@agents24/cli 0.1.1 → 0.2.0

package/dist/cli.js

@@ -1,30 +1,34 @@
 #!/usr/bin/env node
 import {
   assertImportAllowed,
-  assertInstallPreviewReady,
   createRemoteClient,
   initializePackage,
+  loadPackageFiles,
   packPackage,
   parseMappings,
   shouldPromptForDependency,
   validatePackage
-} from "./chunk-MNGBA3HP.js";
+} from "./chunk-NLUCQTMN.js";
 
 // src/cli.ts
 import { basename, join, resolve } from "path";
-import { chmod, readFile, writeFile } from "fs/promises";
+import { chmod, mkdir, readFile, stat, writeFile } from "fs/promises";
 import { createInterface } from "readline/promises";
-import { createHash } from "crypto";
+import { createHash, createHmac, randomBytes } from "crypto";
+import { spawn } from "child_process";
+import { hostname } from "os";
+import { parse as parseYaml } from "yaml";
 import { isCancel, password, select, text } from "@clack/prompts";
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["json", "remote", "yes", "allow-incomplete", "no-write-env"]);
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["json", "remote", "yes", "allow-incomplete", "no-write-env", "prune"]);
+var LIFECYCLE_COMMANDS = /* @__PURE__ */ new Set(["prepare", "plan", "apply", "dev", "publish", "setup", "status", "link", "resources"]);
 var DEFAULT_API_BASE_URL = "https://api.agents24.dev";
 var DEFAULT_LOCAL_CLIENT_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
 function parse(argv) {
-  const standaloneInstall = argv[0] === "install";
-  if (!standaloneInstall && (argv[0] !== "package" || !argv[1])) throw new Error("Usage: agents24 install <directory-or-zip> | agents24 package <init|validate|pack|export|compile|preview|import>");
+  const lifecycle = LIFECYCLE_COMMANDS.has(argv[0]);
+  if (!lifecycle && (argv[0] !== "package" || !argv[1])) throw new Error("Usage: agents24 <prepare|plan|apply|dev|publish|setup|status|link|resources> | agents24 package <init|validate|pack|export|compile|preview|import>");
   const flags = /* @__PURE__ */ new Map();
   const positionals = [];
-  for (let index = standaloneInstall ? 1 : 2; index < argv.length; index += 1) {
+  for (let index = lifecycle ? 1 : 2; index < argv.length; index += 1) {
     const current = argv[index];
     if (!current.startsWith("--")) {
       positionals.push(current);
@@ -39,7 +43,7 @@ function parse(argv) {
     if (value === void 0 || value.startsWith("--")) throw new Error(`--${rawName} requires a value`);
     flags.set(rawName, [...flags.get(rawName) || [], value]);
   }
-  return { command: standaloneInstall ? "install" : argv[1], positionals, flags };
+  return { command: lifecycle ? argv[0] : argv[1], positionals, flags };
 }
 function flag(parsed, name) {
   return parsed.flags.get(name)?.at(-1);
@@ -53,6 +57,128 @@ function mappings(parsed) {
 function upload(data, input) {
   return { data, filename: basename(input).endsWith(".zip") ? basename(input) : "resource.agents24.zip" };
 }
+async function packageDirectory(input) {
+  try {
+    return (await stat(input)).isDirectory() ? resolve(input) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function installationId(input) {
+  const explicit = String(process.env.AGENTS24_INSTALLATION_ID || "").trim();
+  if (explicit) return explicit;
+  const directory = await packageDirectory(input);
+  if (!directory) return void 0;
+  try {
+    return (await readFile(join(directory, ".agents24/installation-id"), "utf8")).trim() || void 0;
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function writeInstallationId(input, id) {
+  if (String(process.env.AGENTS24_INSTALLATION_ID || "").trim()) return void 0;
+  const directory = await packageDirectory(input);
+  if (!directory) return void 0;
+  const stateDirectory = join(directory, ".agents24");
+  await mkdir(stateDirectory, { recursive: true, mode: 448 });
+  const target = join(stateDirectory, "installation-id");
+  await writeFile(target, `${id}
+`, { mode: 384 });
+  await chmod(target, 384);
+  await ensureIgnored(directory, [".agents24/", ".env.local"]);
+  return target;
+}
+async function ensureIgnored(directory, entries) {
+  const target = join(directory, ".gitignore");
+  let current = "";
+  try {
+    current = await readFile(target, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const lines = new Set(current.split(/\r?\n/).map((item) => item.trim()).filter(Boolean));
+  const missing = entries.filter((item) => !lines.has(item));
+  if (!missing.length) return;
+  const separator = current && !current.endsWith("\n") ? "\n" : "";
+  await writeFile(target, `${current}${separator}${missing.join("\n")}
+`);
+}
+function parseEnv(textValue) {
+  const result = {};
+  for (const line of textValue.split(/\r?\n/)) {
+    const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line.trim());
