swaggerbot 0.0.0-stage → 0.1.0

package/dist/swaggerbot.mjs

@@ -0,0 +1,1824 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+import { createHash, randomBytes } from "node:crypto";
+import { open, rename, rm, stat } from "node:fs/promises";
+var package_default = {
+	name: "swaggerbot",
+	version: "0.1.0",
+	license: "MIT",
+	description: "The swagger.bot CLI: the name of an API in, its verified OpenAPI/Swagger Spec with its Provenance out.",
+	type: "module",
+	bin: { "swaggerbot": "./dist/swaggerbot.mjs" },
+	files: ["dist", "README.md"],
+	engines: { "node": ">=20" },
+	repository: {
+		"type": "git",
+		"url": "git+https://github.com/evolv3ai/swaggerbot.git",
+		"directory": "cli"
+	},
+	homepage: "https://swaggerbot.dev",
+	keywords: [
+		"openapi",
+		"swagger",
+		"api",
+		"cli"
+	],
+	publishConfig: { "access": "public" }
+};
+//#endregion
+//#region src/cli/args.ts
+var CLI_USAGE = `usage: swaggerbot <command> [options]
+  lookup <name> [--api-version V] [--community] [--fresh]
+                      resolve a name to its verified Spec and Provenance,
+                      or say why not
+  login [--key K]     check a key and store it for this swagger.bot
+                      (prompted for it when --key isn't given)
+  logout              forget the stored key
+  key                 the key in use: its id, credits left, when they reset
+  spec <name | apiId | specId> [--form published|normalized]
+       [--api-version V] [-o FILE] [--force] [--no-wait]
+                      download a Spec: by name (a Lookup, Resolved only),
+                      apiId (its Current Spec) or Spec id; to FILE, to
+                      stdout on a pipe, else to the file the server names
+                      (--force to overwrite it). --no-wait: fail at once
+                      while the Normalized Form is being built. --json
+                      prints what was written, so it needs -o or a terminal
+  outline <name | apiId> [--tag T] [--query Q] [--spec-id S] [--limit N]
+          [--all]     its Spec Outline: title, servers, security schemes,
+                      tags, then the operations (100 a page, --limit up to
+                      500), by tag or a word of the path, operationId or
+                      summary; --all lists every tag and every page
+  operation <name | apiId> <method> <path> [--spec-id S]
+                      one operation, every reference inlined, as JSON
+  schema <name | apiId> <schemaName> [--spec-id S]
+                      one component schema, as JSON
+  vendors [<query>] [--all]
+                      the Vendors in the Index, 50 a page, their id, name
+                      and API count; those whose id or name holds <query>;
+                      --all lists every page
+  vendor <vendor>     a Vendor's APIs in the Index, each with its Current
+                      Spec, Provenance and download URLs
+Options:
+  --json              print the answer as the HTTP API gives it
+  --key <key>         the API key (or SWAGGERBOT_API_KEY, or the one
+                      login stored); needed for Discovery and --fresh
+  --url <origin>      another swagger.bot (or SWAGGERBOT_URL);
+                      default https://swaggerbot.dev
+  --no-color          no colour (or NO_COLOR); never on a pipe anyway
+  -V, --version       print the version
+  -h, --help          print this
+Exit codes: 0 Resolved or success, 3 Ambiguous, 4 Unconfirmed, 5 No Spec,
+6 Unknown, 1 refused or failed (no key, quota, unreachable), 2 usage.`;
+/** The methods an OpenAPI Path Item holds operations under. */
+var METHODS = [
+	"get",
+	"put",
+	"post",
+	"delete",
+	"options",
+	"head",
+	"patch",
+	"trace"
+];
+function fail(error) {
+	return {
+		ok: false,
+		error,
+		exitCode: 2
+	};
+}
+/** The flags that go with some commands only, to refuse them elsewhere. */
+var COMMAND_FLAGS = {
+	lookup: [
+		"api-version",
+		"community",
+		"fresh"
+	],
+	spec: [
+		"api-version",
+		"form",
+		"output",
+		"force",
+		"no-wait"
+	],
+	outline: [
+		"tag",
+		"query",
+		"spec-id",
+		"limit",
+		"all",
+		"cursor"
+	],
+	operation: ["spec-id"],
+	schema: ["spec-id"],
+	vendors: ["all", "cursor"]
+};
+/** `-o` is `--output` to `parseArgs`; say it as it was given. */
+var FLAG_WORDS = { output: "-o" };
+/** A Spec id: the lowercase hex sha256 of its Published Form. */
+var SPEC_ID = /^[0-9a-f]{64}$/i;
+/** Parses and validates `swaggerbot`'s arguments without running anything. */
+function parseCliArgs(args) {
+	let values;
+	let positionals;
+	try {
+		({values, positionals} = parseArgs({
+			args,
+			allowPositionals: true,
+			options: {
+				json: { type: "boolean" },
+				key: { type: "string" },
+				url: { type: "string" },
+				"no-color": { type: "boolean" },
+				version: {
+					type: "boolean",
+					short: "V"
+				},
+				help: {
+					type: "boolean",
+					short: "h"
+				},
+				"api-version": { type: "string" },
+				community: { type: "boolean" },
+				fresh: { type: "boolean" },
+				form: { type: "string" },
+				output: {
+					type: "string",
+					short: "o"
+				},
+				force: { type: "boolean" },
+				"no-wait": { type: "boolean" },
+				tag: { type: "string" },
+				query: { type: "string" },
+				"spec-id": { type: "string" },
+				limit: { type: "string" },
+				all: { type: "boolean" },
+				cursor: { type: "string" }
+			}
+		}));
+	} catch (err) {
+		return fail(err.message);
+	}
+	const globals = {
+		json: values.json === true,
+		noColor: values["no-color"] === true
+	};
+	if (values.key !== void 0) {
+		if (!values.key.trim()) return fail("--key needs a key");
+		globals.key = values.key.trim();
+	}
+	if (values.url !== void 0) {
+		const url = values.url.trim().replace(/\/+$/, "");
+		if (!/^https?:\/\/\S+$/.test(url)) return fail(`--url must be an http(s) origin (got "${values.url}")`);
+		globals.url = url;
+	}
+	if (values.version) return {
+		ok: true,
+		command: { command: "version" },
+		globals
+	};
+	if (values.help) return {
+		ok: true,
+		command: { command: "help" },
+		globals
+	};
+	const [command, ...rest] = positionals;
+	const owned = new Set(command ? COMMAND_FLAGS[command] : void 0);
+	for (const flag of new Set(Object.values(COMMAND_FLAGS).flat())) {
+		if (owned.has(flag) || values[flag] === void 0) continue;
+		const owners = Object.keys(COMMAND_FLAGS).filter((owner) => COMMAND_FLAGS[owner]?.includes(flag));
+		return fail(`${FLAG_WORDS[flag] ?? `--${flag}`} only goes with ${owners.join(" or ")}`);
+	}
+	switch (command) {
+		case "lookup": {
+			const [name, ...extra] = rest;
+			if (!name?.trim()) return fail("lookup needs a name");
+			if (extra.length > 0) return fail(`unexpected argument: ${extra[0]}`);
+			if (values["api-version"] !== void 0 && !values["api-version"].trim()) return fail("--api-version needs a version");
+			return {
+				ok: true,
+				command: {
+					command,
+					name: name.trim(),
+					...values["api-version"] === void 0 ? {} : { apiVersion: values["api-version"].trim() },
+					community: values.community === true,
+					fresh: values.fresh === true
+				},
+				globals
+			};
+		}
+		case "spec": {
+			const [given, ...extra] = rest;
+			const arg = given?.trim();
+			if (!arg) return fail("spec needs a name, an apiId or a Spec id");
+			if (extra.length > 0) return fail(`unexpected argument: ${extra[0]}`);
+			const target = SPEC_ID.test(arg) ? {
+				kind: "specId",
+				specId: arg.toLowerCase()
+			} : arg.includes("/") ? {
+				kind: "apiId",
+				apiId: arg
+			} : {
+				kind: "name",
+				name: arg
+			};
+			const form = values.form ?? "published";
+			if (form !== "published" && form !== "normalized") return fail(`--form is published or normalized (got "${form}")`);
+			const apiVersion = values["api-version"];
+			if (apiVersion !== void 0 && !apiVersion.trim()) return fail("--api-version needs a version");
+			if (apiVersion !== void 0 && target.kind !== "name") return fail(target.kind === "specId" ? "--api-version goes with a name: a Spec id names one Spec already" : "--api-version goes with a name: an apiId gives its Current Spec only");
+			if (values.output !== void 0 && !values.output.trim()) return fail("-o needs a file");
+			return {
+				ok: true,
+				command: {
+					command,
+					target,
+					form,
+					...apiVersion === void 0 ? {} : { apiVersion: apiVersion.trim() },
+					...values.output === void 0 ? {} : { output: values.output },
+					force: values.force === true,
+					noWait: values["no-wait"] === true
+				},
+				globals
+			};
+		}
+		case "outline": {
+			const [given, ...extra] = rest;
+			const target = apiTargetOf(given);
+			if (!target) return fail("outline needs a name or an apiId");
+			if (extra.length > 0) return fail(`unexpected argument: ${extra[0]}`);
+			const specId = specIdOf(values["spec-id"]);
+			if (specId === null) return fail(SPEC_ID_WORDS);
+			for (const flag of [
+				"tag",
