vercel 54.12.0 → 54.12.1

package/dist/chunks/{chunk-ZYNF76YT.js → chunk-ASVZLQHG.js}

@@ -8,22 +8,22 @@ import {
   getUpdateCommandInfo,
   isGlobal,
   isNativeBinaryInstall
-} from "./chunk-NLEBTR3S.js";
+} from "./chunk-OKWVPKJJ.js";
 import {
   getGlobalPathConfig,
   writeToConfigFile
-} from "./chunk-WNYUBBFH.js";
+} from "./chunk-25I7H5PE.js";
 import {
   apiCommand,
   listSubcommand2 as listSubcommand,
   loginCommand
-} from "./chunk-HVYPWTJQ.js";
+} from "./chunk-222H5MYY.js";
 import {
   help
 } from "./chunk-VNUNCNPE.js";
 import {
   login
-} from "./chunk-IDTFK3CR.js";
+} from "./chunk-QNCTSLLG.js";
 import {
   TelemetryClient
 } from "./chunk-J5273CSE.js";
@@ -575,15 +575,79 @@ import { readFile, writeFile, mkdir } from "fs/promises";
 
 // src/util/openapi/constants.ts
 var OPENAPI_URL = "https://openapi.vercel.sh/";
+var SSO_API_URL = "https://vercel.com/sso-api";
 var CACHE_FILE = "openapi-spec.json";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 10 * 1e3;
+var MAX_OPENAPI_SPEC_BYTES = 50 * 1024 * 1024;
+
+// src/util/openapi/read-spec-response.ts
+async function readSpecResponse(response, url, maxBytes = MAX_OPENAPI_SPEC_BYTES) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength) {
+    const bytes = Number(contentLength);
+    if (Number.isFinite(bytes) && bytes > maxBytes) {
+      throw new Error(
+        `OpenAPI spec from ${url} exceeds the ${maxBytes} byte limit.`
+      );
+    }
+  }
+  if (!response.body) {
+    throw new Error(`OpenAPI spec from ${url} returned an empty response.`);
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    if (!value) {
+      continue;
+    }
+    totalBytes += value.byteLength;
+    if (totalBytes > maxBytes) {
+      await reader.cancel();
+      throw new Error(
+        `OpenAPI spec from ${url} exceeds the ${maxBytes} byte limit.`
+      );
+    }
+    chunks.push(value);
+  }
+  const buffer = new Uint8Array(totalBytes);
+  let offset = 0;
+  for (const chunk of chunks) {
+    buffer.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder().decode(buffer));
+}
+
+// src/util/openapi/spec-url-allowlist.ts
+var ALLOWED_SPEC_HOSTS = ["vercel.sh", "vercel.tools"];
+function assertAllowedSpecUrl(specUrl) {
+  const parsedUrl = new URL(specUrl);
+  if (parsedUrl.protocol !== "https:") {
+    throw new Error("OpenAPI spec URL must use https");
+  }
+  if (!ALLOWED_SPEC_HOSTS.some((host) => isHostOrSubdomain(parsedUrl, host))) {
+    throw new Error("OpenAPI spec URL must be on an allowed origin.");
+  }
+  return parsedUrl;
+}
+function isHostOrSubdomain(url, host) {
+  return url.hostname === host || url.hostname.endsWith(`.${host}`);
+}
 
