.tokenEndpoint } : {}
-	};
-}
-async function buildOAuthLoginStart(options) {
-	const [discovery, pkce] = await Promise.all([discoverOAuthLogin({
-		baseUrl: options.baseUrl,
-		clientId: options.clientId,
-		fetch: options.fetch,
-		redirectUri: options.redirectUri
-	}), createPkcePair()]);
-	return {
-		authorizeUrl: buildAuthorizeUrl({
-			authorizationEndpoint: discovery.authorizationEndpoint,
-			clientId: discovery.clientId,
-			redirectUri: options.redirectUri,
-			codeChallenge: pkce.codeChallenge,
-			state: options.state,
-			scopes: discovery.scopes
-		}),
-		codeVerifier: pkce.codeVerifier,
-		discovery
-	};
-}
-function formatStoredCredentialSource(storedCredential) {
-	if (storedCredential.credential?.type === "api_key") return `Credential source: stored api_key (${describeCredentialBackend(storedCredential.backend, storedCredential.location)}).`;
-	if (storedCredential.credential?.type === "oauth") return `Credential source: stored oauth (${describeCredentialBackend(storedCredential.backend, storedCredential.location)}).`;
-	if (storedCredential.authMode === "none") return `Credential source: stored no-auth mode (${describeCredentialBackend(storedCredential.backend, storedCredential.location)}).`;
-	return `Credential source: stored unknown (${describeCredentialBackend(storedCredential.backend, storedCredential.location)}).`;
-}
-async function runOAuthBrowserLogin(options) {
-	const state = crypto.randomBytes(16).toString("base64url");
-	const callbackServer = await createLocalOAuthCallbackServer({ state });
-	try {
-		const { authorizeUrl, codeVerifier, discovery } = await buildOAuthLoginStart({
-			baseUrl: options.baseUrl,
-			redirectUri: callbackServer.redirectUri,
-			state
-		});
-		options.log(`Opening browser for ${discovery.resourceUrl}`);
-		options.log(authorizeUrl);
-		let openedBrowser = false;
-		try {
-			openBrowser(authorizeUrl);
-			openedBrowser = true;
-		} catch {
-			options.log("Could not open a browser automatically.");
-		}
-		const codePromise = callbackServer.waitForCode();
-		const pastedCodePromise = !openedBrowser && process.stdin.isTTY && process.stdout.isTTY ? promptForOAuthCallback().then((value) => {
-			const callback = parseOAuthCallback(value);
-			if (callback.state && callback.state !== state) throw new Error("OAuth state did not match.");
-			return callback.code;
-		}) : void 0;
-		const code = await (pastedCodePromise ? Promise.race([codePromise, pastedCodePromise]) : codePromise);
-		return setStoredCredential(createOAuthCredential(await exchangeCodeForToken({
-			tokenEndpoint: discovery.tokenEndpoint,
-			code,
-			codeVerifier,
-			redirectUri: callbackServer.redirectUri,
-			clientId: discovery.clientId
-		}), {
-			clientId: discovery.clientId,
-			tokenEndpoint: discovery.tokenEndpoint
-		}));
-	} finally {
-		await callbackServer.close();
-	}
-}
-async function promptYesNo(question, defaultValue = true) {
-	if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("No interactive terminal available.");
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stdout,
-		terminal: true
-	});
-	try {
-		const suffix = defaultValue ? " [Y/n] " : " [y/N] ";
-		const answer = (await rl.question(`${question}${suffix}`)).trim().toLowerCase();
-		if (!answer) return defaultValue;
-		return answer === "y" || answer === "yes";
-	} finally {
-		rl.close();
-	}
-}
-function normalizeApiKey(value) {
-	const trimmed = value?.trim();
-	return trimmed ? trimmed : void 0;
-}
-function pluralize(count, singular, plural = `${singular}s`) {
-	return count === 1 ? singular : plural;
-}
-function supportsColor() {
-	return Boolean(process.stdout.isTTY) && process.env.NO_COLOR == null && process.env.CI !== "true";
-}
-function colorize(text, ...codes) {
-	if (!supportsColor()) return text;
-	return `${codes.join("")}${text}${ANSI_RESET}`;
-}
-function formatSectionLabel(label, tone = "info") {
-	return colorize(label, ANSI_BOLD, tone === "success" ? ANSI_GREEN : tone === "warning" ? ANSI_YELLOW : ANSI_CYAN);
-}
-function formatSecondaryText(text) {
-	return colorize(text, ANSI_DIM);
-}
-function inferSuggestedNewMachineDir(config) {
-	const include = config.include[0];
-	if (!include) return "src";
-	const groupedRootMatch = include.match(/^(src|packages\/[^/]+\/src|apps\/[^/]+\/src)(?:\/|$)/);
-	if (groupedRootMatch?.[1]) return groupedRootMatch[1];
-	const globIndex = include.indexOf("**/");
-	if (globIndex > 0) return include.slice(0, globIndex).replace(/\/$/, "") || "src";
-	const wildcardIndex = include.indexOf("*");
-	if (wildcardIndex > 0) return path.posix.dirname(include.slice(0, wildcardIndex)) || "src";
-	return path.posix.dirname(include) === "." ? "src" : path.posix.dirname(include);
-}
-function formatMissingNewMachineDirMessage(options) {
-	const suggestedDir = inferSuggestedNewMachineDir(options.config);
-	const countLabel = pluralize(options.remoteMachineCount, "remote-only project machine");
-	return [
-		`Found ${options.remoteMachineCount} ${countLabel}, but statelyai.json does not set newMachinesDir, so they will be skipped.`,
-		"To import new machines created in Studio, add this to statelyai.json:",
-		`  "newMachinesDir": "${suggestedDir}"`,
-		"Then run `statelyai pull` again."