+				"query",
+				"cursor"
+			]) if (values[flag] !== void 0 && !values[flag].trim()) return fail(`--${flag} needs a value`);
+			let limit;
+			if (values.limit !== void 0) {
+				limit = Number(values.limit);
+				if (!/^\d+$/.test(values.limit.trim()) || limit < 1 || limit > 500) return fail(`--limit is a whole number from 1 to 500 (got "${values.limit}")`);
+			}
+			return {
+				ok: true,
+				command: {
+					command,
+					target,
+					...values.tag === void 0 ? {} : { tag: values.tag.trim() },
+					...values.query === void 0 ? {} : { query: values.query.trim() },
+					...specId === void 0 ? {} : { specId },
+					...limit === void 0 ? {} : { limit },
+					all: values.all === true,
+					...values.cursor === void 0 ? {} : { cursor: values.cursor.trim() }
+				},
+				globals
+			};
+		}
+		case "operation": {
+			const [given, method, path, ...extra] = rest;
+			const target = apiTargetOf(given);
+			if (!target || !method?.trim() || !path?.trim()) return fail("operation needs a name or an apiId, a method and a path, as in: operation stripe.com/stripe-api post /v1/customers");
+			if (extra.length > 0) return fail(`unexpected argument: ${extra[0]}`);
+			if (!METHODS.includes(method.trim().toLowerCase())) return fail(`the method is one of ${METHODS.join(", ")} (got "${method}")`);
+			const specId = specIdOf(values["spec-id"]);
+			if (specId === null) return fail(SPEC_ID_WORDS);
+			return {
+				ok: true,
+				command: {
+					command,
+					target,
+					method: method.trim().toLowerCase(),
+					path: path.trim(),
+					...specId === void 0 ? {} : { specId }
+				},
+				globals
+			};
+		}
+		case "schema": {
+			const [given, name, ...extra] = rest;
+			const target = apiTargetOf(given);
+			if (!target || !name?.trim()) return fail("schema needs a name or an apiId and a schema name, as in: schema stripe.com/stripe-api customer");
+			if (extra.length > 0) return fail(`unexpected argument: ${extra[0]}`);
+			const specId = specIdOf(values["spec-id"]);
+			if (specId === null) return fail(SPEC_ID_WORDS);
+			return {
+				ok: true,
+				command: {
+					command,
+					target,
+					name: name.trim(),
+					...specId === void 0 ? {} : { specId }
+				},
+				globals
+			};
+		}
+		case "vendors": {
+			const [query, ...extra] = rest;
+			if (extra.length > 0) return fail(`unexpected argument: ${extra[0]}`);
+			if (values.cursor !== void 0 && !values.cursor.trim()) return fail("--cursor needs a value");
+			return {
+				ok: true,
+				command: {
+					command,
+					...query?.trim() ? { query: query.trim() } : {},
+					all: values.all === true,
+					...values.cursor === void 0 ? {} : { cursor: values.cursor.trim() }
+				},
+				globals
+			};
+		}
+		case "vendor": {
+			const [vendor, ...extra] = rest;
+			if (!vendor?.trim()) return fail("vendor needs a Vendor: its id, domain or name, as in: vendor stripe.com");
+			if (extra.length > 0) return fail(`unexpected argument: ${extra[0]}`);
+			return {
+				ok: true,
+				command: {
+					command,
+					vendor: vendor.trim()
+				},
+				globals
+			};
+		}
+		case "login":
+		case "logout":
+		case "key":
+			if (rest.length > 0) return fail(`unexpected argument: ${rest[0]}`);
+			return {
+				ok: true,
+				command: { command },
+				globals
+			};
+		case void 0: return fail("no command given");
+		default: return fail(`unknown command: ${command}`);
+	}
+}
+var SPEC_ID_WORDS = "--spec-id is a Spec id: 64 hex characters";
+/** A name, or an apiId when it has a `/`; none when blank. */
+function apiTargetOf(given) {
+	const arg = given?.trim();
+	if (!arg) return void 0;
+	return arg.includes("/") ? {
+		kind: "apiId",
+		apiId: arg
+	} : {
+		kind: "name",
+		name: arg
+	};
+}
+/** `--spec-id` lowercased; `undefined` when not given, `null` when it isn't a Spec id. */
+function specIdOf(given) {
+	if (given === void 0) return void 0;
+	return SPEC_ID.test(given.trim()) ? given.trim().toLowerCase() : null;
+}
+//#endregion
+//#region src/cli/config.ts
+/**
+* Where the config file lives: `SWAGGERBOT_CONFIG` when set; else
+* `%APPDATA%\swaggerbot\config.json` on Windows and
+* `$XDG_CONFIG_HOME/swaggerbot/config.json` (`~/.config/…`) elsewhere.
+*/
+function configPathOf(env, { platform = process.platform, home = homedir() } = {}) {
+	const override = env.SWAGGERBOT_CONFIG?.trim();
+	if (override) return override;
+	const base = platform === "win32" ? env.APPDATA?.trim() || join(home, "AppData", "Roaming") : env.XDG_CONFIG_HOME?.trim() || join(home, ".config");
+	return join(base, "swaggerbot", "config.json");
+}
+/** The origin a swagger.bot URL names, the part a key is stored under; undefined when it isn't a URL. */
+function originOf(baseUrl) {
+	try {
+		return new URL(baseUrl).origin;
+	} catch {
+		return;
+	}
+}
+/**
+* The config file as it stands, or an empty one when there is none. A file
+* that isn't JSON is read as empty too, and `note` is told, so no command
+* is blocked by it and the next write replaces it.
+*/
+function readConfig(path, note) {
+	let text;
+	try {
+		text = readFileSync(path, "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") return { keys: {} };
+		throw err;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		note(`${path} isn't JSON: read as holding no key; the next \`swaggerbot login\` or \`logout\` replaces it.`);
+		return { keys: {} };
+	}
+	const keys = parsed && typeof parsed === "object" ? parsed.keys : void 0;
+	const config = { keys: {} };
+	if (keys && typeof keys === "object") {
+		for (const [origin, key] of Object.entries(keys)) if (typeof key === "string" && key) config.keys[origin] = key;
+	}
+	return config;
+}
+/**
+* Writes the config, readable by its owner only (mode 0600, in a 0700
+* directory, made as needed): written whole to a sibling, then moved into
+* place, so a crash leaves the old file, never half of the new.
+*/
+function writeConfig(path, config) {
+	mkdirSync(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const temp = `${path}.${process.pid}.tmp`;
+	writeFileSync(temp, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+	if (process.platform !== "win32") chmodSync(temp, 384);
+	renameSync(temp, path);
+}
+/** The key stored for `baseUrl`'s origin, and no other's; none without one. */
+function storedKeyOf(path, baseUrl, note) {
+	const origin = originOf(baseUrl);
+	if (!origin) return void 0;
+	return readConfig(path, note).keys[origin];
+}
+/** Stores `key` for `baseUrl`'s origin, keeping the other origins' keys. */
+function storeKey(path, baseUrl, key, note) {
+	const origin = originOf(baseUrl);
+	if (!origin) throw new Error(`${baseUrl} isn't a URL.`);
+	const config = readConfig(path, note);
+	config.keys[origin] = key;
+	writeConfig(path, config);
+}
+/**
+* Removes the key stored for `baseUrl`'s origin: true when there was one.
+* A file that isn't JSON is replaced by an empty config, so `logout` always
+* leaves a config with no key for the origin.
+*/
+function removeKey(path, baseUrl, note) {
+	const origin = originOf(baseUrl);
+	if (!origin) return false;
+	let replace = false;
+	const config = readConfig(path, (message) => {
+		replace = true;
+		note(message);
+	});
+	const removed = origin in config.keys;
+	delete config.keys[origin];
+	if (removed || replace) writeConfig(path, config);
+	return removed;
+}
+/** Where a Caller gets an API key. */
+var KEYS_URL = "https://swaggerbot.dev/keys";
+/** Said whenever Discovery or `--fresh` is asked for without a key. */
+var NEEDS_KEY_HINT = `Discovery needs an API key. Get one at ${KEYS_URL}, then run \`swaggerbot login\`.`;
+/** A request without a key waits this long; a keyed Lookup (Discovery) longer. */
+var TIMEOUT_MS = 3e4;
+var KEYED_LOOKUP_TIMEOUT_MS = 12e4;
+/** A download waits this long for its headers and again between chunks of its body. */
+var DOWNLOAD_TIMEOUT_MS = 12e4;
+/**
+* The CLI's origin: `--url`, else `SWAGGERBOT_URL`, else swaggerbot.dev,
+* without a trailing slash.
+*/
+function baseUrlOf(flag, env) {
+	return (flag ?? env.SWAGGERBOT_URL?.trim() ?? "").replace(/\/+$/, "") || "https://swaggerbot.dev";
+}
+/**
+* The key in hand: `--key`, else `SWAGGERBOT_API_KEY`; none without either.
+* The one `swaggerbot login` stored comes after these (D3), read by a
+* command only when it needs a key (`storedKeyOf`).
+*/
+function keyOf(flag, env) {
+	return flag ?? (env.SWAGGERBOT_API_KEY?.trim() || void 0);
+}
+/** `swaggerbot-cli/<version> node/<v>`, so the server can tell the CLI apart. */
+function userAgentOf(version) {
+	return `swaggerbot-cli/${version} node/${process.versions.node}`;
+}
+/**
+* `POST <baseUrl><path>` with a JSON body, the bearer when a key is given,
+* and `timeoutMs` to answer, body included. A 2xx is `ok` with the body parsed and its
+* exact text; anything else, or no answer, is the error mapped from the
+* server's body (`error`, `hint`) with a hint for the statuses the CLI
+* knows how to get past.