 // src/util/openapi/openapi-cache.ts
 var OpenApiCache = class {
-  constructor() {
+  constructor(options) {
     this.spec = null;
+    this.error = null;
     this.cachePath = join(getGlobalPathConfig(), CACHE_FILE);
+    this.specUrl = options?.specUrl;
+    this.fetchSpecUrl = options?.fetchSpecUrl;
   }
   /**
    * Check if the spec has been loaded
@@ -591,13 +655,23 @@ var OpenApiCache = class {
   get isLoaded() {
     return this.spec !== null;
   }
+  get loadError() {
+    return this.error;
+  }
   /**
    * Load the OpenAPI spec, using cache if available and fresh.
    * Returns true if successful, false otherwise.
    */
   async load(forceRefresh = false) {
+    return this.loadSpec(forceRefresh);
+  }
+  async loadSpec(forceRefresh = false) {
+    this.error = null;
+    if (this.specUrl) {
+      return this.loadCustomSpec(this.specUrl);
+    }
     if (!forceRefresh) {
-      const cached = await this.readCache();
+      const cached = await this.readCache(this.cachePath);
       if (cached && !this.isExpired(cached.fetchedAt)) {
         output_manager_default.debug("Using cached OpenAPI spec");
         this.spec = cached.spec;
@@ -606,12 +680,12 @@ var OpenApiCache = class {
     }
     try {
       output_manager_default.debug("Fetching OpenAPI spec from " + OPENAPI_URL);
-      this.spec = await this.fetchSpec();
-      await this.saveCache(this.spec);
+      this.spec = await this.fetchSpec(OPENAPI_URL);
+      await this.saveCache(this.cachePath, this.spec);
       return true;
     } catch (err) {
       output_manager_default.debug(`Failed to fetch OpenAPI spec: ${err}`);
-      const stale = await this.readCache();
+      const stale = await this.readCache(this.cachePath);
       if (stale) {
         output_manager_default.debug("Using stale cached OpenAPI spec");
         this.spec = stale.spec;
@@ -620,6 +694,25 @@ var OpenApiCache = class {
       return false;
     }
   }
+  async loadCustomSpec(specUrl) {
+    try {
+      assertAllowedSpecUrl(specUrl);
+      output_manager_default.debug("Fetching OpenAPI spec from " + specUrl);
+      const spec = this.fetchSpecUrl ? await this.fetchSpecUrl(specUrl) : await this.fetchSpec(specUrl);
+      if (!spec) {
+        this.error = `Could not load OpenAPI spec from ${specUrl}.`;
+        return false;
+      }
+      this.validateSpec(spec, specUrl);
+      this.spec = spec;
+      return Boolean(this.spec);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.error = message;
+      output_manager_default.debug(`Failed to fetch OpenAPI spec from ${specUrl}: ${message}`);
+      return false;
+    }
+  }
   /**
    * Load the OpenAPI spec with spinner UI.
    * Returns true if successful, false otherwise.
@@ -735,43 +828,69 @@ var OpenApiCache = class {
   /**
    * Read cached spec from disk
    */
-  async readCache() {
+  async readCache(cachePath) {
     try {
-      const content = await readFile(this.cachePath, "utf-8");
+      const content = await readFile(cachePath, "utf-8");
       return JSON.parse(content);
     } catch {
       return null;
     }
   }
   /**
-   * Save spec to disk cache
+   * Save public spec to disk cache
    */
-  async saveCache(spec) {
+  async saveCache(cachePath, spec) {
     const cached = {
       fetchedAt: Date.now(),
       spec
     };
-    const dir = join(this.cachePath, "..");
+    const dir = join(cachePath, "..");
     await mkdir(dir, { recursive: true });
-    await writeFile(this.cachePath, JSON.stringify(cached));
+    await writeFile(cachePath, JSON.stringify(cached));
     output_manager_default.debug("Saved OpenAPI spec to cache");
   }
   /**
    * Fetch OpenAPI spec from remote with timeout
    */
-  async fetchSpec() {
+  async fetchSpec(url) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
     try {
-      const response = await fetch(OPENAPI_URL, { signal: controller.signal });
+      const response = await fetch(url, { signal: controller.signal });
       if (!response.ok) {
         throw new Error(`Failed to fetch OpenAPI spec: ${response.status}`);
       }
-      return await response.json();
+      const spec = await readSpecResponse(response, url);
+      this.validateSpec(spec, url);
+      return spec;
     } finally {
       clearTimeout(timeoutId);
     }
   }
+  validateSpec(spec, url) {
+    if (!spec || typeof spec !== "object") {
+      throw new Error(
+        `Invalid OpenAPI spec from ${url}: expected a JSON object.`
+      );
+    }
+    if (typeof spec.openapi !== "string" || !spec.openapi.startsWith("3.")) {
+      throw new Error(
+        `Invalid OpenAPI spec from ${url}: expected an OpenAPI 3.x document with an "openapi" field.`
+      );
+    }
+    if (!spec.paths || typeof spec.paths !== "object") {
+      throw new Error(
+        `Invalid OpenAPI spec from ${url}: expected a "paths" object.`
+      );
+    }
+    for (const path of Object.keys(spec.paths)) {
+      if (!path.startsWith("/") || path.startsWith("//")) {
+        throw new Error(
+          `Invalid OpenAPI spec from ${url}: path "${path}" must be a relative API path.`
+        );
+      }
+    }
+  }
   /**
    * Check if cached spec is expired
    */
@@ -779,7 +898,7 @@ var OpenApiCache = class {
     return Date.now() - fetchedAt > CACHE_TTL_MS;
   }
   /**
-   * Sort endpoints by path, then by method
+   * Sort endpoints by path, then by method.
    */
   sortEndpoints(endpoints) {
     return endpoints.sort((a, b) => {
@@ -790,7 +909,7 @@ var OpenApiCache = class {
     });
   }
   /**
-   * Extract all available endpoints from the spec
+   * Extract all available endpoints from the loaded spec.
    */
   extractEndpoints() {
     const endpoints = [];
@@ -820,21 +939,21 @@ var OpenApiCache = class {
   /**
    * Resolve a $ref to its actual schema
    */
-  resolveSchemaRef(schema) {
+  resolveSchemaRef(schema, spec = this.spec) {
     if (!schema)
       return void 0;
     if (schema.$ref) {
       const match = schema.$ref.match(/^#\/components\/schemas\/(.+)$/);
-      if (match && this.spec.components?.schemas) {
-        const resolved = this.spec.components.schemas[match[1]];
-        return this.resolveSchemaRef(resolved);
+      if (match && spec.components?.schemas) {
+        const resolved = spec.components.schemas[match[1]];
+        return this.resolveSchemaRef(resolved, spec);
       }
       return void 0;
     }
     if (schema.allOf && schema.allOf.length > 0) {
       const merged = { type: "object", properties: {}, required: [] };
       for (const subSchema of schema.allOf) {
-        const resolved = this.resolveSchemaRef(subSchema);
+        const resolved = this.resolveSchemaRef(subSchema, spec);
         if (resolved) {
           if (resolved.properties) {
             merged.properties = {
@@ -955,6 +1074,14 @@ var ApiTelemetryClient = class extends TelemetryClient {
       });
     }
   }
+  trackCliOptionSpecUrl(specUrl) {
+    if (specUrl) {
+      this.trackCliOption({
+        option: "spec-url",
+        value: this.redactedValue
+      });
+    }
+  }
   trackCliFlagPaginate(value) {
     if (value) {
       this.trackCliFlag("paginate");
@@ -1385,6 +1512,133 @@ async function buildRequestForResolvedOperation(endpoint, bodyFields, flags, pos
   };
 }
 