-	].join("\n");
-}
-function toMachineFileStem(machineName) {
-	return (typeof machineName === "string" ? machineName : "").trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "machine";
-}
-function buildProjectEditorUrl(studioUrl, projectId) {
-	return `${studioUrl.replace(/\/+$/, "")}/registry/editor/${encodeURIComponent(projectId)}`;
-}
-function buildMachineEditorUrl(studioUrl, projectId, machineId) {
-	const url = new URL(buildProjectEditorUrl(studioUrl, projectId));
-	url.searchParams.set("machineId", machineId);
-	return url.toString();
-}
-function inferNewMachineDirFromSuggestions(suggestions) {
-	if (suggestions.length !== 1) return;
-	const include = suggestions[0]?.include[0];
-	if (!include) return;
-	const globIndex = include.indexOf("**/");
-	if (globIndex >= 0) return include.slice(0, globIndex).replace(/\/$/, "") || void 0;
-	const directory = path.posix.dirname(include);
-	return directory === "." ? void 0 : directory;
-}
-function isRelinkableLinkedMachineError(error) {
-	return error instanceof StudioApiError && (error.status === 403 || error.status === 404);
-}
-async function fileHasLinkedMachineId(filePath) {
-	const contents = await fsPromises.readFile(filePath, "utf8");
-	return Boolean(getStatelyPragma(contents, filePath)?.id);
-}
-async function fileExists(filePath) {
-	try {
-		await fsPromises.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-}
-async function getGitRepoRoot(cwd) {
-	try {
-		const { stdout } = await execFileAsync("git", ["rev-parse", "--show-toplevel"], { cwd });
-		const root = stdout.trim();
-		return root ? await fsPromises.realpath(root) : void 0;
-	} catch {
-		return;
-	}
-}
-async function isFileGitDirty(filePath) {
-	const resolvedFilePath = await fsPromises.realpath(path.resolve(filePath));
-	const repoRoot = await getGitRepoRoot(path.dirname(resolvedFilePath));
-	if (!repoRoot) return false;
-	try {
-		const relativePath = path.relative(repoRoot, resolvedFilePath);
-		const { stdout: untrackedStdout } = await execFileAsync("git", [
-			"ls-files",
-			"--others",
-			"--exclude-standard",
-			"--",
-			relativePath
-		], { cwd: repoRoot });
-		if (untrackedStdout.trim().length > 0) return true;
-		try {
-			await execFileAsync("git", [
-				"diff",
-				"--no-ext-diff",
-				"--quiet",
-				"--",
-				relativePath
-			], { cwd: repoRoot });
-		} catch {
-			return true;
-		}
-		try {
-			await execFileAsync("git", [
-				"diff",
-				"--cached",
-				"--no-ext-diff",
-				"--quiet",
-				"--",
-				relativePath
-			], { cwd: repoRoot });
-		} catch {
-			return true;
-		}
-		return false;
-	} catch {
-		return false;
-	}
-}
-async function discoverLinkedPullTargets(files) {
-	const linkedTargets = [];
-	for (const file of files) {
-		if (!supportsMachineDiscovery(file)) continue;
-		findStatelyPragmaAttachments(await fsPromises.readFile(file.filePath, "utf8"), file.filePath).forEach((attachment, machineIndex) => {
-			if (attachment.pragma?.id) linkedTargets.push({
-				file,
-				machineId: attachment.pragma.id,
-				machineIndex
-			});
-		});
-	}
-	return linkedTargets;
-}
-async function discoverRemoteProjectMachineTargets(options) {
-	const newMachineDir = options.config.newMachinesDir?.trim();
-	if (!newMachineDir) return [];
-	const targets = [];
-	const reservedRelativePaths = /* @__PURE__ */ new Set();
-	for (const machine of options.machines) {
-		const candidate = machine;
-		const machineId = typeof candidate.machineId === "string" ? candidate.machineId : typeof candidate.id === "string" ? candidate.id : void 0;
-		if (!machineId || options.linkedMachineIds.has(machineId)) continue;
-		const baseDirectory = path.join(options.rootDir, newMachineDir);
-		let machineName = typeof candidate.name === "string" && candidate.name.trim().length > 0 ? candidate.name : typeof candidate.key === "string" && candidate.key.trim().length > 0 ? candidate.key : void 0;
-		if ((!machineName || machineName === machineId) && options.client?.machines?.get) try {
-			const remoteMachine = await options.client.machines.get(machineId);
-			const fetchedName = typeof remoteMachine?.name === "string" && remoteMachine.name.trim().length > 0 ? remoteMachine.name : void 0;
-			if (fetchedName) machineName = fetchedName;
-		} catch {}
-		machineName ??= machineId;
-		const stem = toMachineFileStem(machineName);
-		let candidateFileName = `${stem}${DEFAULT_NEW_MACHINE_FILE_SUFFIX}`;
-		let attempt = 2;
-		for (;;) {
-			const filePath = path.join(baseDirectory, candidateFileName);
-			const relativePath = path.relative(options.rootDir, filePath).replace(/\\/g, "/");
-			if (!isTrackedByStatelyProjectConfig(options.config, relativePath)) throw new Error(`Generated path ${relativePath} for remote machine ${machineName} is not covered by include/exclude globs.`);
-			if (!reservedRelativePaths.has(relativePath) && !await fileExists(filePath)) {
-				reservedRelativePaths.add(relativePath);
-				targets.push({
-					machineId,
-					machineName,
-					filePath,
-					relativePath
-				});
-				break;
-			}
-			candidateFileName = `${stem}-${attempt}${DEFAULT_NEW_MACHINE_FILE_SUFFIX}`;
-			attempt += 1;
-		}
-	}
-	return targets;
-}
-async function initProject(options) {
-	const cwd = path.resolve(options.cwd ?? process.cwd());
-	const studioUrl = getResolvedStudioUrl(options.baseUrl);
-	const apiBaseUrl = resolveApiBaseUrl(studioUrl);
-	const configPath = path.resolve(cwd, options.configPath ?? STATELY_CONFIG_FILE);
-	const defaultXStateVersion = Math.max(5, options.defaultXStateVersion ?? 5);
-	const existingConfig = !options.force ? await readStatelyProjectConfig({
-		cwd,
-		configPath: options.configPath,
-		rewriteIfNeeded: true
-	}).catch(() => void 0) : void 0;
-	if (existingConfig) {
-		if (options.local) return {
-			config: existingConfig.config,
-			configPath: existingConfig.configPath,
-			reusedExistingConfig: true
-		};
-		if (existingConfig.config.projectId) {
-			const client = options.client ?? createStatelyClient({
-				apiKey: options.apiKey,
-				baseUrl: apiBaseUrl
-			});
-			return {
-				config: existingConfig.config,
-				configPath: existingConfig.configPath,
-				project: await client.projects.get(existingConfig.config.projectId),
-				reusedExistingConfig: true
-			};
-		}
-	}
-	if (options.local) {
-		const config = createStatelyProjectConfig({ defaultXStateVersion });
-		await writeStatelyProjectConfig(configPath, config);
-		return {
-			config,
-			configPath,
-			reusedExistingConfig: false
-		};
-	}
-	const client = options.client ?? createStatelyClient({
-		apiKey: options.apiKey,
-		baseUrl: apiBaseUrl
-	});
-	const inferredRepo = options.project?.repo ?? await inferConnectedRepoFromCwd(cwd);
-	const projectInput = {
-		name: options.project?.name ?? inferInitProjectName(cwd, inferredRepo),
-		visibility: options.project?.visibility ?? "Private",
-		...options.project?.description ? { description: options.project.description } : {},
