@agents24/cli 0.1.2 → 0.3.0

package/dist/cli.js

@@ -1,30 +1,37 @@
 #!/usr/bin/env node
 import {
   assertImportAllowed,
-  assertInstallPreviewReady,
   createRemoteClient,
+  forkPackage,
   initializePackage,
+  loadPackageFiles,
   packPackage,
+  packPackageSnapshot,
   parseMappings,
+  replacePackageFiles,
   shouldPromptForDependency,
   validatePackage
-} from "./chunk-MNGBA3HP.js";
+} from "./chunk-YOT3B62P.js";
 
 // src/cli.ts
-import { basename, join, resolve } from "path";
-import { chmod, readFile, writeFile } from "fs/promises";
-import { createInterface } from "readline/promises";
-import { createHash } from "crypto";
+import { basename as basename2, dirname, join as join3, resolve as resolve3 } from "path";
+import { chmod as chmod2, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { createInterface as createInterface3 } from "readline/promises";
+import { createHash as createHash2 } from "crypto";
+import { spawn } from "child_process";
 import { isCancel, password, select, text } from "@clack/prompts";
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["json", "remote", "yes", "allow-incomplete", "no-write-env"]);
-var DEFAULT_API_BASE_URL = "https://api.agents24.dev";
-var DEFAULT_LOCAL_CLIENT_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
-function parse(argv) {
-  const standaloneInstall = argv[0] === "install";
-  if (!standaloneInstall && (argv[0] !== "package" || !argv[1])) throw new Error("Usage: agents24 install <directory-or-zip> | agents24 package <init|validate|pack|export|compile|preview|import>");
+
+// src/cli-arguments.ts
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["json", "remote", "yes", "allow-incomplete", "no-write-env", "prune", "apply"]);
+var LIFECYCLE_COMMANDS = /* @__PURE__ */ new Set(["prepare", "plan", "apply", "pull", "dev", "publish", "setup", "status", "link", "resources", "fork"]);
+function parseArguments(argv) {
+  const lifecycle = LIFECYCLE_COMMANDS.has(argv[0]);
+  if (!lifecycle && (argv[0] !== "package" || !argv[1])) {
+    throw new Error("Usage: agents24 <prepare|plan|apply|pull|dev|publish|setup|status|link|resources|fork> | agents24 package <init|validate|pack|export|preview|import>");
+  }
   const flags = /* @__PURE__ */ new Map();
   const positionals = [];
-  for (let index = standaloneInstall ? 1 : 2; index < argv.length; index += 1) {
+  for (let index = lifecycle ? 1 : 2; index < argv.length; index += 1) {
     const current = argv[index];
     if (!current.startsWith("--")) {
       positionals.push(current);
@@ -39,7 +46,7 @@ function parse(argv) {
     if (value === void 0 || value.startsWith("--")) throw new Error(`--${rawName} requires a value`);
     flags.set(rawName, [...flags.get(rawName) || [], value]);
   }
-  return { command: standaloneInstall ? "install" : argv[1], positionals, flags };
+  return { command: lifecycle ? argv[0] : argv[1], positionals, flags };
 }
 function flag(parsed, name) {
   return parsed.flags.get(name)?.at(-1);
@@ -47,47 +54,280 @@ function flag(parsed, name) {
 function values(parsed, name) {
   return parsed.flags.get(name) || [];
 }
-function mappings(parsed) {
-  return parseMappings(values(parsed, "map"));
+
+// src/cli-output.ts
+var sensitiveValues = /* @__PURE__ */ new Set();
+function registerSensitiveValue(value) {
+  if (value.length >= 8) sensitiveValues.add(value);
+}
+function redactText(value) {
+  let result = value;
+  for (const secret of sensitiveValues) result = result.split(secret).join("[REDACTED]");
+  return result;
+}
+function sanitize(value) {
+  if (typeof value === "string") return redactText(value);
+  if (Array.isArray(value)) return value.map(sanitize);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [key, sanitize(item)])
+  );
+}
+function readDiagnostics(value) {
+  return Array.isArray(value) ? value : void 0;
+}
+function diagnostics(error) {
+  if (!error || typeof error !== "object") return void 0;
+  const record = error;
+  const fromError = readDiagnostics(record.diagnostics);
+  if (fromError) return fromError;
+  if (!record.details || typeof record.details !== "object" || Array.isArray(record.details)) return void 0;
+  const details = record.details;
+  const fromDetails = readDiagnostics(details.diagnostics);
+  if (fromDetails) return fromDetails;
+  const nested = details.detail;
+  if (!nested || typeof nested !== "object" || Array.isArray(nested)) return void 0;
+  return readDiagnostics(nested.diagnostics);
 }
-function upload(data, input) {
-  return { data, filename: basename(input).endsWith(".zip") ? basename(input) : "resource.agents24.zip" };
+function failurePayload(error) {