+*/
+async function postJson(http, path, body, { timeoutMs }) {
+	return requestJson(http, path, {
+		timeoutMs,
+		method: "POST",
+		body
+	});
+}
+/** `GET <baseUrl><path>`, otherwise as `postJson`. */
+async function getJson(http, path, { timeoutMs }) {
+	return requestJson(http, path, {
+		timeoutMs,
+		method: "GET"
+	});
+}
+async function requestJson(http, path, { timeoutMs, method, body }) {
+	const headers = {
+		accept: "application/json",
+		"user-agent": userAgentOf(http.version)
+	};
+	if (method === "POST") headers["content-type"] = "application/json";
+	if (http.key) headers.authorization = `Bearer ${http.key}`;
+	const doFetch = http.fetch ?? globalThis.fetch;
+	let response;
+	let text;
+	try {
+		response = await doFetch(`${http.baseUrl}${path}`, {
+			method,
+			headers,
+			...method === "POST" ? { body: JSON.stringify(body) } : {},
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		text = await response.text();
+	} catch (err) {
+		return {
+			ok: false,
+			error: transportError(err, http.baseUrl, timeoutMs)
+		};
+	}
+	if (response.ok) try {
+		return {
+			ok: true,
+			status: response.status,
+			body: JSON.parse(text),
+			text,
+			headers: response.headers
+		};
+	} catch {
+		return {
+			ok: false,
+			error: {
+				status: response.status,
+				error: `${http.baseUrl} answered ${response.status} but not with JSON.`
+			},
+			text,
+			headers: response.headers
+		};
+	}
+	return {
+		ok: false,
+		error: serverError(response, text, http.baseUrl),
+		text,
+		headers: response.headers
+	};
+}
+/**
+* A download's answer: the response with its body still to read, or the
+* error as `getJson` gives it. `url` is absolute or a path on the base URL;
+* no key goes with it, as downloads are public and an absolute URL may be
+* another origin's. The headers have `DOWNLOAD_TIMEOUT_MS` to come, and so
+* has each chunk of the body after them: `alive` restarts that wait,
+* `done` stops it.
+*/
+async function getDownload(http, url) {
+	const target = /^https?:\/\//i.test(url) ? url : `${http.baseUrl}${url}`;
+	const doFetch = http.fetch ?? globalThis.fetch;
+	const controller = new AbortController();
+	let timer;
+	const done = () => clearTimeout(timer);
+	const alive = () => {
+		done();
+		timer = setTimeout(() => controller.abort(new DOMException("The download stalled.", "TimeoutError")), DOWNLOAD_TIMEOUT_MS);
+	};
+	const failed = (err) => {
+		done();
+		return {
+			ok: false,
+			error: transportError(err, http.baseUrl, DOWNLOAD_TIMEOUT_MS)
+		};
+	};
+	alive();
+	let response;
+	try {
+		response = await doFetch(target, {
+			headers: { "user-agent": userAgentOf(http.version) },
+			signal: controller.signal
+		});
+	} catch (err) {
+		return failed(err);
+	}
+	if (response.ok) return {
+		ok: true,
+		response,
+		alive,
+		done
+	};
+	let text;
+	try {
+		text = await response.text();
+	} catch (err) {
+		return failed(err);
+	}
+	done();
+	return {
+		ok: false,
+		error: serverError(response, text, http.baseUrl),
+		text,
+		headers: response.headers
+	};
+}
+/** A failed response as the CLI's error: the server's words, plus a way past. */
+function serverError(response, text, baseUrl) {
+	const { status } = response;
+	let parsed = {};
+	try {
+		const json = JSON.parse(text);
+		if (json && typeof json === "object") parsed = json;
+	} catch {}
+	const error = typeof parsed.error === "string" && parsed.error ? parsed.error : `${baseUrl} answered ${status}${response.statusText ? ` ${response.statusText}` : ""}.`;
+	const serverHint = typeof parsed.hint === "string" ? parsed.hint : void 0;
+	const retryAfter = response.headers.get("retry-after");
+	switch (status) {
+		case 401: return {
+			status,
+			error,
+			hint: /needs an api key/i.test(error) ? NEEDS_KEY_HINT : `Check the key, or get a new one at ${KEYS_URL}, then run \`swaggerbot login\`.`
+		};
+		case 429: return {
+			status,
+			error,
+			hint: retryAfter ? `Retry in ${retryAfterWords(retryAfter)}.` : serverHint ?? "Retry later."
+		};
+		case 503: return {
+			status,
+			error,
+			hint: retryAfter ? `Retry in ${retryAfterWords(retryAfter)}.` : serverHint ?? "Retry shortly."
+		};
+		default: return serverHint ? {
+			status,
+			error,
+			hint: serverHint
+		} : {
+			status,
+			error
+		};
+	}
+}
+/** No answer at all: refused, unreachable or too slow. Status 0. */
+function transportError(err, baseUrl, timeoutMs) {
+	const name = err instanceof Error ? err.name : "";
+	if (name === "TimeoutError" || name === "AbortError") return {
+		status: 0,
+		error: `${baseUrl} did not answer within ${Math.round(timeoutMs / 1e3)} s.`,
+		hint: "Retry, or check the service at https://swaggerbot.dev/api/health."
+	};
+	const cause = err?.cause;
+	return {
+		status: 0,
+		error: `Could not reach ${baseUrl}: ${cause instanceof Error ? cause.message : err instanceof Error ? err.message : String(err)}`,
+		hint: "Check the network, or --url / SWAGGERBOT_URL if you set one."
+	};
+}
+/** `retry-after` as words: seconds, or an HTTP date's distance from now. */
+function retryAfterWords(value) {
+	return durationWords(retryAfterSeconds(value, Date.now()) ?? 0);
+}
+/** `retry-after` in seconds: as given, or an HTTP date's distance from `now`; none when it is neither. */
+function retryAfterSeconds(value, now) {
+	if (!value) return void 0;
+	if (/^\d+$/.test(value.trim())) return Number(value.trim());
+	const at = Date.parse(value);
+	return Number.isNaN(at) ? void 0 : Math.ceil((at - now) / 1e3);
+}
+/** A wait in a person's words: `45 s`, `20 min`, `5 h`; `a moment` when it is over or unknown. */
+function durationWords(seconds) {
+	if (!Number.isFinite(seconds) || seconds <= 0) return "a moment";
+	if (seconds < 90) return `${seconds} s`;
+	if (seconds < 5400) return `${Math.ceil(seconds / 60)} min`;
+	return `${Math.ceil(seconds / 3600)} h`;
+}
+//#endregion
+//#region src/cli/render.ts
+/**
+* Whether to colour a stream's output: only when it is a terminal, and never
+* with `--no-color` or `NO_COLOR` set in the environment (https://no-color.org).
+*/
+function colorEnabled(isTTY, env, noColor) {
+	if (noColor) return false;
+	if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
+	return isTTY;
+}
+/** The few ANSI colours the views use; identity when colour is off. */
+function palette(color) {
+	const wrap = (open, close) => (text) => color ? `\u001b[${open}m${text}\u001b[${close}m` : text;
+	return {
+		green: wrap(32, 39),
+		yellow: wrap(33, 39),
+		red: wrap(31, 39),
+		dim: wrap(2, 22),
+		bold: wrap(1, 22)
+	};
+}
+/**
+* The CLI's exit codes (D4), the one mapping every command uses: 0 for
+* Resolved or success, one code per other Outcome, 1 for a refusal or a
+* failed request (401, 429, 503, no answer), 2 for a usage error. `--json`
+* exits the same.
+*/
+var EXIT = {
+	ok: 0,
+	failed: 1,
+	usage: 2,
+	Ambiguous: 3,
+	Unconfirmed: 4,
+	NoSpec: 5,
+	Unknown: 6
+};
+/** The exit code an Outcome earns: 0 for Resolved, 3 to 6 for the others. */
+function outcomeExitCode(outcome) {
+	return outcome.outcome === "Resolved" ? EXIT.ok : EXIT[outcome.outcome];
+}
+/**
+* A download URL as the server gives it, made absolute: the server gives a
+* path (`/api/specs/…`) when it has no `PUBLIC_BASE_URL`.
+*/
+function absolute(url, baseUrl) {
+	return /^https?:\/\//i.test(url) ? url : `${baseUrl}${url}`;
+}
+/** `2026-09-24T00:07:16.403Z` → `2026-09-24`. */
+function day(timestamp) {
+	return timestamp.slice(0, 10);
+}
+/**
+* One line for the Outcome, the Spec's URL (its Published Form) and the
+* Provenance where there is one; Resolved is that one line alone. Dimmer
+* lines follow for what explains the other Outcomes: candidates, reasons,
+* diagnostics.