-		...options.project?.keywords ? { keywords: options.project.keywords } : {},
-		...inferredRepo ? { repo: inferredRepo } : {}
-	};
-	const project = await client.projects.ensure(projectInput);
-	const config = existingConfig ? {
-		...existingConfig.config,
-		projectId: project.projectId,
-		studioUrl
-	} : createStatelyProjectConfig({
-		projectId: project.projectId,
-		studioUrl,
-		defaultXStateVersion
-	});
-	await writeStatelyProjectConfig(configPath, config);
-	return {
-		config,
-		configPath,
-		project,
-		reusedExistingConfig: false
-	};
-}
-function inferDiscoveredMachineName(options) {
-	const declaration = options.source.slice(options.attachStart, options.machineStart);
-	const variableName = [...declaration.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=/g)].at(-1)?.[1];
-	if (variableName) return variableName;
-	if (/\bexport\s+default\b/.test(declaration)) return "default";
-	const configuredId = options.source.slice(options.machineStart, options.machineStart + 500).match(/\bid\s*:\s*['"]([^'"]+)['"]/)?.[1];
-	if (configuredId) return configuredId;
-	return `${path.basename(options.relativePath, path.extname(options.relativePath))}#${options.machineIndex + 1}`;
-}
-function discoverMachinesInSource(options) {
-	if (!hasXStateDependency(options.source)) return [];
-	return findStatelyPragmaAttachments(options.source, options.filePath).map((attachment, machineIndex) => ({
-		filePath: options.filePath,
-		...attachment.pragma?.id ? { id: attachment.pragma.id } : {},
-		line: options.source.slice(0, attachment.machineStart).split(/\r?\n/).length,
-		machineIndex,
-		name: inferDiscoveredMachineName({
-			attachStart: attachment.attachStart,
-			machineIndex,
-			machineStart: attachment.machineStart,
-			relativePath: options.relativePath,
-			source: options.source
-		}),
-		relativePath: options.relativePath
-	}));
-}
-function hasXStateDependency(source) {
-	return /\bfrom\s*['"]xstate['"]/.test(source) || /\bimport\s*['"]xstate['"]/.test(source) || /\brequire\s*\(\s*['"]xstate['"]\s*\)/.test(source);
-}
-async function discoverMachinesInFiles(files) {
-	const machines = [];
-	for (const file of files) {
-		const source = await fsPromises.readFile(file.filePath, "utf8");
-		machines.push(...discoverMachinesInSource({
-			filePath: file.filePath,
-			relativePath: file.relativePath,
-			source
-		}));
-	}
-	return machines;
-}
-async function scanProjectMachines(options = {}) {
-	const cwd = path.resolve(options.cwd ?? process.cwd());
-	return discoverMachinesInFiles((await discoverCodeSourceFiles({ cwd })).map((relativePath) => ({
-		filePath: path.join(cwd, relativePath),
-		relativePath,
-		source: {
-			include: [relativePath],
-			exclude: [],
-			format: "xstate",
-			xstateVersion: 5
-		}
-	})));
-}
-function formatDiscoveredMachines(machines) {
-	const fileCount = new Set(machines.map((machine) => machine.relativePath)).size;
-	const lines = [`Found ${machines.length} ${pluralize(machines.length, "machine")} in ${fileCount} ${pluralize(fileCount, "file")}:`];
-	for (const machine of machines) lines.push(`  ${machine.name}  ${machine.relativePath}:${machine.line}${machine.id ? `  ${machine.id}` : ""}`);
-	return lines.join("\n");
-}
-async function scanProjectSources(options) {
-	const cwd = path.resolve(options.cwd ?? process.cwd());
-	return suggestStatelySourceConfigs([...new Set((await scanProjectMachines({ cwd })).map((machine) => machine.relativePath))]);
-}
-async function classifyPushCandidates(files) {
-	const machineFiles = [];
-	const nonMachineFiles = [];
-	for (const file of files) {
-		const contents = await fsPromises.readFile(file.filePath, "utf8");
-		if (discoverMachinesInSource({
-			filePath: file.filePath,
-			relativePath: file.relativePath,
-			source: contents
-		}).length > 0) {
-			machineFiles.push(file);
-			continue;
-		}
-		nonMachineFiles.push(file);
-	}
-	return {
-		machineFiles,
-		nonMachineFiles
-	};
-}
-function supportsMachineDiscovery(file) {
-	return file.source.format === "xstate" || file.source.format === "auto";
-}
-async function resolveConfiguredProject(options) {
-	const { config, configPath, rootDir, rewriteStatus } = await readStatelyProjectConfig({
-		cwd: options.cwd,
-		configPath: options.configPath,
-		rewriteIfNeeded: options.rewriteIfNeeded ?? true
-	});
-	if (!config.projectId) throw new Error("This is a local-only project. Run `statelyai init` to connect it to Stately Studio.");
-	return {
-		client: options.client ?? createStatelyClient({
-			apiKey: options.apiKey,
-			baseUrl: resolveApiBaseUrl(options.baseUrl ?? config.studioUrl)
-		}),
-		config,
-		configPath,
-		files: await discoverStatelySourceFiles({
-			cwd: rootDir,
-			config
-		}),
-		rewriteStatus
-	};
-}
-async function resolveConfiguredPullTargets(options) {
-	const { client, files, config, configPath, rewriteStatus } = await resolveConfiguredProject(options);
-	const linkedTargets = await discoverLinkedPullTargets(files);
-	const linkedMachineIds = new Set(linkedTargets.map((linkedTarget) => linkedTarget.machineId));
-	const project = await client.projects.get(config.projectId);
-	const machines = await client.projects.listMachines(config.projectId);
-	const skipped = [];
-	let remoteOnlyTargets = [];
-	try {
-		remoteOnlyTargets = await discoverRemoteProjectMachineTargets({
-			rootDir: path.dirname(configPath),
-			config,
-			machines,
-			linkedMachineIds,
-			client
-		});
-	} catch (error) {
-		skipped.push(error instanceof Error ? error.message : String(error));
-	}
-	return {
-		client,
-		config,
-		configPath,
-		linkedTargets,
-		machines,
-		project,
-		remoteOnlyTargets,
-		skipped,
-		rewriteStatus
-	};
-}
-async function resolveCredentialStatus() {
-	const envCredential = getEnvCredential();
-	if (envCredential) return {
-		detail: envCredential.variable,
-		source: "environment",
-		type: envCredential.credential.type
-	};
-	const storedCredential = await getStoredCredential();
-	if (storedCredential?.credential) return {
-		detail: describeCredentialBackend(storedCredential.backend, storedCredential.location),
-		source: "stored",
-		type: storedCredential.credential.type
-	};
-	return {
-		detail: "server decides whether authentication is required",
-		source: "none",
-		type: "none"
-	};
-}
-function getProjectMachineId(machine) {
-	const candidate = machine;
-	return candidate.machineId || candidate.id;
-}
-function formatCredentialStatus(status) {
-	return status.type === "none" ? `Auth: none (${status.detail})` : `Auth: ${status.type} from ${status.source} (${status.detail})`;
-}
-async function resolveProjectStatus(options = {}) {
-	const { config, configPath, rootDir } = await readStatelyProjectConfig({
-		cwd: options.cwd,
-		configPath: options.configPath,
-		rewriteIfNeeded: false
-	});
-	const localMachines = await discoverMachinesInFiles((await discoverStatelySourceFiles({
-		cwd: rootDir,
-		config
-	})).filter(supportsMachineDiscovery));
-	const studioUrl = options.baseUrl ?? config.studioUrl;