+    if (!match) continue;
+    const raw = match[2].trim();
+    try {
+      result[match[1]] = raw.startsWith('"') ? JSON.parse(raw) : raw;
+    } catch {
+      result[match[1]] = raw;
+    }
+  }
+  return result;
+}
+async function packageSecretRequirements(input) {
+  const files = await loadPackageFiles(input);
+  const manifest = parseYaml(files.get("agents24.yaml") || "");
+  const requires = manifest.requires && typeof manifest.requires === "object" ? manifest.requires : {};
+  const secrets = requires.secrets && typeof requires.secrets === "object" ? requires.secrets : {};
+  return Object.entries(secrets).map(([key, raw]) => {
+    const item = raw && typeof raw === "object" ? raw : {};
+    const env = String(item.env || "").trim();
+    if (!env) throw new Error(`Secret requirement ${key} must declare env`);
+    return { key: `$secrets.${key}`, env, generate: item.generate === true };
+  });
+}
+async function preparePackage(input) {
+  const directory = await packageDirectory(input);
+  if (!directory) throw new Error("prepare requires a Resource Package directory");
+  const local = await validatePackage(input);
+  if (!local.valid) throw Object.assign(new Error("Resource package is invalid"), { diagnostics: local.diagnostics });
+  const target = join(directory, ".env.local");
+  let current = "";
+  try {
+    current = await readFile(target, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const values2 = parseEnv(current);
+  const generated = [];
+  const preserved = [];
+  let next = current;
+  for (const requirement of await packageSecretRequirements(input)) {
+    if (values2[requirement.env] || process.env[requirement.env]) {
+      preserved.push(requirement.env);
+      continue;
+    }
+    if (!requirement.generate) continue;
+    const value = randomBytes(32).toString("base64url");
+    next += `${next && !next.endsWith("\n") ? "\n" : ""}${requirement.env}=${JSON.stringify(value)}
+`;
+    generated.push(requirement.env);
+  }
+  await writeFile(target, next, { mode: 384 });
+  await chmod(target, 384);
+  await ensureIgnored(directory, [".env.local", ".agents24/"]);
+  return { ok: true, package: directory, env_file: target, generated, preserved };
+}
+async function secretValues(input) {
+  const directory = await packageDirectory(input);
+  let local = {};
+  if (directory) {
+    try {
+      local = parseEnv(await readFile(join(directory, ".env.local"), "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  const result = {};
+  for (const requirement of await packageSecretRequirements(input)) {
+    const value = String(process.env[requirement.env] || local[requirement.env] || "");
+    if (value) result[requirement.key] = value;
+  }
+  return result;
+}
 function safeResult(result) {
   return result;
 }
@@ -70,6 +196,26 @@ async function confirmation(parsed, preview) {
   prompt.close();
   if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Import cancelled");
 }
+async function applyConfirmation(parsed, plan) {
+  if (flag(parsed, "yes") === "true") return;
+  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("apply requires --yes in noninteractive mode");
+  const actions = Array.isArray(plan.actions) ? plan.actions.length : 0;
+  const removals = Array.isArray(plan.content) ? plan.content.reduce((count, item) => count + (Array.isArray(item.remove) ? item.remove.length : 0), 0) : 0;
+  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await prompt.question(`Apply ${actions} resource action(s)${removals ? ` and ${removals} content removal(s)` : ""}? [y/N] `);
+  prompt.close();
+  if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Apply cancelled");
+}
+async function pollOperation(client, operation) {
+  let current = operation;
+  for (let attempt = 0; attempt < 900; attempt += 1) {
+    const status = String(current.status || "");
+    if (["completed", "failed"].includes(status)) return current;
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 1e3));
+    current = await client.resourceInstallations.operationStatus(String(current.operation_id));
+  }
+  throw new Error("Resource apply did not finish within 15 minutes");
+}
 async function promptMappings(parsed, client, preview, current) {
   if (!process.stdin.isTTY || !process.stdout.isTTY || flag(parsed, "yes") === "true") return current;
   const dependencies = Array.isArray(preview.dependencies) ? preview.dependencies.filter((item) => Boolean(item && typeof item === "object" && item.status === "unresolved")) : [];
@@ -119,11 +265,8 @@ function canonical(value) {
   if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
   return JSON.stringify(value);
 }
-function installKey(bundle, map) {
-  return `install-${createHash("sha256").update(canonical({ bundle, mappings: map })).digest("hex").slice(0, 40)}`;