+*/
+function renderOutcome(outcome, { baseUrl, color }) {
+	const p = palette(color);
+	const lines = [];
+	switch (outcome.outcome) {
+		case "Resolved":
+			lines.push([
+				p.green(p.bold("Resolved")),
+				`${outcome.api.name} (${outcome.api.id})`,
+				outcome.provenance,
+				absolute(outcome.currentSpec.downloads.published, baseUrl),
+				p.dim(`verified ${day(outcome.verifiedAt)}`)
+			].join("  "));
+			break;
+		case "Ambiguous":
+			lines.push([p.yellow(p.bold("Ambiguous")), `${outcome.candidates.length} APIs could be meant; say which`].join("  "));
+			for (const c of outcome.candidates) lines.push(p.dim(`  ${c.name}${c.vendor ? ` (${c.vendor})` : ""}${c.apiId ? `  ${c.apiId}` : ""}  ${Math.round(c.probability * 100)}%`));
+			break;
+		case "Unconfirmed": {
+			let best;
+			for (const tier of [
+				"Official",
+				"Endorsed",
+				"Mirror",
+				"Community"
+			]) if (!best && outcome.sources.some((s) => s.provenance === tier)) best = tier;
+			lines.push([
+				p.yellow(p.bold("Unconfirmed")),
+				`${outcome.api.name} (${outcome.api.id})`,
+				best ?? "",
+				absolute(outcome.spec.downloads.published, baseUrl),
+				p.dim(`verified ${day(outcome.verifiedAt)}`)
+			].filter(Boolean).join("  "));
+			lines.push(p.dim(`  not confirmed to describe it: ${outcome.reasons.join("; ")}`));
+			break;
+		}
+		case "NoSpec":
+			lines.push([
+				p.red(p.bold("No Spec")),
+				`${outcome.api.name} (${outcome.api.id})`,
+				outcome.communityAvailable ? "a Community Spec exists: add --community to allow it" : "no Spec at an allowed Provenance"
+			].join("  "));
+			break;
+		case "Unknown": lines.push([p.red(p.bold("Unknown")), `no API matches "${outcome.name}"`].join("  "));
+	}
+	if (outcome.diagnostics?.length) lines.push(p.dim(`  diagnostics: ${outcome.diagnostics.join(" | ")}`));
+	return `${lines.join("\n")}\n`;
+}
+/** A size as a person reads it: `512 B`, `72.5 kB`, `6.1 MB`. */
+function sizeWords(bytes) {
+	if (bytes < 1e3) return `${bytes} B`;
+	if (bytes < 1e6) return `${(bytes / 1e3).toFixed(1)} kB`;
+	return `${(bytes / 1e6).toFixed(1)} MB`;
+}
+/** `87 credits left today`; `1 credit`; `no credits left today`. */
+function creditsWords(remaining) {
+	if (remaining <= 0) return "no credits left today";
+	return `${remaining} credit${remaining === 1 ? "" : "s"} left today`;
+}
+/** `resets at 00:00 UTC, in 5 h`, from when the credits are next refilled. */
+function resetWords(resetsAt, now) {
+	const at = new Date(resetsAt);
+	if (Number.isNaN(at.getTime())) return "";
+	return `resets at ${String(at.getUTCHours()).padStart(2, "0")}:${String(at.getUTCMinutes()).padStart(2, "0")} UTC, in ${durationWords(Math.ceil((at.getTime() - now.getTime()) / 1e3))}`;
+}
+/** A failed request, for stderr: what went wrong, then what fixes it. */
+function renderError(error, color) {
+	const p = palette(color);
+	const lines = [`${p.red(p.bold("error"))}  ${error.error}`];
+	if (error.hint) lines.push(`  ${error.hint}`);
+	return `${lines.join("\n")}\n`;
+}
+/** A warning, for stderr: something the command went on past. */
+function renderWarning(message, color) {
+	const p = palette(color);
+	return `${p.yellow(p.bold("warning"))}  ${message}\n`;
+}
+/** A usage error, for stderr, with where to read the usage. */
+function renderUsageError(message, color) {
+	const p = palette(color);
+	return `${p.red(p.bold("usage error"))}  ${message}\n  Run \`swaggerbot --help\` for the usage.\n`;
+}
+/** The widest the method, path and operationId columns are padded to. */
+var OUTLINE_COLUMN_CAPS = [
+	7,
+	48,
+	36
+];
+/**
+* The Spec Outline as a person reads it: the title and API Version, the
+* servers and security schemes, the tags with their operation counts (the
+* `SHOWN_TAGS` largest unless `allTags`), then the operations as a table,
+* `METHOD path  operationId  summary`, and how many of how many there are,
+* with the cursor of the next page when there is one.
+*/
+function renderOutline(page, { allTags, color }) {
+	const p = palette(color);
+	const lines = [];
+	lines.push([
+		p.bold(clean(page.title ?? page.apiId)),
+		page.apiVersion === null ? "" : `API Version ${clean(page.apiVersion)}`,
+		p.dim(page.apiId)
+	].filter(Boolean).join("  "));
+	const field = (name, value) => lines.push(`${p.dim(name.padEnd(9))} ${value}`);
+	field("servers", page.servers.length > 0 ? page.servers.map(clean).join("  ") : "none");
+	field("security", page.securitySchemes.length > 0 ? page.securitySchemes.map((s) => `${clean(s.name)} (${[
+		s.type,
+		s.scheme,
+		s.in && `in ${s.in}`
+	].filter(Boolean).map((w) => clean(w)).join(" ")})`).join(", ") : "none");
+	const tags = [...page.tags].sort((a, b) => b.operationCount - a.operationCount);
+	const shown = allTags ? tags : tags.slice(0, 20);
+	const more = [tags.length > shown.length ? `+${tags.length - shown.length} more: --all lists them` : "", page.tagsCut ? "the service sent only the largest" : ""].filter(Boolean);
+	field("tags", shown.length > 0 ? `${shown.map((t) => `${clean(t.name)} ${t.operationCount}`).join(", ")}${more.length > 0 ? p.dim(`  (${more.join("; ")})`) : ""}` : "none");
+	if (page.operations.length > 0) {
+		lines.push("");
+		const rows = page.operations.map((op) => [
+			op.method.toUpperCase(),
+			clean(op.path),
+			clean(op.operationId ?? ""),
+			`${clean(op.summary ?? "")}${op.deprecated ? p.dim(" (deprecated)") : ""}`
+		]);
+		const widths = OUTLINE_COLUMN_CAPS.map((cap, i) => Math.min(cap, Math.max(...rows.map((row) => row[i]?.length ?? 0))));
+		for (const [method = "", path = "", operationId = "", summary = ""] of rows) lines.push([
+			p.bold(method.padEnd(widths[0] ?? 0)),
+			path.padEnd(widths[1] ?? 0),
+			p.dim(operationId.padEnd(widths[2] ?? 0)),
+			summary
+		].join("  ").trimEnd());
+	}
+	lines.push("");
+	const { totalOperations: total, matchedOperations: matched } = page;
+	const count = matched === total ? `${page.operations.length} of ${total} operations` : `${page.operations.length} of ${matched} matching operations (${total} in all)`;
+	lines.push(page.nextCursor === null ? count : `${count}; next page: --cursor ${page.nextCursor}`);
+	return `${lines.join("\n")}\n`;
+}
+/**
+* One operation: a heading, `METHOD path · operationId · summary`, then
+* the operation as pretty JSON (it is a JSON object; a prose view would
+* invent structure), then the security schemes it names and the schemas
+* that recur within themselves, each as JSON; `truncated` and `circular`
+* are said under the heading.
+*/
+function renderOperation(body, color) {
+	const p = palette(color);
+	const { operationId, summary } = body.operation;
+	const lines = [
+		[
+			p.bold(`${body.method.toUpperCase()} ${clean(body.path)}`),
+			typeof operationId === "string" ? clean(operationId) : "",
+			typeof summary === "string" ? clean(summary) : ""
+		].filter(Boolean).join(" · "),
+		...expansionNotes(body, p),
+		prettyJson(body.operation)
+	];
+	if (Object.keys(body.securitySchemes).length > 0) lines.push(p.dim("security schemes"), prettyJson(body.securitySchemes));
+	if (Object.keys(body.circular).length > 0) lines.push(p.dim("circular"), prettyJson(body.circular));
+	return `${lines.join("\n")}\n`;
+}
+/** One schema: a heading, its name and API, then the schema as pretty JSON, as `renderOperation`. */
+function renderSchema(body, color) {
+	const p = palette(color);
+	const lines = [
+		`${p.bold(clean(body.name))} · ${p.dim(`components.schemas of ${body.apiId}`)}`,
+		...expansionNotes(body, p),
+		prettyJson(body.schema)
+	];
+	if (Object.keys(body.circular).length > 0) lines.push(p.dim("circular"), prettyJson(body.circular));
+	return `${lines.join("\n")}\n`;
+}
+/** What `truncated` and `circular` mean, said only when they apply. */
+function expansionNotes({ truncated, circular }, p) {
+	const notes = [];
+	if (truncated) notes.push(p.yellow("truncated: inlining stopped at the size cap; each reference left is {\"$ref\", \"x-truncated\": true}"));
+	const names = Object.keys(circular);
+	if (names.length > 0) notes.push(p.dim(`circular: ${names.map(clean).join(", ")} ${names.length === 1 ? "recurs within itself" : "recur within themselves"}; each is under "circular" once, and {"$ref", "x-circular": true} where it recurs`));
+	return notes;
+}
+/** The widest the id and name columns of the Vendor list are padded to. */
+var VENDOR_COLUMN_CAPS = [32, 32];
+/**
+* The Vendor list as a person reads it: a table of `id  name  N APIs`, then
+* how many of how many there are, with the cursor of the next page when
+* there is one.