-	if (!config.projectId) {
-		const machines = localMachines.map((machine) => ({
-			line: machine.line,
-			machineIndex: machine.machineIndex,
-			name: machine.name,
-			path: machine.relativePath,
-			status: "local-only"
-		}));
-		return {
-			auth: {
-				detail: "not required for local projects",
-				source: "none",
-				type: "none"
-			},
-			configPath,
-			counts: {
-				linked: 0,
-				"local-only": machines.length,
-				"missing-remote": 0,
-				"remote-only": 0
-			},
-			machines,
-			mode: "local"
-		};
-	}
-	const apiKey = options.apiKey ?? (options.client ? void 0 : (await resolveApiKey()).apiKey);
-	const client = options.client ?? createStatelyClient({
-		apiKey,
-		baseUrl: resolveApiBaseUrl(studioUrl)
-	});
-	const project = await client.projects.get(config.projectId);
-	const remoteMachines = await client.projects.listMachines(config.projectId);
-	const remoteById = new Map(remoteMachines.flatMap((machine) => {
-		const id = getProjectMachineId(machine);
-		return id ? [[id, machine]] : [];
-	}));
-	const linkedIds = new Set(localMachines.flatMap((machine) => machine.id ? [machine.id] : []));
-	const machines = localMachines.map((machine) => {
-		if (!machine.id) return {
-			line: machine.line,
-			machineIndex: machine.machineIndex,
-			name: machine.name,
-			path: machine.relativePath,
-			status: "local-only"
-		};
-		const remote = remoteById.get(machine.id);
-		return {
-			id: machine.id,
-			line: machine.line,
-			machineIndex: machine.machineIndex,
-			name: remote?.name || machine.name,
-			path: machine.relativePath,
-			status: remote ? "linked" : "missing-remote",
-			url: buildMachineEditorUrl(studioUrl, config.projectId, machine.id)
-		};
-	});
-	for (const remote of remoteMachines) {
-		const id = getProjectMachineId(remote);
-		if (!id || linkedIds.has(id)) continue;
-		machines.push({
-			id,
-			name: remote.name || id,
-			status: "remote-only",
-			url: buildMachineEditorUrl(studioUrl, config.projectId, id)
-		});
-	}
-	machines.sort((left, right) => left.status.localeCompare(right.status) || left.name.localeCompare(right.name));
-	return {
-		auth: await resolveCredentialStatus(),
-		configPath,
-		counts: {
-			linked: machines.filter((machine) => machine.status === "linked").length,
-			"local-only": machines.filter((machine) => machine.status === "local-only").length,
-			"missing-remote": machines.filter((machine) => machine.status === "missing-remote").length,
-			"remote-only": machines.filter((machine) => machine.status === "remote-only").length
-		},
-		machines,
-		mode: "studio",
-		project: {
-			id: config.projectId,
-			...project.name ? { name: project.name } : {},
-			url: buildProjectEditorUrl(studioUrl, config.projectId)
-		},
-		studioUrl
-	};
-}
-const baseUrlFlags = {
-	help: Flags.help({ char: "h" }),
-	"base-url": Flags.string({ description: "Base URL for Stately Studio or a self-hosted deployment" })
-};
-const sharedFlags = {
-	...baseUrlFlags,
-	"fail-on-changes": Flags.boolean({
-		default: false,
-		description: "Exit with a nonzero code when differences are found"
-	})
-};
-function formatChangeList(label, items) {
-	if (items.length === 0) return null;
-	return `${label}: ${items.map((item) => item.id).join(", ")}`;
-}
-function formatPlanSummary(plan) {
-	const lines = [
-		`Plan: ${plan.source.locator} -> ${plan.target.locator}`,
-		`Source: ${plan.source.kind} (${plan.source.format})`,
-		`Target: ${plan.target.kind} (${plan.target.format})`,
-		`Has changes: ${plan.summary.hasChanges ? "yes" : "no"}`,
-		`Node changes: ${plan.summary.nodeChanges}`,
-		`Edge changes: ${plan.summary.edgeChanges}`
-	];
-	const nodeSections = [
-		formatChangeList("Added nodes", plan.diff.nodes.added),
-		formatChangeList("Removed nodes", plan.diff.nodes.removed),
-		formatChangeList("Updated nodes", plan.diff.nodes.updated)
-	].filter(Boolean);
-	const edgeSections = [
-		formatChangeList("Added edges", plan.diff.edges.added),
-		formatChangeList("Removed edges", plan.diff.edges.removed),
-		formatChangeList("Updated edges", plan.diff.edges.updated)
-	].filter(Boolean);
-	lines.push(...nodeSections, ...edgeSections);
-	if (plan.warnings.length > 0) lines.push(`Warnings: ${plan.warnings.join("; ")}`);
-	return lines.join("\n");
-}
-var BaseSyncCommand = class extends Command {
-	static enableJsonFlag = false;
-	static flags = sharedFlags;
-};
-const sharedArgs = {
-	source: Args.string({
-		required: true,
-		description: "Source locator. Supports local file paths, URLs, or machine IDs."
-	}),
-	target: Args.string({
-		required: true,
-		description: "Target locator. Supports local file paths, URLs, or machine IDs."
-	})
-};
-var ParsedSyncCommand = class extends BaseSyncCommand {
-	async parseSync(command) {
-		return this.parse(command);
-	}
-};
-async function createSemanticDiff(source, target, baseUrl) {
-	return planSync({
-		source,
-		target,
-		apiKey: (await resolveApiKey()).apiKey,
-		baseUrl: resolveApiBaseUrl(baseUrl ?? getDefaultBaseUrl())
-	});
-}
-var PlanCommand = class PlanCommand extends ParsedSyncCommand {
-	static hidden = true;
-	static summary = "Plan semantic sync changes between a source and target.";
-	static description = "Resolves the source and target, normalizes both into graph form, and prints a semantic change summary.";
-	static args = sharedArgs;
-	async run() {
-		const { args, flags } = await this.parseSync(PlanCommand);
-		const plan = await createSemanticDiff(args.source, args.target, flags["base-url"]);
-		this.log(formatPlanSummary(plan));
-		this.exit(flags["fail-on-changes"] && plan.summary.hasChanges ? 1 : 0);
-	}
-};
-var DiffCommand = class DiffCommand extends ParsedSyncCommand {
-	static summary = "Diff a source and target using semantic graph comparison.";
-	static description = "Like plan, but intended for diff-style usage and exit codes in scripts.";
-	static args = sharedArgs;
-	async run() {
-		const { args, flags } = await this.parseSync(DiffCommand);
-		const plan = await createSemanticDiff(args.source, args.target, flags["base-url"]);
-		this.log(formatPlanSummary(plan));
-		this.exit(flags["fail-on-changes"] && plan.summary.hasChanges ? 1 : 0);
-	}
-};
-var PullCommand = class PullCommand extends ParsedSyncCommand {
-	static summary = "Pull a source locator into a local target file.";
-	static description = "Resolves the source, materializes it in the target format inferred from the target file, and writes the result locally. With no arguments, pulls all linked files discovered from statelyai.json.";
-	static flags = {
-		...baseUrlFlags,
-		config: Flags.string({ description: "Path to statelyai.json" }),
-		force: Flags.boolean({
-			description: "Overwrite linked files even when they have local git changes",
-			default: false
-		})
-	};
-	static args = {
-		source: Args.string({
-			required: false,
-			description: "Optional source locator. Supports a local linked file, machine ID, URL, or local file path."