-}
-function importedRows(imported) {
-  return Array.isArray(imported.resources) ? imported.resources.filter((item) => Boolean(item && typeof item === "object")) : [];
+function importKey(bundle, map) {
+  return `import-${createHash("sha256").update(canonical({ bundle, mappings: map })).digest("hex").slice(0, 40)}`;
 }
 function interactive(parsed) {
   return flag(parsed, "yes") !== "true" && Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -131,14 +274,14 @@ function interactive(parsed) {
 function cancelled(value) {
   if (isCancel(value)) throw new Error("Installation cancelled");
 }
-async function apiKeyForInstall(parsed) {
+async function apiKeyForLifecycle(parsed) {
   let apiKey = String(process.env.AGENTS24_API_KEY || "").trim();
   if (!apiKey && interactive(parsed)) {
     const answer = await password({ message: "Agents24 API key", validate: (value) => String(value || "").trim() ? void 0 : "The API key is required." });
     cancelled(answer);
     apiKey = String(answer).trim();
   }
-  if (!apiKey) throw new Error("AGENTS24_API_KEY is required for noninteractive installation");
+  if (!apiKey) throw new Error("AGENTS24_API_KEY is required for noninteractive resource management");
   if (/[\r\n\0]/.test(apiKey)) throw new Error("AGENTS24_API_KEY contains invalid control characters");
   return apiKey;
 }
@@ -191,21 +334,6 @@ async function resolveInstallMode(parsed, app) {
   cancelled(answer);
   return answer;
 }
-async function selectInstalledAgent(parsed, imported) {
-  const agents = importedRows(imported).filter((row) => row.kind === "agent");
-  if (!agents.length) throw new Error("The installed package does not contain an Agent");
-  const requested = flag(parsed, "agent");
-  if (requested) {
-    const match = agents.find((row) => [row.id, row.resource_key, row.name].map(String).includes(requested));
-    if (!match) throw new Error(`--agent did not match an imported Agent: ${requested}`);
-    return match;
-  }
-  if (agents.length === 1) return agents[0];
-  if (!interactive(parsed)) throw new Error("--agent is required when the package contains multiple Agents");
-  const answer = await select({ message: "Which Agent should be published?", options: agents.map((row) => ({ value: String(row.id), label: String(row.name) })) });
-  cancelled(answer);
-  return agents.find((row) => String(row.id) === answer);
-}
 async function clientDeployment(parsed, client, agent, app) {
   const policies = (await client.resourcePolicies.list()).filter((row) => row.is_active === true);
   let policyId = flag(parsed, "policy-set");
@@ -258,7 +386,362 @@ async function updateEnvFile(app, values2) {
   await chmod(target, 384);
   return target;
 }
+async function ensureInstallation(input, client, data) {
+  const current = await installationId(input);
+  if (current) return current;
+  const initial = await client.resourceInstallations.plan(upload(data, input));
+  const created = await client.resourceInstallations.create(
+    { package_name: String(initial.package_name), operation_id: String(initial.operation_id) },
+    { idempotencyKey: `installation-${String(initial.package_hash).slice(0, 40)}` }
+  );
+  const id = String(created.id);
+  await writeInstallationId(input, id);
+  return id;
+}
+async function applyDraft(parsed, options = {}) {
+  const input = parsed.positionals[0];
+  if (!input) throw new Error(`${parsed.command} requires a Resource Package directory or ZIP`);
+  const apiKey = await apiKeyForLifecycle(parsed);
+  const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+  const data = await packPackage(input);
+  const currentId = await installationId(input);
+  const plan = await client.resourceInstallations.plan({
+    ...upload(data, input),
+    ...currentId ? { installationId: currentId } : {},
+    prune: flag(parsed, "prune") === "true",
+    development: options.development === true
+  });
+  if (plan.can_apply !== true) throw Object.assign(new Error("The Resource Package plan is blocked"), { plan });
+  if (!options.skipConfirmation) await applyConfirmation(parsed, plan);
+  const secrets = await secretValues(input);
+  let operation = await client.resourceInstallations.apply(String(plan.operation_id), {
+    primary_resource_key: flag(parsed, "agent"),
+    integration_mode: options.integrationMode || flag(parsed, "integration") || "publish-only",
+    secrets,
+    ...options.developmentSessions ? { development_sessions: options.developmentSessions } : {}
+  }, { idempotencyKey: `apply-${String(plan.package_hash).slice(0, 40)}` });
+  operation = await pollOperation(client, operation);
+  if (operation.status !== "completed") throw Object.assign(new Error("Draft apply failed"), { operation });