+*/
+function renderVendors(page, { query, color }) {
+	const p = palette(color);
+	const lines = [];
+	const rows = page.vendors.map((v) => [
+		clean(v.id),
+		clean(v.name),
+		`${v.apiCount} API${v.apiCount === 1 ? "" : "s"}`
+	]);
+	const widths = VENDOR_COLUMN_CAPS.map((cap, i) => Math.min(cap, Math.max(...rows.map((row) => row[i]?.length ?? 0))));
+	for (const [id = "", name = "", count = ""] of rows) lines.push([
+		p.bold(id.padEnd(widths[0] ?? 0)),
+		name.padEnd(widths[1] ?? 0),
+		p.dim(count)
+	].join("  "));
+	if (lines.length > 0) lines.push("");
+	const count = `${page.vendors.length} of ${page.total} Vendors${query === void 0 ? "" : ` matching "${clean(query)}"`}`;
+	lines.push(page.nextCursor === null ? count : `${count}; --cursor ${page.nextCursor} for the next page`);
+	return `${lines.join("\n")}\n`;
+}
+/**
+* A Vendor's APIs as a person reads them: the Vendor, then each API with its
+* id, its Current Spec (API Version, format, Provenance, when it was
+* verified) and both download URLs, or that the Index has no confirmed Spec
+* of it yet.
+*/
+function renderVendorApis(body, { baseUrl, color }) {
+	const p = palette(color);
+	const lines = [`${p.bold(clean(body.vendor.name))}  ${p.dim(clean(body.vendor.id))}`];
+	for (const { api, currentSpec, provenance, verifiedAt } of body.apis) {
+		lines.push("", `${p.bold(clean(api.name))}  ${clean(api.id)}`);
+		if (!currentSpec) {
+			lines.push(p.dim("  no confirmed Spec in the Index yet"));
+			continue;
+		}
+		lines.push(`  ${[
+			currentSpec.apiVersion === null ? "no API Version" : `API Version ${clean(currentSpec.apiVersion)}`,
+			currentSpec.format,
+			provenance ?? "",
+			verifiedAt ? p.dim(`verified ${day(verifiedAt)}`) : ""
+		].filter(Boolean).join("  ")}`, `  ${p.dim("published ")}  ${absolute(currentSpec.downloads.published, baseUrl)}`, `  ${p.dim("normalized")}  ${absolute(currentSpec.downloads.normalized, baseUrl)}${currentSpec.normalized === "ready" ? "" : p.dim(currentSpec.normalized === "pending" ? "  (being built)" : "  (couldn't be built)")}`);
+	}
+	lines.push("", `${body.apis.length} API${body.apis.length === 1 ? "" : "s"} in the Index`);
+	return `${lines.join("\n")}\n`;
+}
+/** The Vendors a name could mean, as `lookup` shows an Ambiguous Outcome. */
+function renderVendorMatches(body, { vendor, color }) {
+	const p = palette(color);
+	const width = Math.max(...body.vendors.map((v) => clean(v.id).length));
+	return `${[
+		[p.yellow(p.bold("Ambiguous")), `${body.vendors.length} Vendors match "${clean(vendor)}"; say which`].join("  "),
+		...body.vendors.map((v) => p.dim(`  ${clean(v.id).padEnd(width)}  ${clean(v.name)}`)),
+		p.dim("  `swaggerbot vendor <id>` lists one")
+	].join("\n")}\n`;
+}
+/** A Vendor the Index doesn't hold, as `lookup` shows an Unknown Outcome, and how to add one. */
+function renderUnknownVendor(vendor, color) {
+	const p = palette(color);
+	return `${[[p.red(p.bold("Unknown")), `no Vendor "${clean(vendor)}" in the Index`].join("  "), p.dim("  Only APIs already in the Index are listed: `swaggerbot lookup <name>` finds an API and adds it, with its Vendor, to the Index.")].join("\n")}\n`;
+}
+/**
+* `value` as JSON indented by two, safe on a terminal: `JSON.stringify`
+* escapes C0 controls itself, and DEL and the C1 controls are escaped too.
+*/
+function prettyJson(value) {
+	return JSON.stringify(value, null, 2).replace(/[\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/** A Spec's text for one line of a terminal: runs of whitespace as one space, control characters gone. */
+function clean(text) {
+	return text.replace(/\s+/g, " ").replace(/[\u0000-\u001f\u007f-\u009f]/g, "").trim();
+}
+//#endregion
+//#region src/cli/commands/lookup.ts
+/**
+* `swaggerbot lookup <name>`: `POST /api/lookup`, then one line per Outcome
+* (or the body as is with `--json`). Exit 0 for Resolved, 3 to 6 for the
+* other Outcomes, 1 when the request failed (`EXIT`). The key in hand goes with the
+* request; the stored one is read only when a key is needed: for `--fresh`
+* before sending, else when the server answers 401 for a name the Index
+* can't answer, and the Lookup is sent again with it. `--fresh` with no
+* key at all says what the server would, and sends nothing; with `--json`
+* the request goes out so stdout carries the server's own answer.
+*/
+async function runLookup(args, { http, configPath, note, globals, io, color, stderrColor }) {
+	const stored = () => storedKeyOf(configPath, http.baseUrl, note);
+	let keyed = http;
+	if (args.fresh && !http.key) keyed = {
+		...http,
+		key: stored()
+	};
+	if (args.fresh && !keyed.key && !globals.json) return failed({ error: {
+		status: 401,
+		error: "--fresh needs an API key.",
+		hint: NEEDS_KEY_HINT
+	} }, globals, io, stderrColor);
+	const result = await requestLookup({
+		name: args.name,
+		...args.apiVersion === void 0 ? {} : { apiVersion: args.apiVersion },
+		...args.community ? { allowCommunity: true } : {},
+		...args.fresh ? { fresh: true } : {}
+	}, keyed, {
+		retryWithStored: !args.fresh,
+		stored
+	});
+	if (!result.ok) return failed(result, globals, io, stderrColor);
+	return printOutcome(result, {
+		http,
+		globals,
+		io,
+		color
+	});
+}
+/**
+* `POST /api/lookup` with the key in `http`, if any; a 401 for a Lookup sent
+* without one is sent again with the stored key (`stored`) when
+* `retryWithStored` and there is one.
+*/
+async function requestLookup(body, http, { retryWithStored, stored }) {
+	const post = (through) => postJson(through, "/api/lookup", body, { timeoutMs: through.key ? KEYED_LOOKUP_TIMEOUT_MS : TIMEOUT_MS });
+	const result = await post(http);
+	if (!result.ok && result.error.status === 401 && !http.key && retryWithStored) {
+		const key = stored();
+		if (key) return post({
+			...http,
+			key
+		});
+	}
+	return result;
+}
+/** The Outcome as `lookup` prints it (or its body as is with `--json`), and its exit code. */
+function printOutcome(result, { http, globals, io, color }) {
+	if (globals.json) io.stdout.write(`${result.text}\n`);
+	else io.stdout.write(renderOutcome(result.body, {
+		baseUrl: http.baseUrl,
+		color
+	}));
+	return outcomeExitCode(result.body);
+}
+/**
+* A failed request. With `--json`, stdout gets the server's body exactly as
+* it answered, or `{"status":0,"error":…}` when no answer came; otherwise
+* stderr gets the error for a person. Exit 1.
+*/
+function failed({ error, text }, globals, io, color) {
+	if (globals.json) io.stdout.write(`${text ?? JSON.stringify({
+		status: error.status,
+		error: error.error
+	})}\n`);
+	else io.stderr.write(renderError(error, color));
+	return EXIT.failed;
+}
+//#endregion
+//#region src/cli/commands/key.ts
+/**
+* `swaggerbot key`: `GET /api/key` with the key in use (`--key`, else
+* `SWAGGERBOT_API_KEY`, else the one `login` stored for this origin), and
+* one line: its id, the credits left today and when they reset. Without a
+* key it says so. Exit 0, or 1 when there is no key or the request failed.
+*/
+async function runKey(_args, { http, configPath, note, globals, io, color, stderrColor }) {
+	const key = http.key ?? storedKeyOf(configPath, http.baseUrl, note);
+	if (!key) return failed({ error: {
+		status: 0,
+		error: `No API key is configured for ${http.baseUrl}.`,
+		hint: `Get one at ${KEYS_URL}, then run \`swaggerbot login\`.`
+	} }, globals, io, stderrColor);
+	const result = await getJson({
+		...http,
+		key
+	}, "/api/key", { timeoutMs: TIMEOUT_MS });
+	if (!result.ok) return failed(result, globals, io, stderrColor);
+	if (globals.json) {
+		io.stdout.write(`${result.text}\n`);
+		return 0;
+	}
+	const p = palette(color);
+	const { id, remaining, limit, resetsAt } = result.body;
+	const now = io.now?.() ?? /* @__PURE__ */ new Date();
+	const parts = [p.bold(id)];
+	if (remaining === void 0) parts.push("credits unknown");
+	else parts.push(`${creditsWords(remaining)}${limit === void 0 ? "" : ` of ${limit}`}`);
+	const reset = resetsAt ? resetWords(resetsAt, now) : "";
+	if (reset) parts.push(p.dim(reset));
+	io.stdout.write(`${parts.join("  ")}\n`);
+	return 0;
+}
+//#endregion
+//#region src/cli/commands/login.ts
+/** Said when a key is needed and the person has none in hand. */
+var NO_KEY_GIVEN = `No key given. Get one at ${KEYS_URL} and pass it with --key, or pipe it in.`;
+/**
+* `swaggerbot login [--key K]`: the key from `--key`, else prompted for
+* (hidden on a terminal, read from a pipe otherwise), checked with
+* `GET /api/key` at no cost, then stored for this swagger.bot's origin and
+* no other's. A key that isn't live (401) is said so and stored nowhere;
+* a key store outage (503) is said with when to retry. The key is never
+* echoed. Exit 0 when signed in, 1 when the request failed, 2 without a
+* key to check.