-		}),
-		target: Args.string({
-			required: false,
-			description: "Optional local target path. Defaults to the source file when pulling a linked local file."
-		})
-	};
-	async run() {
-		const { args, flags } = await this.parseSync(PullCommand);
-		const apiKey = (await resolveApiKey()).apiKey;
-		if (!args.source) {
-			this.log(colorize("Resolving configured project and linked source files...", ANSI_CYAN));
-			const { config, linkedTargets, machines, remoteOnlyTargets, skipped, rewriteStatus } = await resolveConfiguredPullTargets({
-				apiKey,
-				baseUrl: flags["base-url"],
-				configPath: flags.config
-			});
-			if (rewriteStatus.reason === "multiple-legacy-sources") this.log("Legacy statelyai.json detected with multiple sources entries. It cannot be rewritten automatically without losing information, so please update it manually.");
-			if (linkedTargets.length === 0 && remoteOnlyTargets.length === 0) {
-				if (machines.length > 0 && !config.newMachinesDir) {
-					this.log(formatSectionLabel("Skipped:", "warning"));
-					this.log(formatMissingNewMachineDirMessage({
-						config,
-						remoteMachineCount: machines.length
-					}));
-					return;
-				}
-				this.log("No linked local machine files or remote-only project machines were discovered.");
-				return;
-			}
-			if (machines.length > linkedTargets.length && !config.newMachinesDir) {
-				this.log(formatSectionLabel("Skipped:", "warning"));
-				this.log(formatMissingNewMachineDirMessage({
-					config,
-					remoteMachineCount: machines.length - linkedTargets.length
-				}));
-			}
-			this.log(colorize(`Processing ${linkedTargets.length} ${pluralize(linkedTargets.length, "linked file")}${remoteOnlyTargets.length > 0 ? ` and ${remoteOnlyTargets.length} ${pluralize(remoteOnlyTargets.length, "new remote machine")}` : ""}...`, ANSI_CYAN));
-			const pulled = [];
-			const created = [];
-			let hadSourceReconciliationFailure = false;
-			const dirtyLinkedFiles = /* @__PURE__ */ new Map();
-			if (!flags.force) await Promise.all([...new Set(linkedTargets.map((target) => target.file.filePath))].map(async (filePath) => {
-				dirtyLinkedFiles.set(filePath, await isFileGitDirty(filePath));
-			}));
-			for (const linkedTarget of linkedTargets) {
-				const targetPath = linkedTarget.file.filePath;
-				if (!flags.force && dirtyLinkedFiles.get(targetPath)) {
-					skipped.push(`${linkedTarget.file.relativePath}: local git changes detected (pass --force to overwrite)`);
-					continue;
-				}
-				this.log(colorize(`Pulling ${linkedTarget.file.relativePath}...`, ANSI_CYAN));
-				try {
-					const result = await pullSync({
-						source: linkedTarget.machineId,
-						target: targetPath,
-						apiKey,
-						baseUrl: resolveApiBaseUrl(flags["base-url"] ?? config.studioUrl),
-						force: flags.force,
-						machineIndex: linkedTarget.machineIndex
-					});
-					pulled.push(`${linkedTarget.file.relativePath}: ${formatSecondaryText(result.source.locator)}`);
-				} catch (error) {
-					if (error instanceof PullSourceReconciliationError) hadSourceReconciliationFailure = true;
-					skipped.push(`${linkedTarget.file.relativePath}: ${error instanceof Error ? error.message : String(error)}`);
-				}
-			}
-			for (const remoteTarget of remoteOnlyTargets) {
-				this.log(colorize(`Pulling new remote machine ${remoteTarget.machineName} into ${remoteTarget.relativePath}...`, ANSI_CYAN));
-				try {
-					await fsPromises.mkdir(path.dirname(remoteTarget.filePath), { recursive: true });
-					const result = await pullSync({
-						source: remoteTarget.machineId,
-						target: remoteTarget.filePath,
-						apiKey,
-						baseUrl: resolveApiBaseUrl(flags["base-url"] ?? config.studioUrl),
-						force: flags.force
-					});
-					created.push(`${remoteTarget.relativePath}: ${formatSecondaryText(result.source.locator)}`);
-				} catch (error) {
-					if (error instanceof PullSourceReconciliationError) hadSourceReconciliationFailure = true;
-					skipped.push(`${remoteTarget.relativePath}: ${error instanceof Error ? error.message : String(error)}`);
-				}
-			}
-			if (pulled.length > 0) this.log(`${formatSectionLabel("Pulled:", "success")}\n${pulled.join("\n")}`);
-			if (created.length > 0) this.log(`${formatSectionLabel("Created:", "success")}\n${created.join("\n")}`);
-			if (skipped.length > 0) this.log(`${formatSectionLabel("Skipped:", "warning")}\n${skipped.join("\n")}`);
-			if (hadSourceReconciliationFailure) this.exit(1);
-			return;
-		}
-		const localCandidate = path.resolve(process.cwd(), args.source);
-		let source = args.source;
-		let target = args.target;
-		if (!target && await fileExists(localCandidate)) {
-			const pragma = getStatelyPragma(await fsPromises.readFile(localCandidate, "utf8"), localCandidate);
-			if (!pragma?.id) this.error(`No @statelyai id found in ${localCandidate}. Pass an explicit source machine ID or URL and target path.`);
-			source = pragma.id;
-			target = localCandidate;
-		}
-		if (!target) this.error("Missing target path. Pass `statelyai pull <machine-id|url> <file>` or `statelyai pull <linked-file>`.");
-		if (!flags.force && await fileExists(target) && await isFileGitDirty(target)) this.error(`Refusing to overwrite locally modified file ${target}. Pass --force to overwrite it.`);
-		this.log(colorize(`Pulling ${source} into ${target}...`, ANSI_CYAN));
-		const result = await pullSync({
-			source,
-			target,
-			apiKey,
-			baseUrl: resolveApiBaseUrl(flags["base-url"] ?? getDefaultBaseUrl()),
-			force: flags.force
-		});
-		this.log(`${formatSectionLabel("Pulled:", "success")} ${formatSecondaryText(result.source.locator)} -> ${result.outputPath}\nTarget: ${result.target.kind} (${result.target.format})`);
-	}
-};
-var PushCommand = class PushCommand extends Command {
-	static enableJsonFlag = false;
-	static summary = "Create or update remote machines for local source files.";
-	static description = "Uses statelyai.json source discovery by default, creates remote machines for unlabeled local machine sources, updates already-linked machines, and writes returned @statelyai ids back into source files.";
-	static args = { file: Args.string({
-		required: false,
-		description: "Optional local source file to push instead of scanning statelyai.json."