+  const installationIdValue = String(operation.installation_id || "");
+  if (!installationIdValue) throw new Error("Apply completed without an installation ID");
+  await writeInstallationId(input, installationIdValue);
+  const result = operation.result && typeof operation.result === "object" ? operation.result : {};
+  const agentId = String(result.primary_agent_id || "");
+  const resources = Array.isArray(result.resources) ? result.resources : [];
+  const agent = resources.find((item) => String(item.id) === agentId) || { id: agentId, name: "Agent" };
+  return { client, apiKey, input, installationId: installationIdValue, plan, operation, result, agent };
+}
+async function publishDraft(parsed, applied) {
+  const input = applied?.input || parsed.positionals[0];
+  if (!input) throw new Error("publish requires a Resource Package directory or ZIP");
+  const apiKey = applied?.apiKey || await apiKeyForLifecycle(parsed);
+  const client = applied?.client || await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+  const id = applied?.installationId || await installationId(input);
+  if (!id) throw new Error("No installation is linked; run agents24 apply first");
+  const data = await packPackage(input);
+  const plan = applied?.plan || await client.resourceInstallations.plan({ ...upload(data, input), installationId: id });
+  const publication = await client.resourceInstallations.publish(id, { package_hash: String(plan.package_hash) }, {
+    idempotencyKey: `publish-${String(plan.package_hash).slice(0, 40)}`
+  });
+  return { publication, client, apiKey, input, installation_id: id, plan };
+}
+async function developmentArtifacts(input) {
+  const directory = await packageDirectory(input);
+  if (!directory) throw new Error("dev requires a Resource Package directory");
+  const files = await loadPackageFiles(input);
+  const manifest = parseYaml(files.get("agents24.yaml") || "");
+  const resources = Array.isArray(manifest.resources) ? manifest.resources : [];
+  const requires = manifest.requires && typeof manifest.requires === "object" ? manifest.requires : {};
+  const requiredSecrets = requires.secrets && typeof requires.secrets === "object" ? requires.secrets : {};
+  const result = [];
+  for (const resource of resources) {
+    const path = String(resource.path || "");
+    const sourceText = files.get(path);
+    if (!sourceText) continue;
+    const source = parseYaml(sourceText);
+    if (source.execution_target !== "self_hosted") continue;
+    const development = source.development && typeof source.development === "object" ? source.development : void 0;
+    if (!development) continue;
+    const server = source.server && typeof source.server === "object" ? source.server : {};
+    const auth = server.auth && typeof server.auth === "object" ? server.auth : {};
+    const secretRequirement = String(auth.secret || "");
+    const secretKey = secretRequirement.startsWith("$secrets.") ? secretRequirement.slice("$secrets.".length) : "";
+    const secretDeclaration = secretKey && requiredSecrets[secretKey] && typeof requiredSecrets[secretKey] === "object" ? requiredSecrets[secretKey] : void 0;
+    const cwd = resolve(directory, String(development.cwd || "."));
+    if (cwd !== directory && !cwd.startsWith(`${directory}/`)) throw new Error(`Artifact ${resource.key} development.cwd must remain inside the package`);
+    result.push({
+      key: String(resource.key || ""),
+      baseUrl: String(development.base_url || ""),
+      command: development.command ? String(development.command) : void 0,
+      args: Array.isArray(development.args) ? development.args.map(String) : [],
+      cwd,
+      protocol: {
+        manifest_path: server.manifest_path,
+        health_path: server.health_path,
+        verify_path: server.verify_path,
+        invoke_path: server.invoke_path,
+        auth_mode: auth.mode,
+        signing_secret_requirement: auth.secret
+      },
+      signingSecretEnv: secretDeclaration?.env ? String(secretDeclaration.env) : void 0
+    });
+  }
+  return result;
+}
+async function waitForServer(baseUrl, healthPath) {
+  const target = new URL(String(healthPath || "/.well-known/agents24/artifact/health"), baseUrl);
+  for (let attempt = 0; attempt < 60; attempt += 1) {
+    try {
+      const response = await fetch(target);
+      if (response.ok) return;
+    } catch {
+    }
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 250));
+  }
+  throw new Error(`Local Artifact server did not become healthy at ${target}`);
+}
+async function openDevelopmentRelay(client, installationIdValue, artifact, localEnv) {
+  const admission = await client.resourceInstallations.prepareDevelopmentSession(installationIdValue, {
+    resource_key: artifact.key,
+    machine_label: hostname()