+// src/util/openapi/spec-url.ts
+import { createHash } from "crypto";
+var MAX_REDIRECTS = 3;
+async function fetchSpecUrl(client, specUrl) {
+  const specOrigin = assertAllowedSpecUrl(specUrl).origin;
+  const probe = await fetchWithTimeout(specUrl, { readSpec: true });
+  if (probe.response.ok) {
+    return probe.spec ?? null;
+  }
+  const nonce = getSetCookieValue(probe.response, "_vercel_sso_nonce");
+  if (!nonce) {
+    output_manager_default.debug(
+      `OpenAPI spec URL returned ${probe.response.status} without a Vercel SSO nonce`
+    );
+    throw new Error(formatHttpError(specUrl, probe.response));
+  }
+  const token = client.authConfig.token;
+  if (!token) {
+    output_manager_default.debug("OpenAPI spec URL requires Vercel authentication");
+    return null;
+  }
+  const hashedNonce = createHash("sha256").update(nonce).digest("hex");
+  const ssoUrl = `${SSO_API_URL}?url=${encodeURIComponent(
+    specUrl
+  )}&nonce=${hashedNonce}`;
+  const sso = await fetchWithTimeout(ssoUrl, {
+    cookie: `authorization=${encodeURIComponent(`Bearer ${token}`)}; isLoggedIn=1`
+  });
+  const location = sso.response.headers.get("location");
+  if (!location || !location.includes("_vercel_jwt=")) {
+    output_manager_default.debug("OpenAPI spec URL: user has no access");
+    throw new Error(formatHttpError(specUrl, sso.response));
+  }
+  const cookies = /* @__PURE__ */ new Map([["_vercel_sso_nonce", nonce]]);
+  let url = location;
+  for (let i = 0; i <= MAX_REDIRECTS; i++) {
+    if (!isSameOriginUrl(url, specOrigin)) {
+      output_manager_default.debug("OpenAPI spec URL: cross-origin redirect rejected");
+      return null;
+    }
+    const { response, spec } = await fetchWithTimeout(url, {
+      cookie: Array.from(cookies, ([name, value]) => `${name}=${value}`).join(
+        "; "
+      ),
+      readSpec: true
+    });
+    if (response.ok) {
+      return spec ?? null;
+    }
+    const next = response.headers.get("location");
+    if (response.status >= 300 && response.status < 400 && next) {
+      const setJwt = getSetCookieValue(response, "_vercel_jwt");
+      if (setJwt) {
+        cookies.set("_vercel_jwt", setJwt);
+      }
+      const nextUrl = new URL(next, url).href;
+      if (!isSameOriginUrl(nextUrl, specOrigin)) {
+        output_manager_default.debug("OpenAPI spec URL: cross-origin redirect rejected");
+        return null;
+      }
+      url = nextUrl;
+      continue;
+    }
+    output_manager_default.debug(`OpenAPI spec URL: unexpected response ${response.status}`);
+    throw new Error(formatHttpError(url, response));
+  }
+  output_manager_default.debug("OpenAPI spec URL: too many redirects");
+  return null;
+}
+function createOpenApiCache(client, specUrl) {
+  return new OpenApiCache(
+    specUrl ? {
+      specUrl,
+      fetchSpecUrl: (url) => fetchSpecUrl(client, url)
+    } : void 0
+  );
+}
+async function fetchWithTimeout(url, options) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetch(url, {
+      redirect: "manual",
+      signal: controller.signal,
+      headers: options?.cookie ? { cookie: options.cookie } : void 0
+    });
+    const spec = options?.readSpec && response.ok ? await readSpecResponse(
+      response,
+      formatDiagnosticUrl(url)
+    ) : void 0;
+    return { response, spec };
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+function isSameOriginUrl(url, origin) {
+  try {
+    return new URL(url).origin === origin;
+  } catch {
+    return false;
+  }
+}
+function formatHttpError(url, response) {
+  const statusText = response.statusText ? ` ${response.statusText}` : "";
+  return `Could not load OpenAPI spec from ${formatDiagnosticUrl(url)}: HTTP ${response.status}${statusText}.`;
+}
+function formatDiagnosticUrl(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.hash = "";
+    for (const key of parsed.searchParams.keys()) {
+      parsed.searchParams.set(key, "[redacted]");
+    }
+    return parsed.href;
+  } catch {
+    return url;
+  }
+}
+function getSetCookieValue(response, name) {
+  const header = response.headers.get("set-cookie");
+  if (!header) {
+    return null;
+  }
+  const match = header.match(new RegExp(`${name}=([^;,\\s]+)`));
+  return match ? match[1] : null;
+}
+
 // src/util/openapi/vercel-cli-table.ts
 var import_ms = __toESM(require_ms(), 1);
 var import_chalk = __toESM(require_source(), 1);
@@ -1480,7 +1734,7 @@ async function tryOpenApiFallback(client, cliArgs, resolveTag) {