-	}) };
-	static flags = {
-		help: Flags.help({ char: "h" }),
-		"base-url": Flags.string({ description: "Base URL for Stately Studio or a self-hosted deployment" }),
-		config: Flags.string({ description: "Path to statelyai.json" }),
-		"dry-run": Flags.boolean({
-			description: "Show which matched files contain machines and what push would do without changing remote or local state",
-			default: false
-		})
-	};
-	async run() {
-		const { args, flags } = await this.parse(PushCommand);
-		const resolvedApiKey = flags["dry-run"] ? { source: "missing" } : await resolveApiKey();
-		this.log(colorize("Resolving configured project and source files...", ANSI_CYAN));
-		const { client, config, files, rewriteStatus } = flags["dry-run"] ? await (async () => {
-			const { config, rootDir, rewriteStatus } = await readStatelyProjectConfig({
-				configPath: flags.config,
-				rewriteIfNeeded: false
-			});
-			return {
-				client: void 0,
-				config,
-				files: await discoverStatelySourceFiles({
-					cwd: rootDir,
-					config
-				}),
-				rewriteStatus
-			};
-		})() : await resolveConfiguredProject({
-			apiKey: resolvedApiKey.apiKey,
-			baseUrl: flags["base-url"],
-			configPath: flags.config
-		});
-		if (rewriteStatus.reason === "multiple-legacy-sources") this.log("Legacy statelyai.json detected with multiple sources entries. It cannot be rewritten automatically without losing information, so please update it manually.");
-		const candidateFiles = args.file ? [{
-			filePath: path.resolve(args.file),
-			relativePath: path.relative(process.cwd(), path.resolve(args.file)),
-			source: {
-				include: [args.file],
-				exclude: [],
-				format: "xstate",
-				xstateVersion: config.defaultXStateVersion
-			}
-		}] : files.filter(supportsMachineDiscovery);
-		if (candidateFiles.length === 0) {
-			this.log(colorize("No matching local machine source files were discovered.", ANSI_YELLOW));
-			return;
-		}
-		const { machineFiles } = await classifyPushCandidates(candidateFiles);
-		if (machineFiles.length === 0) {
-			this.log(colorize(`Matched ${candidateFiles.length} ${pluralize(candidateFiles.length, "file")}, but no local machine sources were discovered.`, ANSI_YELLOW));
-			return;
-		}
-		this.log(colorize(`Discovered ${machineFiles.length} ${pluralize(machineFiles.length, "file with a machine")} from ${candidateFiles.length} matched ${pluralize(candidateFiles.length, "file")}.`, ANSI_CYAN));
-		if (flags["dry-run"]) {
-			const wouldLink = [];
-			const wouldUpdate = [];
-			for (const machine of await discoverMachinesInFiles(machineFiles)) {
-				const location = `${machine.relativePath}:${machine.line}`;
-				if (machine.id) wouldUpdate.push(`${machine.name}  ${location}  ${formatSecondaryText(machine.id)}`);
-				else wouldLink.push(`${machine.name}  ${location}`);
-			}
-			if (wouldLink.length > 0) this.log(`${formatSectionLabel("Would link:")}\n${wouldLink.join("\n")}`);
-			if (wouldUpdate.length > 0) this.log(`${formatSectionLabel("Would update:")}\n${wouldUpdate.join("\n")}`);
-			return;
-		}
-		this.log(colorize(`Processing ${machineFiles.length} ${pluralize(machineFiles.length, "source file")}...`, ANSI_CYAN));
-		const linked = [];
-		const refreshed = [];
-		const skipped = [];
-		for (const file of machineFiles) {
-			this.log(colorize(`Pushing ${file.relativePath}...`, ANSI_CYAN));
-			if (!supportsMachineDiscovery(file)) {
-				skipped.push(`${file.relativePath}: unsupported format ${file.source.format}`);
-				continue;
-			}
-			let result;
-			try {
-				result = await pushLocalMachineLinks({
-					source: file.filePath,
-					apiKey: resolvedApiKey.apiKey,
-					baseUrl: resolveApiBaseUrl(flags["base-url"] ?? config.studioUrl),
-					client,
-					project: { projectId: config.projectId },
-					xstateVersion: Math.max(5, file.source.xstateVersion ?? config.defaultXStateVersion)
-				});
-			} catch (error) {
-				if (isRelinkableLinkedMachineError(error) && await fileHasLinkedMachineId(file.filePath)) {
-					if (!process.stdin.isTTY || !process.stdout.isTTY) {
-						skipped.push(`${file.relativePath}: linked remote machine is missing or inaccessible. Re-run interactively to relink it as a new machine.`);
-						continue;
-					}
-					if (!await promptYesNo(`Linked remote machine for ${file.relativePath} is missing or inaccessible. Push it as a new machine and replace the local @statelyai id?`, true)) {
-						skipped.push(`${file.relativePath}: linked remote machine is missing or inaccessible.`);
-						continue;
-					}
-					this.log(colorize(`Relinking ${file.relativePath} as a new remote machine...`, ANSI_YELLOW));
-					result = await pushLocalMachineLinks({
-						source: file.filePath,
-						apiKey: resolvedApiKey.apiKey,
-						baseUrl: resolveApiBaseUrl(flags["base-url"] ?? config.studioUrl),
-						client,
-						project: { projectId: config.projectId },
-						xstateVersion: Math.max(5, file.source.xstateVersion ?? config.defaultXStateVersion),
-						relink: true
-					});
-				} else throw error;
-			}
-			if (result.created.length > 0) linked.push(`${file.relativePath}: ${result.created.map(({ machineIndex, machine }) => `${formatSecondaryText(`${machine.id} [${machineIndex}]`)} ${formatSecondaryText(buildMachineEditorUrl(config.studioUrl, config.projectId, machine.id))}`).join(", ")}`);
-			if (result.updated.length > 0) refreshed.push(`${file.relativePath}: ${result.updated.map(({ machineIndex, machine }) => `${formatSecondaryText(`${machine.id} [${machineIndex}]`)} ${formatSecondaryText(buildMachineEditorUrl(config.studioUrl, config.projectId, machine.id))}`).join(", ")}`);
-			for (const entry of result.skipped) skipped.push(`${file.relativePath} [${entry.machineIndex}]: ${entry.reason}`);
-		}
-		if (linked.length > 0) this.log(`${formatSectionLabel("Linked:", "success")}\n${linked.join("\n")}`);
-		if (refreshed.length > 0) this.log(`${formatSectionLabel("Updated:", "success")}\n${refreshed.join("\n")}`);
-		if (skipped.length > 0) this.log(`${formatSectionLabel("Skipped:", "warning")}\n${skipped.join("\n")}`);
-	}
-};
-var OpenCommand = class OpenCommand extends Command {
-	static enableJsonFlag = false;
-	static summary = "Open local machines in the Stately visual editor.";
-	static description = "Starts a local browser-backed workspace. Pass a file to open all its machines, or omit it to discover machines in the current worktree.";
-	static args = { file: Args.string({
-		required: false,
-		description: "Local source file to edit visually. Defaults to the current worktree."