+  });
+  const apiUrl = new URL(String(process.env.AGENTS24_BASE_URL || DEFAULT_API_BASE_URL));
+  apiUrl.protocol = apiUrl.protocol === "https:" ? "wss:" : "ws:";
+  apiUrl.pathname = String(admission.relay_path);
+  const socket = new WebSocket(apiUrl, [
+    "agents24-artifact-relay",
+    `agents24-credential-${String(admission.relay_token)}`
+  ]);
+  const state = {};
+  await new Promise((resolveReady, rejectReady) => {
+    socket.addEventListener("error", () => rejectReady(new Error(`Artifact relay failed for ${artifact.key}`)), { once: true });
+    socket.addEventListener("message", async (event) => {
+      const message = JSON.parse(String(event.data));
+      if (message.type === "ready") {
+        resolveReady();
+        return;
+      }
+      if (message.type === "superseded" || message.type === "revoked") {
+        state.terminalReason = String(message.type);
+        socket.close();
+        return;
+      }
+      if (message.type !== "request") return;
+      const method = message.operation === "health" || message.operation === "manifest" ? "GET" : "POST";
+      try {
+        const requestBody = method === "POST" ? JSON.stringify(message.body || {}) : void 0;
+        const headers = method === "POST" ? { "content-type": "application/json" } : {};
+        if (method === "POST" && String(artifact.protocol.auth_mode || "hmac_sha256") === "hmac_sha256") {
+          const signingSecret = String(
+            artifact.signingSecretEnv && (localEnv[artifact.signingSecretEnv] || process.env[artifact.signingSecretEnv]) || ""
+          );
+          if (!signingSecret) throw new Error(`Artifact ${artifact.key} signing secret is unavailable`);
+          const timestamp = String(Date.now());
+          const signature = createHmac("sha256", signingSecret).update(`${timestamp}.${requestBody}`).digest("hex");
+          headers["x-agents24-timestamp"] = timestamp;
+          headers["x-agents24-signature"] = `sha256=${signature}`;
+        }
+        const response = await fetch(new URL(String(message.path || "/"), artifact.baseUrl), {
+          method,
+          headers,
+          body: requestBody
+        });
+        const textBody = await response.text();
+        let body = textBody;
+        try {
+          body = textBody ? JSON.parse(textBody) : null;
+        } catch {
+        }
+        socket.send(JSON.stringify({ type: "response", request_id: message.request_id, status: response.status, body }));
+      } catch {
+        socket.send(JSON.stringify({ type: "response", request_id: message.request_id, status: 502, body: { status: "failed" } }));
+      }
+    });
+    const heartbeat = setInterval(() => {
+      if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify({ type: "heartbeat" }));
+    }, 15e3);
+    socket.addEventListener("close", () => clearInterval(heartbeat), { once: true });
+  });
+  return { sessionId: String(admission.id), socket, state };
+}
 async function execute(parsed) {
+  if (parsed.command === "prepare") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("prepare requires a Resource Package directory");
+    return preparePackage(input);
+  }
+  if (parsed.command === "plan") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("plan requires a Resource Package directory or ZIP");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    const data = await packPackage(input);
+    const currentId = await installationId(input);
+    const plan = await client.resourceInstallations.plan({
+      ...upload(data, input),
+      ...currentId ? { installationId: currentId } : {},
+      prune: flag(parsed, "prune") === "true"
+    });
+    return { ok: plan.can_apply === true, plan };
+  }
+  if (parsed.command === "status") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("status requires a Resource Package directory or ZIP");
+    const id = await installationId(input);
+    if (!id) throw new Error("No installation is linked; run agents24 apply/link first or set AGENTS24_INSTALLATION_ID");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const status = await (await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey })).resourceInstallations.get(id);
+    return { ok: true, installation: status };
+  }
+  if (parsed.command === "resources") {
+    if (parsed.positionals[0] !== "list") throw new Error("Usage: agents24 resources list --kind <kind>");
+    const kind = flag(parsed, "kind");
+    if (!kind) throw new Error("resources list requires --kind");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const result = await (await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey })).resourceInstallations.resources({
+      kind,
+      query: flag(parsed, "query"),
+      limit: Number(flag(parsed, "limit") || 100)