     client.dangerouslySkipPermissions = true;
   }
   if (flags["--help"]) {
-    return printOperationHelpForTagCommand(flags, tag, operationHint);
+    return printOperationHelpForTagCommand(client, flags, tag, operationHint);
   }
   return runTagOperation(client, {
     tag,
@@ -1654,9 +1908,12 @@ async function api(client) {
       telemetryClient.trackCliFlagRefresh(true);
     if (lsFlags["--format"])
       telemetryClient.trackCliOptionFormat(lsFlags["--format"]);
+    if (lsFlags["--spec-url"])
+      telemetryClient.trackCliOptionSpecUrl(lsFlags["--spec-url"]);
     return listEndpoints(
       client,
       lsFlags["--refresh"] ?? false,
+      lsFlags["--spec-url"],
       lsFlags["--format"] ?? "table"
     );
   }
@@ -1675,7 +1932,8 @@ async function api(client) {
     if (client.stdin.isTTY) {
       const selected = await promptEndpointSelection(
         client,
-        flags["--refresh"] ?? false
+        flags["--refresh"] ?? false,
+        flags["--spec-url"]
       );
       if (!selected) {
         return 1;
@@ -1740,6 +1998,8 @@ async function api(client) {
     telemetryClient.trackCliFlagRaw(true);
   if (flags["--refresh"])
     telemetryClient.trackCliFlagRefresh(true);
+  if (flags["--spec-url"])
+    telemetryClient.trackCliOptionSpecUrl(flags["--spec-url"]);
   if (flags["--generate"])
     telemetryClient.trackCliOptionGenerate(flags["--generate"]);
   if (flags["--dangerously-skip-permissions"])
@@ -1757,11 +2017,11 @@ async function api(client) {
   }
   return executeApiRequest(client, requestConfig, finalFlags);
 }
-async function printOperationHelpForTagCommand(flags, tag, operationId) {
-  const openApi = new OpenApiCache();
+async function printOperationHelpForTagCommand(client, flags, tag, operationId) {
+  const openApi = createOpenApiCache(client, flags["--spec-url"]);
   const loaded = await openApi.loadWithSpinner(flags["--refresh"] ?? false);
   if (!loaded) {
-    output_manager_default.error("Could not load API specification");
+    output_manager_default.error(openApi.loadError ?? "Could not load API specification");
     return 1;
   }
   const allEndpoints = openApi.getEndpoints();
@@ -2219,12 +2479,14 @@ function outputResults(client, data, flags) {
   client.stdout.write(formatted + "\n");
   return 0;
 }
-async function promptEndpointSelection(client, forceRefresh) {
+async function promptEndpointSelection(client, forceRefresh, specUrl) {
   try {
-    const openApi = new OpenApiCache();
+    const openApi = createOpenApiCache(client, specUrl);
     const success = await openApi.loadWithSpinner(forceRefresh);
     if (!success) {
-      output_manager_default.error("Could not load API specification for endpoint selection");
+      output_manager_default.error(
+        openApi.loadError ?? "Could not load API specification for endpoint selection"
+      );
       return null;
     }
     const endpoints = openApi.getEndpoints();
@@ -2249,7 +2511,8 @@ async function promptEndpointSelection(client, forceRefresh) {
   }
 }
 async function promptForEndpoint(client, endpoints) {
-  const allChoices = endpoints.map((ep) => ({
+  const total = endpoints.length;
+  const buildChoices = () => endpoints.map((ep) => ({
     name: `${colorizeMethodPadded(ep.method)} ${ep.path}`,
     value: ep,
     // Show full description if available, otherwise show summary
@@ -2258,10 +2521,10 @@ async function promptForEndpoint(client, endpoints) {
     summary: ep.summary,
     tags: ep.tags
   }));
-  const total = allChoices.length;
   return client.input.search({
     message: `Search for an API endpoint (${total} available):`,
     source: async (term) => {
+      const allChoices = buildChoices();
       if (!term) {
         return allChoices;
       }
@@ -2278,11 +2541,11 @@ async function promptForEndpoint(client, endpoints) {
     }
   });
 }
-async function listEndpoints(client, forceRefresh, format) {
-  const openApi = new OpenApiCache();
+async function listEndpoints(client, forceRefresh, specUrl, format) {
+  const openApi = createOpenApiCache(client, specUrl);
   const success = await openApi.loadWithSpinner(forceRefresh);
   if (!success) {
-    output_manager_default.error("Could not load API specification");
+    output_manager_default.error(openApi.loadError ?? "Could not load API specification");
     return 1;
   }
   const endpoints = openApi.getEndpoints();
@@ -2307,7 +2570,10 @@ function groupEndpointsByPath(endpoints) {