-	}) };
-	static flags = {
-		help: Flags.help({ char: "h" }),
-		"editor-url": Flags.string({ description: "Base URL for the Stately editor embed" }),
-		host: Flags.string({
-			description: "Local server host",
-			default: "127.0.0.1"
-		}),
-		port: Flags.integer({
-			description: "Local server port. Defaults to a random available port.",
-			default: 0,
-			min: 0
-		}),
-		open: Flags.boolean({
-			description: "Open the local editor URL in the default browser",
-			default: true,
-			allowNo: true
-		}),
-		debug: Flags.boolean({
-			description: "Log editor protocol messages",
-			default: false
-		}),
-		"source-update": Flags.string({
-			description: "Source update strategy: preserve keeps formatting; rewrite regenerates the machine",
-			options: ["preserve", "rewrite"]
-		})
-	};
-	async run() {
-		const { args, flags } = await this.parse(OpenCommand);
-		const apiKey = (await resolveApiKey()).apiKey;
-		const cwd = process.cwd();
-		const discovered = args.file ? await discoverMachinesInFile(path.resolve(args.file)) : await scanProjectMachines({ cwd });
-		if (discovered.length === 0) throw new Error(args.file ? `No machines found in ${path.resolve(args.file)}.` : `No machines found in ${cwd}.`);
-		const rootDir = args.file ? path.dirname(path.resolve(args.file)) : cwd;
-		const machines = discovered.map((machine) => ({
-			id: `${pathToFileURL(machine.filePath).toString()}#${machine.machineIndex}`,
-			name: machine.name,
-			fileName: machine.filePath,
-			machineIndex: machine.machineIndex
-		}));
-		let configuredSourceUpdateStrategy;
-		try {
-			configuredSourceUpdateStrategy = (await readStatelyProjectConfig({ cwd })).config.sourceUpdateStrategy;
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-		}
-		await openEditor({
-			fileName: machines[0].fileName,
-			machines,
-			rootDir,
-			editorUrl: flags["editor-url"] ?? getDefaultEditorUrl(),
-			host: flags.host,
-			port: flags.port,
-			shouldOpen: flags.open,
-			sourceUpdateStrategy: flags["source-update"] ?? configuredSourceUpdateStrategy ?? "preserve",
-			apiKey,
-			debug: flags.debug
-		});
-	}
-};
-async function discoverMachinesInFile(filePath) {
-	const source = await fsPromises.readFile(filePath, "utf8");
-	const discovered = discoverMachinesInSource({
-		filePath,
-		relativePath: path.basename(filePath),
-		source
-	});
-	if (discovered.length > 0) return discovered;
-	return [{
-		filePath,
-		line: 1,
-		machineIndex: 0,
-		name: path.basename(filePath),
-		relativePath: path.basename(filePath)
-	}];
-}
-var InitCommand = class InitCommand extends Command {
-	static enableJsonFlag = false;
-	static summary = "Create a local or Studio-connected statelyai.json.";
-	static description = "Creates a local configuration or reuses a remote Studio project for the current working directory.";
-	static flags = {
-		help: Flags.help({ char: "h" }),
-		"base-url": Flags.string({ description: "Base URL for Stately Studio or a self-hosted deployment" }),
-		name: Flags.string({ description: "Project name to create remotely" }),
-		visibility: Flags.string({
-			description: "Remote project visibility",
-			options: [
-				"Private",
-				"Public",
-				"Unlisted"
-			],
-			default: "Private"
-		}),
-		force: Flags.boolean({
-			description: "Overwrite an existing statelyai.json file",
-			default: false
-		}),
-		local: Flags.boolean({
-			description: "Create a local-only config without authentication or Studio access",
-			default: false
-		}),
-		scan: Flags.boolean({
-			description: "Scan the repo for machine-bearing files and suggest source globs to save into statelyai.json",
-			default: false
-		})
-	};
-	async run() {
-		const { flags } = await this.parse(InitCommand);
-		const resolvedApiKey = flags.local ? { source: "missing" } : await resolveApiKey();
-		this.log(flags.local ? "Creating local project config..." : "Creating or reusing remote project...");
-		let result;
-		try {
-			result = await initProject({
-				apiKey: resolvedApiKey.apiKey,
-				baseUrl: flags["base-url"],
-				force: flags.force,
-				local: flags.local,
-				project: {
-					...flags.name ? { name: flags.name } : {},
-					visibility: flags.visibility
-				}
-			});
-		} catch (error) {
-			if (resolvedApiKey.source === "missing" && error instanceof StudioApiError && (error.status === 401 || error.status === 403)) this.error("Not logged in. Run `npx statelyai login` and retry. To initialize without an account, run `npx statelyai init --local` (add `--force` to replace an existing config).");
-			throw error;
-		}
-		const initMessage = result.project ? (() => {
-			const projectEditorUrl = buildProjectEditorUrl(result.config.studioUrl, result.project.projectId);
-			return result.reusedExistingConfig ? `Using existing statelyai.json at ${result.configPath} for project ${result.project.projectId}.\nEditor: ${projectEditorUrl}` : `Initialized project ${result.project.projectId} and wrote ${result.configPath}.\nEditor: ${projectEditorUrl}`;
-		})() : result.reusedExistingConfig ? `Using existing local statelyai.json at ${result.configPath}.` : `Initialized local project and wrote ${result.configPath}.`;
-		if (flags.scan) {
-			this.log("Scanning local source files...");
-			const machines = await scanProjectMachines({ cwd: path.dirname(result.configPath) });
-			const suggestions = await scanProjectSources({
-				cwd: path.dirname(result.configPath),
-				defaultXStateVersion: result.config.defaultXStateVersion
-			});
-			if (suggestions.length === 0) {
-				this.log(`${initMessage}\nNo include globs were suggested from files with a machine. Edit statelyai.json before running statelyai push.`);
-				return;
-			}
-			this.log(initMessage);
-			this.log(formatDiscoveredMachines(machines));
-			this.log(`Suggested source globs:\n${suggestions.map((source) => `- ${source.include.join(", ")}`).join("\n")}`);
-			if (await promptYesNo("Save these source globs to statelyai.json?", true)) {
-				const inferredNewMachineDir = inferNewMachineDirFromSuggestions(suggestions);
-				const nextConfig = {
-					...result.config,
-					include: suggestions.flatMap((suggestion) => suggestion.include),
-					exclude: [...new Set(suggestions.flatMap((suggestion) => suggestion.exclude ?? []))],
-					...inferredNewMachineDir ? { newMachinesDir: inferredNewMachineDir } : {}
-				};
-				await writeStatelyProjectConfig(result.configPath, nextConfig);
-				this.log(inferredNewMachineDir ? `Saved scanned source globs to statelyai.json.\nNew remote machines will be created under ${inferredNewMachineDir}/ by default.` : "Saved scanned source globs to statelyai.json.");
-			} else this.log("Left statelyai.json unchanged. Edit it before running statelyai push.");
-			return;
-		}
-		this.log(`${initMessage}\nNo include globs configured yet. Edit statelyai.json before running statelyai push, or rerun with --scan.`);
-	}
-};
-var ScanCommand = class ScanCommand extends Command {
-	static enableJsonFlag = false;