+    });
+    return { ok: true, ...result };
+  }
+  if (parsed.command === "link") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("link requires a Resource Package directory or ZIP");
+    const assignments = values(parsed, "resource");
+    if (!assignments.length) throw new Error("link requires --resource <stable-key>=<uuid>");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    let id = await installationId(input);
+    if (!id) {
+      const data = await packPackage(input);
+      const initialPlan = await client.resourceInstallations.plan(upload(data, input));
+      const created = await client.resourceInstallations.create(
+        { package_name: String(initialPlan.package_name), operation_id: String(initialPlan.operation_id) },
+        { idempotencyKey: `installation-${String(initialPlan.package_hash).slice(0, 40)}` }
+      );
+      id = String(created.id);
+      await writeInstallationId(input, id);
+      await client.resourceInstallations.plan({ ...upload(data, input), installationId: id });
+    }
+    const linked = [];
+    for (const assignment of assignments) {
+      const separator = assignment.indexOf("=");
+      if (separator <= 0 || separator === assignment.length - 1) throw new Error("--resource must be <stable-key>=<uuid>");
+      const resourceKey = assignment.slice(0, separator);
+      const resourceId = assignment.slice(separator + 1);
+      linked.push(await client.resourceInstallations.link(id, { resource_key: resourceKey, resource_id: resourceId }, {
+        idempotencyKey: `link-${createHash("sha256").update(`${id}:${assignment}`).digest("hex").slice(0, 40)}`
+      }));
+    }
+    return { ok: true, installation_id: id, linked };
+  }
+  if (parsed.command === "apply") {
+    const applied = await applyDraft(parsed);
+    return { ok: true, phase: "draft_applied", installation_id: applied.installationId, agent_id: applied.agent.id, plan: applied.plan, operation: applied.operation };
+  }
+  if (parsed.command === "publish") {
+    const published = await publishDraft(parsed);
+    return { ok: true, phase: "published", ...published };
+  }
+  if (parsed.command === "setup") {
+    const app = await resolveApp(parsed);
+    const integration = await resolveInstallMode(parsed, app);
+    const applied = await applyDraft(parsed, { integrationMode: integration });
+    const published = await publishDraft(parsed, applied);
+    const installed = await applied.client.resourceInstallations.get(applied.installationId);
+    let deployment;
+    let deploymentId;
+    if (integration === "client-deployment") {
+      deployment = installed.client_deployment_id ? await applied.client.clientDeployments.get(String(installed.client_deployment_id)) : await clientDeployment(parsed, applied.client, applied.agent, app);
+      if (!installed.client_deployment_id) {
+        await applied.client.resourceInstallations.bindDeployment(applied.installationId, { client_deployment_id: String(deployment.id) }, { idempotencyKey: `deployment-bind-${applied.installationId}` });
+      }
+      deploymentId = String(deployment.client_id || "");
+    }
+    let envFile;
+    if (app && flag(parsed, "no-write-env") !== "true" && integration !== "publish-only") {
+      const localClientBaseUrl = integration === "client-deployment" ? clientAppBaseUrl() : void 0;
+      envFile = await updateEnvFile(app, integration === "client-deployment" ? { VITE_AGENTS24_DEPLOYMENT_ID: String(deploymentId), ...localClientBaseUrl ? { VITE_AGENTS24_BASE_URL: localClientBaseUrl } : {} } : { AGENTS24_API_KEY: applied.apiKey, AGENTS24_AGENT_ID: String(applied.agent.id) });
+    }
+    return { ok: true, phase: deployment ? "deployed" : "published", integration, installation_id: applied.installationId, agent_id: applied.agent.id, publication: published.publication, ...deployment ? { deployment, deployment_id: deploymentId } : {}, ...envFile ? { env_file: envFile } : {} };
+  }
+  if (parsed.command === "dev") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("dev requires a Resource Package directory");
+    await preparePackage(input);
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    const data = await packPackage(input);
+    const id = await ensureInstallation(input, client, data);
+    const configuredSecrets = await secretValues(input);
+    if (Object.keys(configuredSecrets).length) await client.resourceInstallations.configureSecrets(id, { secrets: configuredSecrets });
+    const declared = await developmentArtifacts(input);
+    const selectedKey = flag(parsed, "artifact");
+    const artifacts = selectedKey ? declared.filter((item) => item.key === selectedKey) : declared;
+    if (!artifacts.length) throw new Error(selectedKey ? `Artifact ${selectedKey} has no development configuration` : "No self-hosted Artifact development configuration was found");