   const grouped = /* @__PURE__ */ new Map();
   for (const ep of endpoints) {
     const existing = grouped.get(ep.path) || [];
-    existing.push({ method: ep.method, summary: ep.summary });
+    existing.push({
+      method: ep.method,
+      summary: ep.summary
+    });
     grouped.set(ep.path, existing);
   }
   const methodOrder = ["GET", "POST", "PUT", "PATCH", "DELETE"];
@@ -2362,18 +2628,20 @@ async function promptForParameters(client, path, parameters, bodyFieldsSpec) {
   const optionalBodyFields = bodyFieldsSpec.filter((f) => !f.required);
   let finalPath = path;
   for (const param of pathParams) {
-    const value = await client.input.text({
-      message: `Enter value for ${formatPathParam(param.name)}${formatDescription(param.description)}:`,
-      validate: createRequiredValidator(param.name)
-    });
+    const value = await promptForParameterValue(
+      client,
+      param,
+      `Enter value for ${formatPathParam(param.name)}${formatDescription(param.description)}:`
+    );
     finalPath = finalPath.replace(`{${param.name}}`, encodeURIComponent(value));
   }
   const queryValues = {};
   for (const param of requiredQueryParams) {
-    queryValues[param.name] = await client.input.text({
-      message: `Enter value for ${import_chalk4.default.cyan(param.name)}${formatDescription(param.description)}:`,
-      validate: createRequiredValidator(param.name)
-    });
+    queryValues[param.name] = await promptForParameterValue(
+      client,
+      param,
+      `Enter value for ${import_chalk4.default.cyan(param.name)}${formatDescription(param.description)}:`
+    );
   }
   if (optionalQueryParams.length > 0) {
     const selectedOptionalParams = await client.input.checkbox({
@@ -2386,10 +2654,11 @@ async function promptForParameters(client, path, parameters, bodyFieldsSpec) {
     });
     for (const paramName of selectedOptionalParams) {
       const param = optionalQueryParams.find((p) => p.name === paramName);
-      queryValues[param.name] = await client.input.text({
-        message: `Enter value for ${import_chalk4.default.cyan(param.name)}${formatDescription(param.description)}:`,
-        validate: createRequiredValidator(param.name)
-      });
+      queryValues[param.name] = await promptForParameterValue(
+        client,
+        param,
+        `Enter value for ${import_chalk4.default.cyan(param.name)}${formatDescription(param.description)}:`
+      );
     }
   }
   const bodyFieldValues = [];
@@ -2418,6 +2687,22 @@ async function promptForParameters(client, path, parameters, bodyFieldsSpec) {
   }
   return { finalUrl: finalPath, bodyFields: bodyFieldValues };
 }
+async function promptForParameterValue(client, param, message) {
+  const schemaDefault = param.schema?.default !== void 0 ? String(param.schema.default) : void 0;
+  const enumValues = param.schema?.enum;
+  if (enumValues && enumValues.length > 0) {
+    return client.input.select({
+      message,
+      choices: enumValues.map((v) => ({ name: String(v), value: String(v) })),
+      default: schemaDefault
+    });
+  }
+  return client.input.text({
+    message,
+    default: schemaDefault,
+    validate: createRequiredValidator(param.name)
+  });
+}
 async function promptForBodyField(client, field, required) {
   const description = formatDescription(field.description);
   const optionalHint = required ? "" : import_chalk4.default.dim(" (optional)");
@@ -2458,12 +2743,12 @@ async function runTagOperation(client, options) {
     opts: { store: client.telemetryEventStore }
   });
   const finalFlags = { ...flags };
-  const openApi = new OpenApiCache();
+  const openApi = createOpenApiCache(client, finalFlags["--spec-url"]);
   const loaded = await openApi.loadWithSpinner(
     finalFlags["--refresh"] ?? false
   );
   if (!loaded) {
-    output_manager_default.error("Could not load API specification");
+    output_manager_default.error(openApi.loadError ?? "Could not load API specification");
     return 1;
   }
   const allEndpoints = openApi.getEndpoints();
@@ -2543,6 +2828,8 @@ async function runTagOperation(client, options) {
     telemetryClient.trackCliFlagRaw(true);
   if (finalFlags["--refresh"])
     telemetryClient.trackCliFlagRefresh(true);
+  if (finalFlags["--spec-url"])
+    telemetryClient.trackCliOptionSpecUrl(finalFlags["--spec-url"]);
   if (finalFlags["--generate"])
     telemetryClient.trackCliOptionGenerate(finalFlags["--generate"]);
   if (finalFlags["--dangerously-skip-permissions"])