-	static summary = "List local state machines without authentication or config.";
-	static description = "Scans source files in the current repository and reports every discovered XState machine.";
-	static flags = {
-		help: Flags.help({ char: "h" }),
-		json: Flags.boolean({
-			description: "Print machine-readable JSON",
-			default: false
-		})
-	};
-	async run() {
-		const { flags } = await this.parse(ScanCommand);
-		const machines = await scanProjectMachines();
-		this.log(flags.json ? JSON.stringify({ machines }, null, 2) : formatDiscoveredMachines(machines));
-	}
-};
-var LoginCommand = class LoginCommand extends Command {
-	static enableJsonFlag = false;
-	static summary = "Store Stately credentials for future CLI use.";
-	static description = "Stores Stately credentials in the OS credential store when available, with a private file fallback.";
-	static flags = {
-		help: Flags.help({ char: "h" }),
-		"api-key": Flags.boolean({ description: "Prompt securely for an API key to store" }),
-		"base-url": Flags.string({ description: "OAuth protected-resource URL for custom deployments" }),
-		stdin: Flags.boolean({
-			description: "Read the API key from standard input",
-			default: false
-		})
-	};
-	async run() {
-		const { flags } = await this.parse(LoginCommand);
-		if (!flags["api-key"] && !flags.stdin) {
-			const stored = await runOAuthBrowserLogin({
-				baseUrl: flags["base-url"],
-				log: (message) => this.log(message)
-			});
-			this.log(`Stored OAuth credential in ${describeCredentialBackend(stored.backend, stored.location)}.`);
-			return;
-		}
-		if (flags.stdin && flags["api-key"]) this.error("Pass either --api-key or --stdin, not both.");
-		const apiKey = normalizeApiKey(flags.stdin ? await readApiKeyFromStdin() : await promptForApiKey());
-		if (!apiKey) this.error(`API key cannot be empty.\nGet or create an API key at ${STATELY_API_KEY_SETTINGS_URL}`);
-		const stored = await setStoredApiKey(apiKey);
-		this.log(`Stored API key in ${describeCredentialBackend(stored.backend, stored.location)}.`);
-	}
-};
-var LogoutCommand = class extends Command {
-	static enableJsonFlag = false;
-	static summary = "Remove credentials stored by the CLI.";
-	static description = "Deletes locally stored credentials. Environment variables are not changed.";
-	static flags = { help: Flags.help({ char: "h" }) };
-	async run() {
-		const result = await deleteStoredApiKey();
-		if (!result.deleted) {
-			this.log("No stored credential found.");
-			return;
-		}
-		this.log(`Removed stored credential from ${result.locations.join(", ")}.`);
-	}
-};
-function formatProjectStatus(result) {
-	const lines = [
-		formatCredentialStatus(result.auth),
-		`Mode: ${result.mode}`,
-		...result.project ? [`Project: ${result.project.name ? `${result.project.name} ` : ""}(${result.project.id})`, `Studio: ${result.project.url}`] : [],
-		`Config: ${result.configPath}`,
-		`Machines: ${result.machines.length} (${result.counts.linked} linked, ${result.counts["local-only"]} local-only, ${result.counts["remote-only"]} remote-only, ${result.counts["missing-remote"]} missing-remote)`
-	];
-	for (const machine of result.machines) {
-		const details = [machine.path ? `${machine.path}${machine.line ? `:${machine.line}` : ""}` : void 0, machine.id].filter(Boolean).join("  ");
-		lines.push(`  [${machine.status}] ${machine.name}${details ? `  ${details}` : ""}`);
-	}
-	const next = [];
-	if (result.mode === "local") {
-		lines.push("Next: statelyai init (connect to Studio)");
-		return lines.join("\n");
-	}
-	if (result.counts["local-only"] > 0 || result.counts["missing-remote"] > 0) next.push("statelyai push");
-	if (result.counts["remote-only"] > 0) next.push("statelyai pull");
-	if (next.length > 0) lines.push(`Next: ${next.join(", ")}`);
-	return lines.join("\n");
-}
-var StatusCommand = class StatusCommand extends Command {
-	static enableJsonFlag = false;
-	static summary = "Show project, machine, and authentication status.";
-	static description = "Reads statelyai.json and Studio project metadata, then classifies configured machine files as linked, local-only, remote-only, or missing remotely.";
-	static flags = {
-		...baseUrlFlags,
-		auth: Flags.boolean({
-			description: "Show only credential resolution",
-			default: false
-		}),
-		config: Flags.string({ description: "Path to statelyai.json" }),
-		json: Flags.boolean({
-			description: "Print machine-readable JSON",
-			default: false
-		})
-	};
-	async run() {
-		const { flags } = await this.parse(StatusCommand);
-		if (flags.auth) {
-			const auth = await resolveCredentialStatus();
-			this.log(flags.json ? JSON.stringify({ auth }, null, 2) : formatCredentialStatus(auth));
-			return;
-		}
-		const result = await resolveProjectStatus({
-			baseUrl: flags["base-url"],
-			configPath: flags.config
-		});
-		this.log(flags.json ? JSON.stringify(result, null, 2) : formatProjectStatus(result));
-	}
-};
-var WhoamiCommand = class extends Command {
-	static hidden = true;
-	static enableJsonFlag = false;
-	static summary = "Show how the CLI would resolve credentials.";
-	static description = "Reports whether the CLI would use an environment variable or stored credential.";
-	static flags = { help: Flags.help({ char: "h" }) };
-	async run() {
-		this.log(formatCredentialStatus(await resolveCredentialStatus()));
-	}
-};
-const COMMANDS = {
-	verify: VerifyCommand,
-	plan: PlanCommand,
-	diff: DiffCommand,
-	pull: PullCommand,
-	push: PushCommand,
-	open: OpenCommand,
-	scan: ScanCommand,
-	status: StatusCommand,
-	init: InitCommand,
-	login: LoginCommand,
-	logout: LogoutCommand,
-	whoami: WhoamiCommand
-};
-async function run$1(argv = process.argv.slice(2), entryUrl = import.meta.url) {
-	const normalizedArgv = argv.length === 1 && argv[0] === "-h" ? ["--help"] : argv;
-	try {
-		await run(normalizedArgv, entryUrl);
-		await flush();
-	} catch (error) {
-		await handle(error);
-	}
-}
-function isDirectExecution() {
-	const entryPath = process.argv[1];
-	if (!entryPath) return false;
-	const modulePath = fileURLToPath(import.meta.url);
-	try {
-		return fs.realpathSync(entryPath) === fs.realpathSync(modulePath);
-	} catch {
-		return path.resolve(entryPath) === modulePath;
-	}
-}
-if (isDirectExecution()) run$1();
-
-//#endregion
-export { scanProjectMachines as C, formatVerificationJUnit as D, verifyProject as E, createStatelyProjectConfig as O, run$1 as S, resolveVerificationRequest as T, isFileGitDirty as _, discoverMachinesInSource as a, resolveCredentialStatus as b, formatDiscoveredMachines as c, formatProjectStatus as d, formatStoredCredentialSource as f, initProject as g, inferInitProjectName as h, discoverLinkedPullTargets as i, formatMissingNewMachineDirMessage as l, getEnvCredential as m, buildOAuthLoginStart as n, discoverOAuthLogin as o, getEnvApiKey as p, classifyPushCandidates as r, discoverRemoteProjectMachineTargets as s, COMMANDS as t, formatPlanSummary as u, resolveApiKey as v, scanProjectSources as w, resolveProjectStatus as x, resolveConfiguredPullTargets as y };