+    const directory = await packageDirectory(input);
+    const localEnv = directory ? parseEnv(await readFile(join(directory, ".env.local"), "utf8")) : {};
+    const children = [];
+    const relays = [];
+    try {
+      for (const artifact of artifacts) {
+        if (artifact.command) children.push(spawn(artifact.command, artifact.args, { cwd: artifact.cwd, env: { ...process.env, ...localEnv }, stdio: "inherit", shell: false }));
+        await waitForServer(artifact.baseUrl, artifact.protocol.health_path);
+        relays.push(await openDevelopmentRelay(client, id, artifact, localEnv));
+      }
+      const developmentSessions = Object.fromEntries(artifacts.map((item, index) => [item.key, relays[index].sessionId]));
+      for (const artifact of declared) {
+        if (developmentSessions[artifact.key]) continue;
+        const status = await client.resourceInstallations.developmentSessionStatus(id, artifact.key);
+        if (status.status !== "connected" || !status.id) throw new Error(`Artifact ${artifact.key} requires an active development connection`);
+        developmentSessions[artifact.key] = String(status.id);
+      }
+      const applied = await applyDraft(parsed, { development: true, developmentSessions, skipConfirmation: true });
+      process.stdout.write(`${JSON.stringify({ ok: true, phase: "development_connected", installation_id: applied.installationId, development_sessions: developmentSessions }, null, 2)}
+`);
+      await new Promise((resolveStop) => {
+        let stopping = false;
+        const reconnecting = /* @__PURE__ */ new Set();
+        const stop = () => {
+          stopping = true;
+          resolveStop();
+        };
+        const watch = (relay, index) => {
+          relay.socket.addEventListener("close", async () => {
+            if (stopping) return;
+            if (relay.state.terminalReason || reconnecting.has(index)) {
+              stop();
+              return;
+            }
+            reconnecting.add(index);
+            for (let attempt = 1; attempt <= 3 && !stopping; attempt += 1) {
+              await new Promise((resolveDelay) => setTimeout(resolveDelay, attempt * 500));
+              try {
+                const replacement = await openDevelopmentRelay(client, id, artifacts[index], localEnv);
+                relays[index] = replacement;
+                developmentSessions[artifacts[index].key] = replacement.sessionId;
+                await applyDraft(parsed, { development: true, developmentSessions, skipConfirmation: true });
+                reconnecting.delete(index);
+                watch(replacement, index);
+                return;
+              } catch {
+              }
+            }
+            reconnecting.delete(index);
+            stop();
+          }, { once: true });
+        };
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+        relays.forEach(watch);
+      });
+      return { ok: true, phase: "development_stopped", installation_id: id };
+    } finally {
+      for (const relay of relays) relay.socket.close();
+      for (const child of children) child.kill("SIGTERM");
+    }
+  }
   if (parsed.command === "init") {
     const directory = resolve(parsed.positionals[0] || ".");
     const name = flag(parsed, "name") || basename(directory);
@@ -308,11 +791,8 @@ async function execute(parsed) {
 `);
     return { ok: result.valid === true, ...output ? { output: resolve(output) } : {}, result: safeResult(result) };
   }
-  if (parsed.command === "preview" || parsed.command === "import" || parsed.command === "install") {
-    const app = parsed.command === "install" ? await resolveApp(parsed) : void 0;
-    const integration = parsed.command === "install" ? await resolveInstallMode(parsed, app) : void 0;
-    const apiKey = parsed.command === "install" ? await apiKeyForInstall(parsed) : void 0;
-    const client = apiKey ? await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey }) : await createRemoteClient();
+  if (parsed.command === "preview" || parsed.command === "import") {
+    const client = await createRemoteClient();
     const { result } = await compiledPackage(parsed, client);
     if (result.valid !== true || !result.bundle || typeof result.bundle !== "object") throw new Error("Remote compilation did not produce a bundle");
     const request = {
@@ -323,64 +803,10 @@ async function execute(parsed) {
     request.mappings = await promptMappings(parsed, client, preview, request.mappings);
     if (Object.keys(request.mappings).length) preview = await client.resourceBundles.importPreview(request);
     if (parsed.command === "preview") return { ok: preview.can_import === true, preview };