+*/
+async function runLogin(_args, { http, configPath, note, globals, io, color, stderrColor }) {
+	const key = globals.key ?? await promptKey(io);
+	if (!key) {
+		io.stderr.write(`${palette(stderrColor).red(palette(stderrColor).bold("error"))}  ${NO_KEY_GIVEN}\n`);
+		return 2;
+	}
+	const result = await getJson({
+		...http,
+		key
+	}, "/api/key", { timeoutMs: TIMEOUT_MS });
+	if (!result.ok) return failed({
+		error: result.error.status === 401 ? {
+			...result.error,
+			error: "That key isn't live."
+		} : result.error,
+		text: result.text
+	}, globals, io, stderrColor);
+	storeKey(configPath, http.baseUrl, key, note);
+	if (globals.json) {
+		io.stdout.write(`${result.text}\n`);
+		return 0;
+	}
+	const p = palette(color);
+	const { id, remaining } = result.body;
+	const credits = remaining === void 0 ? "" : `: ${creditsWords(remaining)}`;
+	io.stdout.write(`${p.green(p.bold("Signed in"))} to ${http.baseUrl} as ${id}${credits}\n`);
+	return 0;
+}
+/**
+* The key typed at a terminal, hidden (readline writes its echo to a sink,
+* so nothing shows), or the first line piped in; empty when neither gives
+* one, or when the prompt is left with Ctrl-C or Ctrl-D.
+*/
+async function promptKey(io) {
+	const { stdin } = io;
+	if (!stdin) return "";
+	if (stdin.isTTY) {
+		const muted = new Writable({ write(_chunk, _encoding, callback) {
+			callback();
+		} });
+		const rl = createInterface({
+			input: stdin,
+			output: muted,
+			terminal: true
+		});
+		rl.on("SIGINT", () => rl.close());
+		io.stderr.write("API key (hidden): ");
+		try {
+			return (await new Promise((resolve) => {
+				rl.once("close", () => resolve(""));
+				rl.question("", (answer) => resolve(answer));
+			})).trim();
+		} finally {
+			rl.close();
+			io.stderr.write("\n");
+		}
+	}
+	const rl = createInterface({
+		input: stdin,
+		terminal: false
+	});
+	try {
+		for await (const line of rl) {
+			const key = line.trim();
+			if (key) return key;
+		}
+		return "";
+	} finally {
+		rl.close();
+	}
+}
+//#endregion
+//#region src/cli/commands/logout.ts
+/**
+* `swaggerbot logout`: removes the key `login` stored for this
+* swagger.bot's origin, and says when there was none; a config file that
+* isn't JSON is replaced by an empty one. Exit 0 either way. With `--json`,
+* `{ "url", "removed" }`.
+*/
+async function runLogout(_args, { http, configPath, note, globals, io, color }) {
+	const removed = removeKey(configPath, http.baseUrl, note);
+	if (globals.json) {
+		io.stdout.write(`${JSON.stringify({
+			url: http.baseUrl,
+			removed
+		})}\n`);
+		return 0;
+	}
+	const p = palette(color);
+	io.stdout.write(removed ? `${p.green(p.bold("Signed out"))} of ${http.baseUrl}: the stored key is forgotten\n` : `${p.dim("No key was stored")} for ${http.baseUrl}; nothing to forget\n`);
+	return 0;
+}
+//#endregion
+//#region src/cli/commands/navigate.ts
+/**
+* The apiId `target` names: an apiId as is; a name through a Lookup, as
+* `spec` makes one, Resolved only. Any other Outcome is printed as `lookup`
+* prints it, and its exit code is the answer, as is a failed Lookup's.
+*/
+async function apiIdOf(target, context) {
+	if (target.kind === "apiId") return target.apiId;
+	const { http, configPath, note, globals, io, stderrColor } = context;
+	const result = await requestLookup({ name: target.name }, http, {
+		retryWithStored: true,
+		stored: () => storedKeyOf(configPath, http.baseUrl, note)
+	});
+	if (!result.ok) return failed(result, globals, io, stderrColor);
+	if (result.body.outcome !== "Resolved") return printOutcome(result, context);
+	return result.body.api.id;
+}
+/**
+* `GET /api/apis/{apiId}/{resource}?{params}`, the apiId keeping its slash.
+* A failure is printed (`failed`: the server's body as is with `--json`)
+* and its exit code is the answer. 409 and 422 say the Spec's forms are
+* pending or failed, as the server answers them; `what` names what was asked
+* for, as in "The operation". `notFoundHint` gives a 404 the hint read from
+* its body, when the server's own hint isn't enough.
+*/
+async function getNavigation({ apiId, resource, params, what, notFoundHint }, { http, globals, io, stderrColor }) {
+	const query = new URLSearchParams();
+	for (const [name, value] of Object.entries(params)) if (value !== void 0) query.set(name, value);
+	const result = await getJson(http, `/api/apis/${apiId.split("/").map(encodeURIComponent).join("/")}/${resource}${query.size > 0 ? `?${query}` : ""}`, { timeoutMs: TIMEOUT_MS });
+	if (result.ok) return result;
+	const { status } = result.error;
+	if (status === 409) {
+		const retry = retryAfterSeconds(result.headers?.get("retry-after"), (io.now?.() ?? /* @__PURE__ */ new Date()).getTime());
+		return failed({
+			...result,
+			error: {
+				status,
+				error: `${what} can't be read yet: the Spec's forms are pending (still being built).`,
+				hint: `Retry in ${durationWords(retry ?? 0)}.`
+			}
+		}, globals, io, stderrColor);
+	}
+	if (status === 422) return failed({
+		...result,
+		error: {
+			status,
+			error: `The Spec's forms failed: ${result.error.error}`,
+			hint: "So it has no Spec Outline or Normalized Form to read; `swaggerbot spec` still downloads its Published Form."
+		}
+	}, globals, io, stderrColor);
+	if (status === 404 && notFoundHint) {
+		let body;
+		try {
+			body = JSON.parse(result.text ?? "");
+		} catch {}
+		const hint = notFoundHint(body);
+		if (hint) return failed({
+			...result,
+			error: {
+				...result.error,
+				hint
+			}
+		}, globals, io, stderrColor);
+	}
+	return failed(result, globals, io, stderrColor);
+}
+//#endregion
+//#region src/cli/commands/operation.ts
+/**
+* `swaggerbot operation <name | apiId> <method> <path>`:
+* `GET /api/apis/{apiId}/operation?method=&path=[&specId=]`, the operation
+* with every reference it reaches inlined, as `renderOperation` shows it. A
+* name is looked up first, as `spec` does. `--json` prints the server's
+* body unchanged. An operation not in the Spec is the server's 404 and its
+* hint (the outline lists the paths), exit 1, as for any failed request.
+*/
+async function runOperation(args, context) {
+	const { globals, io, color } = context;
+	const apiId = await apiIdOf(args.target, context);
+	if (typeof apiId === "number") return apiId;
+	const result = await getNavigation({
+		apiId,
+		resource: "operation",
+		params: {
+			method: args.method,
+			path: args.path,
+			specId: args.specId
+		},
+		what: "The operation"
+	}, context);
+	if (typeof result === "number") return result;
+	io.stdout.write(globals.json ? `${result.text}\n` : renderOperation(result.body, color));
+	return EXIT.ok;
+}
+/** Operations a page when `--all` follows every page and `--limit` isn't given: the most the route allows. */
+var ALL_PAGE_LIMIT$1 = 500;
+/**
+* `swaggerbot outline <name | apiId>`: `GET /api/apis/{apiId}/outline`, one
+* page of the Spec Outline (`--tag`, `--query`, `--spec-id`, `--limit`, the
+* hidden `--cursor`), as `renderOutline` shows it; `--all` follows every
+* page and lists every tag. A name is looked up first, as `spec` does.
+* `--json` prints the server's body unchanged, one line a page. Exit 1 for
+* a failed request, pending or failed forms included (`EXIT`).
+*/
+async function runOutline(args, context) {
+	const { globals, io, color, stderrColor } = context;
+	const apiId = await apiIdOf(args.target, context);
+	if (typeof apiId === "number") return apiId;
+	const limit = args.limit ?? (args.all ? ALL_PAGE_LIMIT$1 : 100);
+	const seen = /* @__PURE__ */ new Set();
+	let cursor = args.cursor;
+	let first;
+	const operations = [];
+	for (;;) {
+		const result = await getNavigation({
+			apiId,
+			resource: "outline",
+			params: {
+				tag: args.tag,
+				query: args.query,
+				specId: args.specId,
+				cursor,
+				limit: String(limit)
+			},
+			what: "The Spec Outline"
+		}, context);
+		if (typeof result === "number") return result;
+		if (globals.json) io.stdout.write(`${result.text}\n`);
+		const page = result.body;
+		first ??= page;
+		operations.push(...page.operations);
+		if (!args.all || page.nextCursor === null) {
+			if (!globals.json) io.stdout.write(renderOutline({
+				...first,
+				operations,
+				nextCursor: page.nextCursor
+			}, {
+				allTags: args.all,
+				color
+			}));
+			return EXIT.ok;
+		}
+		if (seen.has(page.nextCursor)) {
+			io.stderr.write(renderUsageError(`the service handed out cursor ${page.nextCursor} twice; stopped paging`, stderrColor));
+			return EXIT.failed;
+		}
+		seen.add(page.nextCursor);
+		cursor = page.nextCursor;
+	}
+}
+//#endregion
+//#region src/cli/commands/schema.ts
+/**
+* `swaggerbot schema <name | apiId> <schemaName>`:
+* `GET /api/apis/{apiId}/schema?name=[&specId=]`, one component schema
+* expanded, as `renderSchema` shows it. A name is looked up first, as `spec`
+* does. `--json` prints the server's body unchanged. A schema not in the
+* Spec is the server's 404 with its `nearest` names, exit 1.