package/dist/chunks/{chunk-NZDGG7W3.js → chunk-CLUKKIJ2.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-LJ5WXXG6.js";
 import {
   getLinkedProject
-} from "./chunk-IDTFK3CR.js";
+} from "./chunk-QNCTSLLG.js";
 import {
   buildCommandWithYes,
   outputAgentError

package/dist/chunks/{chunk-7IAMAKFC.js → chunk-DW6I2NB5.js}

@@ -6,7 +6,7 @@ const __filename = __fileURLToPath(import.meta.url);
 const __dirname = __dirname_(__filename);
 import {
   resolveAlertsScope
-} from "./chunk-HYFP6VVA.js";
+} from "./chunk-3PICWXS2.js";
 import {
   handleValidationError,
   outputError,

package/dist/chunks/{chunk-DITVV3KE.js → chunk-EACELZBS.js}

@@ -18,7 +18,7 @@ import {
   require_lib,
   require_minimatch,
   require_pluralize
-} from "./chunk-IDTFK3CR.js";
+} from "./chunk-QNCTSLLG.js";
 import {
   CantParseJSONFile,
   cmd,

package/dist/chunks/{chunk-2WND2XFN.js → chunk-FVDFTZNG.js}

@@ -6,7 +6,7 @@ const __filename = __fileURLToPath(import.meta.url);
 const __dirname = __dirname_(__filename);
 import {
   getEnvTargetPlaceholder
-} from "./chunk-IDTFK3CR.js";
+} from "./chunk-QNCTSLLG.js";
 import {
   projectOption,
   yesOption