-    if (parsed.command === "install") assertInstallPreviewReady(preview);
     if (preview.can_import !== true) return { ok: false, preview };
     await confirmation(parsed, preview);
-    const imported = await client.resourceBundles.importBundle(request, { idempotencyKey: installKey(request.bundle, request.mappings) });
-    if (parsed.command === "import") return { ok: true, phase: "imported", preview, result: imported };
-    const agent = await selectInstalledAgent(parsed, imported);
-    if (importedRows(imported).some((row) => row.status === "incomplete") && flag(parsed, "allow-incomplete") !== "true") {
-      throw Object.assign(new Error("Publication is blocked by incomplete imported dependencies"), { phase: "post_import", imported });
-    }
-    try {
-      await client.agents.publish(String(agent.id), {
-        idempotencyKey: `publish-${createHash("sha256").update(`agent:${String(agent.id)}`).digest("hex").slice(0, 40)}`
-      });
-    } catch (error) {
-      throw Object.assign(error instanceof Error ? error : new Error("Agent publication failed"), {
-        phase: "publish",
-        imported
-      });
-    }
-    let deployment;
-    try {
-      if (integration === "client-deployment") deployment = await clientDeployment(parsed, client, agent, app);
-    } catch (error) {
-      throw Object.assign(error instanceof Error ? error : new Error("Client deployment setup failed"), {
-        phase: "deployment",
-        imported
-      });
-    }
-    const deploymentId = deployment && typeof deployment.client_id === "string" ? deployment.client_id : void 0;
-    let envFile;
-    if (app && flag(parsed, "no-write-env") !== "true" && integration !== "publish-only") {
-      try {
-        const localClientBaseUrl = integration === "client-deployment" ? clientAppBaseUrl() : void 0;
-        envFile = await updateEnvFile(app, integration === "client-deployment" ? {
-          VITE_AGENTS24_DEPLOYMENT_ID: String(deploymentId),
-          ...localClientBaseUrl ? { VITE_AGENTS24_BASE_URL: localClientBaseUrl } : {}
-        } : { AGENTS24_API_KEY: apiKey, AGENTS24_AGENT_ID: String(agent.id) });
-      } catch (error) {
-        throw Object.assign(error instanceof Error ? error : new Error("Could not configure the generated app"), {
-          phase: "env_write",
-          imported
-        });
-      }
-    }
-    const packageManager = app?.packageManager || "pnpm";
-    const nextCommand = app && integration !== "publish-only" ? packageManager === "npm" ? "npm run dev" : packageManager === "bun" ? "bun run dev" : `${packageManager} dev` : void 0;
-    return {
-      ok: true,
-      phase: deployment ? "deployed" : "published",
-      integration,
-      agent_id: String(agent.id),
-      ...deployment ? { deployment, deployment_id: deploymentId } : {},
-      env_written: Boolean(envFile),
-      ...envFile ? { env_file: envFile } : {},
-      ...nextCommand ? { next_command: nextCommand } : {},
-      preview,
-      result: imported
-    };
+    const imported = await client.resourceBundles.importBundle(request, { idempotencyKey: importKey(request.bundle, request.mappings) });
+    return { ok: true, phase: "imported", preview, result: imported };
   }
   throw new Error(`Unknown package command: ${parsed.command}`);
 }
@@ -395,20 +821,9 @@ function diagnostics(error) {
   return Array.isArray(value) ? value : void 0;
 }
 function errorMessage(error, parsed) {
-  if (parsed?.command === "install" && error && typeof error === "object" && "status" in error && error.status === 403) {
-    return "This API key cannot install Agents. Create a new Agent integration API key in Settings; existing keys cannot gain additional scopes.";
-  }
+  void parsed;
   return error instanceof Error ? error.message : "Unexpected CLI failure";
 }
-function installSummary(result) {
-  const lines = ["Agent installed and published.", `Agent ID: ${String(result.agent_id)}`];
-  if (result.deployment_id) lines.push(`Deployment ID: ${String(result.deployment_id)}`);
-  if (result.env_written) lines.push(`Configured: ${String(result.env_file)}`);
-  else if (result.integration !== "publish-only") lines.push("Environment configuration was not written.");
-  if (result.next_command) lines.push(`Next: ${String(result.next_command)}`);
-  return `${lines.join("\n")}
-`;
-}
 async function run(argv = process.argv.slice(2)) {
   let parsed;
   try {
@@ -418,7 +833,6 @@ async function run(argv = process.argv.slice(2)) {
 `);
     else if (result.ok === false) process.stderr.write(`${JSON.stringify(result, null, 2)}
 `);
-    else if (parsed.command === "install") process.stdout.write(installSummary(result));
     else process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
     return result.ok === false ? 1 : 0;