+*/
+async function runSchema(args, context) {
+	const { globals, io, color } = context;
+	const apiId = await apiIdOf(args.target, context);
+	if (typeof apiId === "number") return apiId;
+	const result = await getNavigation({
+		apiId,
+		resource: "schema",
+		params: {
+			name: args.name,
+			specId: args.specId
+		},
+		what: "The schema",
+		notFoundHint: nearestHint
+	}, context);
+	if (typeof result === "number") return result;
+	io.stdout.write(globals.json ? `${result.text}\n` : renderSchema(result.body, color));
+	return EXIT.ok;
+}
+/** A 404's `nearest` schema names, as a hint; none when it gives none. */
+function nearestHint(body) {
+	const nearest = body?.nearest;
+	if (!Array.isArray(nearest)) return void 0;
+	const names = nearest.filter((n) => typeof n === "string");
+	return names.length > 0 ? `The nearest it has: ${names.join(", ")}.` : void 0;
+}
+/** The wait between tries when the server gives no `retry-after`. */
+var DEFAULT_RETRY_SECONDS = 10;
+/**
+* `swaggerbot spec <name | apiId | specId>`: downloads one form of a Spec.
+* A Spec id needs no Lookup; an apiId's Current Spec is read from its
+* outline; a name is looked up, and only a Resolved answer is downloaded:
+* its Current Spec, or with `--api-version` the Spec a Lookup for that API
+* Version resolves to (else a plain Lookup says which API Versions it has);
+* any other Outcome is printed as `lookup` prints it, with its exit code.
+* The bytes go to `-o FILE`, else to stdout on a pipe, else to the file
+* the server names in the current directory (`--force` to overwrite it).
+* A Normalized Form being built is waited for, `retry-after` at a time, up
+* to `BUILD_WAIT_SECONDS`; `--no-wait` fails at once. The Published Form's
+* sha256 must be its Spec id. Exit codes as `EXIT`.
+*/
+async function runSpec(args, context) {
+	const { globals, io, stderrColor } = context;
+	if (globals.json && args.output === void 0 && !io.isTTY) {
+		io.stderr.write(renderUsageError("--json can't share stdout with the Spec's bytes: give -o FILE", stderrColor));
+		return EXIT.usage;
+	}
+	const chosen = await choose(args, context);
+	if (typeof chosen === "number") return chosen;
+	return download(args, chosen, context);
+}
+/** The Spec the argument names, or the exit code when there is none to download. */
+async function choose(args, context) {
+	const { http, configPath, note, globals, io, stderrColor } = context;
+	const { target, form } = args;
+	switch (target.kind) {
+		case "specId": return {
+			specId: target.specId,
+			apiId: null,
+			url: `/api/specs/${target.specId}/${form}`
+		};
+		case "apiId": {
+			const path = `/api/apis/${target.apiId.split("/").map(encodeURIComponent).join("/")}/outline`;
+			const result = await whileBuilding(() => getJson(http, path, { timeoutMs: TIMEOUT_MS }), args, context);
+			if (typeof result === "number") return result;
+			if (!result.ok) return failed(result.error.status === 422 ? {
+				...result,
+				error: {
+					...result.error,
+					hint: `Its Spec Outline couldn't be built, so its Current Spec can't be found by apiId: name the API, or give its Spec id.`
+				}
+			} : result, globals, io, stderrColor);
+			return {
+				specId: result.body.specId,
+				apiId: result.body.apiId,
+				url: result.body.downloads[form]
+			};
+		}
+		case "name": {
+			const lookup = (body) => requestLookup(body, http, {
+				retryWithStored: true,
+				stored: () => storedKeyOf(configPath, http.baseUrl, note)
+			});
+			const { apiVersion } = args;
+			let needsKey = false;
+			if (apiVersion !== void 0) {
+				const versioned = await lookup({
+					name: target.name,
+					apiVersion
+				});
+				needsKey = !versioned.ok && versioned.error.status === 401;
+				if (!versioned.ok && !needsKey) return failed(versioned, globals, io, stderrColor);
+				const outcome = versioned.ok ? versioned.body : void 0;
+				if (outcome?.outcome === "Resolved" && outcome.currentSpec.apiVersion === apiVersion) return {
+					specId: outcome.currentSpec.id,
+					apiId: outcome.api.id,
+					url: outcome.currentSpec.downloads[form]
+				};
+			}
+			const result = await lookup({ name: target.name });
+			if (!result.ok) return failed(result, globals, io, stderrColor);
+			const outcome = result.body;
+			if (outcome.outcome !== "Resolved") return printOutcome(result, context);
+			if (apiVersion !== void 0) {
+				const versions = [outcome.currentSpec, ...outcome.alternateSpecs].map((s) => `${s.apiVersion ?? "none"}${s === outcome.currentSpec ? " (Current)" : ""}`);
+				return failed({ error: {
+					status: 404,
+					error: `${outcome.api.name} (${outcome.api.id}) has no Spec for API Version ${apiVersion}.`,
+					hint: `Its API Versions: ${versions.join(", ")}.${needsKey ? ` With an API key (swaggerbot login), Discovery can look for ${apiVersion}.` : ""}`
+				} }, globals, io, stderrColor);
+			}
+			return {
+				specId: outcome.currentSpec.id,
+				apiId: outcome.api.id,
+				url: outcome.currentSpec.downloads[form]
+			};
+		}
+	}
+}
+/**
+* Tries `attempt` until it answers other than 409 (a Normalized Form being
+* built), waiting the server's `retry-after` between tries and
+* `BUILD_WAIT_SECONDS` in all; `--no-wait` gives up at the first 409. Gives
+* the last answer, or the exit code when it gave up.
+*/
+async function whileBuilding(attempt, args, { globals, io, stderrColor }) {
+	const sleep = io.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const now = () => (io.now?.() ?? /* @__PURE__ */ new Date()).getTime();
+	let waited = 0;
+	for (;;) {
+		const result = await attempt();
+		if (result.ok || result.error.status !== 409) return result;
+		const retry = Math.max(1, retryAfterSeconds(result.headers?.get("retry-after"), now()) ?? DEFAULT_RETRY_SECONDS);
+		const giveUp = (error, hint) => failed({
+			error: {
+				status: 409,
+				error,
+				hint
+			},
+			text: result.text
+		}, globals, io, stderrColor);
+		if (args.noWait) return giveUp("The Normalized Form is being built.", `Retry in ${durationWords(retry)}, or leave out --no-wait to wait for it.`);
+		if (waited >= 120) return giveUp(`The Normalized Form is still being built after 120 s.`, args.form === "normalized" ? "Retry in a minute, or download the Published Form (leave out --form normalized)." : "Retry in a minute, or name the API instead of its apiId.");
+		if (waited === 0) io.stderr.write(`${palette(stderrColor).dim("Normalized Form being built…")}\n`);
+		const wait = Math.min(retry, 120 - waited);
+		await sleep(wait * 1e3);
+		waited += wait;
+	}
+}
+/** Downloads `chosen`'s form to where `args` and the terminal say, then says what was written. */
+async function download(args, chosen, context) {
+	const { http, globals, io, stderrColor } = context;
+	const refuse = (error, hint) => failed({ error: {
+		status: 0,
+		error,
+		...hint ? { hint } : {}
+	} }, globals, io, stderrColor);
+	const result = await whileBuilding(() => getDownload(http, chosen.url), args, context);
+	if (typeof result === "number") return result;
+	if (!result.ok) return failed(result, globals, io, stderrColor);
+	const { response, alive, done } = result;
+	let file;
+	if (args.output !== void 0) file = {
+		path: args.output,
+		shown: args.output
+	};
+	else if (io.isTTY) {
+		const name = fileNameOf(response.headers, chosen, args.form);
+		file = {
+			path: join(io.cwd ?? process.cwd(), name),
+			shown: name
+		};
+		if (!args.force && await exists(file.path)) {
+			done();
+			await response.body?.cancel().catch(() => {});
+			return refuse(`${name} exists already.`, "Pass --force to overwrite it, or -o another path.");
+		}
+	}
+	const part = file ? join(dirname(file.path), `.${basename(file.path)}.${randomBytes(4).toString("hex")}.part`) : void 0;
+	let handle;
+	const discard = async () => {
+		await handle?.close().catch(() => {});
+		if (part) await rm(part, { force: true });
+	};
+	if (file && part) try {
+		handle = await open(part, "wx");
+	} catch (err) {
+		done();
+		await response.body?.cancel().catch(() => {});
+		return refuse(`Can't write ${file.shown}: ${err.message}`);
+	}
+	const hash = createHash("sha256");
+	let bytes = 0;
+	try {
+		const reader = response.body?.getReader();
+		for (;;) {
+			const next = await reader?.read();
+			if (!next || next.done) break;
+			alive();
+			hash.update(next.value);
+			bytes += next.value.byteLength;
+			if (handle) await handle.write(next.value);
+			else await writeOut(io, next.value);
+		}
+	} catch (err) {
+		await discard();
+		if (typeof err.code === "string" && file) return refuse(`Can't write ${file.shown}: ${err.message}`);
+		return failed({ error: transportError(err, http.baseUrl, DOWNLOAD_TIMEOUT_MS) }, globals, io, stderrColor);
+	} finally {
+		done();
+	}
+	const sha256 = hash.digest("hex");
+	if (args.form === "published" && sha256 !== chosen.specId) {
+		await discard();
+		return refuse(`The bytes downloaded aren't Spec ${chosen.specId}: their sha256 is ${sha256}.`, file ? "Nothing was kept. Retry; if it happens again, something between you and the server changed them." : "Don't use what was written to stdout. Retry; if it happens again, something between you and the server changed them.");
+	}
+	if (handle && file && part) {
+		try {
+			await handle.close();
+			handle = void 0;
+			await rename(part, file.path);
+		} catch (err) {
+			await discard();
+			return refuse(`Can't write ${file.shown}: ${err.message}`);
+		}
+		io.stderr.write(`Wrote ${file.shown} (${sizeWords(bytes)})\n`);
+	}
+	if (globals.json) io.stdout.write(`${JSON.stringify({
+		specId: chosen.specId,
+		apiId: chosen.apiId,
+		form: args.form,
+		path: file ? file.shown : "stdout",
+		bytes,
+		sha256
+	})}\n`);
+	return EXIT.ok;
+}
+/**
+* The file name the server gives in `content-disposition`, as a plain name
+* in the current directory and nothing else; else one made like it:
+* `<api>-<first 12 of the Spec id>.json`, `.normalized.json` for that form.
+*/
+function fileNameOf(headers, chosen, form) {
+	const given = /filename\s*=\s*"?([^";]+)"?/i.exec(headers.get("content-disposition") ?? "")?.[1]?.trim();
+	const name = [...basename((given ?? "").replace(/\\/g, "/"))].filter((c) => c >= " " && c !== "").join("");
+	if (name && !name.startsWith(".")) return name;
+	const slug = chosen.apiId?.slice(chosen.apiId.indexOf("/") + 1);
+	const extension = form === "normalized" ? "normalized.json" : /yaml/i.test(headers.get("content-type") ?? "") ? "yaml" : "json";
+	return `${slug ? `${slug}-` : ""}${chosen.specId.slice(0, 12)}.${extension}`;
+}
+/** Whether anything is at `path`. */
+async function exists(path) {
+	try {
+		await stat(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** Writes `chunk` to stdout, waiting for it to drain when it says to. */
+async function writeOut(io, chunk) {
+	if (io.stdout.write(chunk) === false && io.stdout.once) await new Promise((resolve) => io.stdout.once?.("drain", resolve));
+}
+//#endregion
+//#region src/cli/commands/vendors.ts
+/** Vendors a page when `--all` follows every page: the most the route allows. */
+var ALL_PAGE_LIMIT = 200;
+/**
+* `swaggerbot vendors [<query>]`: `GET /api/vendors[?query=]`, one page of
+* the Vendors in the Index (the server's 50, or from the hidden `--cursor`),
+* as `renderVendors` shows it; `--all` follows every page. `--json` prints
+* the server's body unchanged, one line a page. Exit 1 for a failed request
+* (`EXIT`).
+*/
+async function runVendors(args, { http, globals, io, color, stderrColor }) {
+	const seen = /* @__PURE__ */ new Set();
+	let cursor = args.cursor;
+	let total = 0;
+	const vendors = [];
+	for (;;) {
+		const query = new URLSearchParams();
+		if (args.query !== void 0) query.set("query", args.query);
+		if (cursor !== void 0) query.set("cursor", cursor);
+		if (args.all) query.set("limit", String(ALL_PAGE_LIMIT));
+		const result = await getJson(http, `/api/vendors${query.size > 0 ? `?${query}` : ""}`, { timeoutMs: TIMEOUT_MS });
+		if (!result.ok) return failed(result, globals, io, stderrColor);
+		if (globals.json) io.stdout.write(`${result.text}\n`);
+		const page = result.body;
+		total = page.total;
+		vendors.push(...page.vendors);
+		if (!args.all || page.nextCursor === null) {
+			if (!globals.json) io.stdout.write(renderVendors({
+				vendors,
+				total,
+				nextCursor: page.nextCursor
+			}, {
+				query: args.query,
+				color
+			}));
+			return EXIT.ok;
+		}
+		if (seen.has(page.nextCursor)) {
+			io.stderr.write(renderUsageError(`the service handed out cursor ${page.nextCursor} twice; stopped paging`, stderrColor));
+			return EXIT.failed;
+		}
+		seen.add(page.nextCursor);
+		cursor = page.nextCursor;
+	}
+}
+/**
+* `swaggerbot vendor <vendor>`: `GET /api/vendors/{vendor}/apis`. A 200 lists
+* the Vendor's APIs (`renderVendorApis`), exit 0; a 300 lists the Vendors it
+* could mean, exit 3 as Ambiguous; a 404 says the Index holds no such Vendor
+* and how a Lookup adds one, exit 6 as Unknown. `--json` prints the server's
+* body unchanged, with the same exit codes. Exit 1 for any other failure.
+*/
+async function runVendor(args, { http, globals, io, color, stderrColor }) {
+	const result = await getJson(http, `/api/vendors/${encodeURIComponent(args.vendor)}/apis`, { timeoutMs: TIMEOUT_MS });
+	if (result.ok) {
+		io.stdout.write(globals.json ? `${result.text}\n` : renderVendorApis(result.body, {
+			baseUrl: http.baseUrl,
+			color
+		}));
+		return EXIT.ok;
+	}
+	const { status } = result.error;
+	if (status === 300) {
+		const body = parsed(result.text);
+		if (Array.isArray(body?.vendors) && body.vendors.length > 0) {
+			io.stdout.write(globals.json ? `${result.text}\n` : renderVendorMatches({ vendors: body.vendors }, {
+				vendor: args.vendor,
+				color
+			}));
+			return EXIT.Ambiguous;
+		}
+	}
+	if (status === 404 && parsed(result.text) !== void 0) {
+		io.stdout.write(globals.json ? `${result.text}\n` : renderUnknownVendor(args.vendor, color));
+		return EXIT.Unknown;
+	}
+	return failed(result, globals, io, stderrColor);
+}
+/** `text` as JSON; none when there is no text or it isn't JSON. */
+function parsed(text) {
+	try {
+		return text === void 0 ? void 0 : JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/cli/main.ts
+/** The CLI's version, from `cli/package.json`, bundled in. */
+var CLI_VERSION = package_default.version;
+/** The command table, one line per command; a command missing here is a type error. */
+var COMMANDS = {
+	lookup: runLookup,
+	login: runLogin,
+	logout: runLogout,
+	key: runKey,
+	spec: runSpec,
+	outline: runOutline,
+	operation: runOperation,
+	schema: runSchema,
+	vendors: runVendors,
+	vendor: runVendor
+};
+/**
+* Runs `swaggerbot` for `argv` (without node and the script) and answers
+* with the exit code (D4, `EXIT`): 0 for Resolved or success, 3 Ambiguous,
+* 4 Unconfirmed, 5 No Spec, 6 Unknown, 1 for a refusal or a failed request,
+* 2 for a usage error. Nothing is written but to `io`.
+*/
+async function runCli(argv, io) {
+	const parsed = parseCliArgs(argv);
+	const noColor = parsed.ok ? parsed.globals.noColor : argv.includes("--no-color");
+	const stderrColor = colorEnabled(io.stderrIsTTY, io.env, noColor);
+	if (!parsed.ok) {
+		io.stderr.write(renderUsageError(parsed.error, stderrColor));
+		return parsed.exitCode;
+	}
+	const { command, globals } = parsed;
+	const color = colorEnabled(io.isTTY, io.env, noColor);
+	switch (command.command) {
+		case "version":
+			io.stdout.write(`${CLI_VERSION}\n`);
+			return 0;
+		case "help":
+			io.stdout.write(`${CLI_USAGE}\n`);
+			return 0;
+		default: {
+			const baseUrl = baseUrlOf(globals.url, io.env);
+			const configPath = configPathOf(io.env);
+			const run = COMMANDS[command.command];
+			return run(command, {
+				http: {
+					baseUrl,
+					key: keyOf(globals.key, io.env),
+					version: CLI_VERSION
+				},
+				configPath,
+				note: (message) => io.stderr.write(renderWarning(message, stderrColor)),
+				globals,
+				io,
+				color,
+				stderrColor
+			});
+		}
+	}
+}
+/** `runCli` over the process: its arguments, streams and environment. */
+async function main() {
+	const io = {
+		stdout: process.stdout,
+		stderr: process.stderr,
+		stdin: process.stdin,
+		isTTY: process.stdout.isTTY === true,
+		stderrIsTTY: process.stderr.isTTY === true,
+		env: process.env
+	};
+	process.stdout.on("error", (err) => {
+		if (err.code !== "EPIPE") throw err;
+		process.exit(process.exitCode ?? 0);
+	});
+	try {
+		process.exitCode = await runCli(process.argv.slice(2), io);
+	} catch (err) {
+		io.stderr.write(`error  ${err instanceof Error ? err.message : String(err)}\n`);
+		process.exitCode = 1;
+	}
+}
+//#endregion
+//#region src/cli/bin.ts
+await main();
+//#endregion
+export {};