+  const diagnosticList = diagnostics(error);
+  return {
+    ok: false,
+    error: redactText(error instanceof Error ? error.message : "Unexpected CLI failure"),
+    ...error && typeof error === "object" && "phase" in error ? { phase: error.phase } : {},
+    ...error && typeof error === "object" && "imported" in error ? { import_result: error.imported } : {},
+    ...diagnosticList ? { diagnostics: diagnosticList } : {}
+  };
 }
-function safeResult(result) {
+function writeResult(result, parsed) {
+  const compact = flag(parsed, "json") === "true";
+  const safeResult = sanitize(result);
+  const body = compact ? JSON.stringify(safeResult) : JSON.stringify(safeResult, null, 2);
+  const stream = result.ok === false ? process.stderr : process.stdout;
+  stream.write(`${body}
+`);
+}
+
+// src/cli-installation-state.ts
+import { basename, join, resolve } from "path";
+import { readFile, stat, writeFile } from "fs/promises";
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+  return JSON.stringify(value);
+}
+function isNotFoundResponse(error) {
+  return Boolean(error && typeof error === "object" && "status" in error && Number(error.status) === 404);
+}
+function packageUpload(data, input) {
+  return {
+    data,
+    filename: basename(input).endsWith(".zip") ? basename(input) : "resource.agents24.zip"
+  };
+}
+async function packageDirectory(input) {
+  try {
+    return (await stat(input)).isDirectory() ? resolve(input) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function ensureIgnored(directory, entries) {
+  const target = join(directory, ".gitignore");
+  let current = "";
+  try {
+    current = await readFile(target, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const lines = new Set(current.split(/\r?\n/).map((item) => item.trim()).filter(Boolean));
+  const missing = entries.filter((item) => !lines.has(item));
+  if (!missing.length) return;
+  const separator = current && !current.endsWith("\n") ? "\n" : "";
+  await writeFile(target, `${current}${separator}${missing.join("\n")}
+`);
+}
+
+// src/cli-secrets.ts
+import { randomBytes } from "crypto";
+import { chmod, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+import { parse as parseYaml } from "yaml";
+function parseEnv(textValue) {
+  const result = {};
+  for (const line of textValue.split(/\r?\n/)) {
+    const match = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line.trim());
+    if (!match) continue;
+    const raw = match[2].trim();
+    try {
+      result[match[1]] = raw.startsWith('"') ? JSON.parse(raw) : raw;
+    } catch {
+      result[match[1]] = raw;
+    }
+  }
   return result;
 }
-async function confirmation(parsed, preview) {
-  const resources = Array.isArray(preview.resources) ? preview.resources : [];
-  const yes = flag(parsed, "yes") === "true";
-  assertImportAllowed(preview, {
-    allowIncomplete: flag(parsed, "allow-incomplete") === "true",
-    yes,
-    interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY)
+async function requirements(input) {
+  const files = await loadPackageFiles(input);
+  const manifest = parseYaml(files.get("agents24.yaml") || "");
+  const requires = manifest.requires && typeof manifest.requires === "object" ? manifest.requires : {};
+  const secrets = requires.secrets && typeof requires.secrets === "object" ? requires.secrets : {};
+  return Object.entries(secrets).map(([key, raw]) => {
+    const item = raw && typeof raw === "object" ? raw : {};
+    const env = String(item.env || "").trim();
+    if (!env) throw new Error(`Secret requirement ${key} must declare env`);
+    return { key: `$secrets.${key}`, env, generate: item.generate === true };
   });
-  if (yes) return;
+}
+async function preparePackage(input) {
+  const directory = await packageDirectory(input);
+  if (!directory) throw new Error("prepare requires a Resource Package directory");
+  const local = await validatePackage(input);
+  if (!local.valid) throw Object.assign(new Error("Resource package is invalid"), { diagnostics: local.diagnostics });
+  const target = join2(directory, ".env.local");
+  let current = "";
+  try {
+    current = await readFile2(target, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const values2 = parseEnv(current);
+  const generated = [];
+  const preserved = [];
+  let next = current;
+  for (const requirement of await requirements(input)) {
+    if (values2[requirement.env] || process.env[requirement.env]) {
+      preserved.push(requirement.env);
+      continue;
+    }
+    if (!requirement.generate) continue;
+    const value = randomBytes(32).toString("base64url");
+    next += `${next && !next.endsWith("\n") ? "\n" : ""}${requirement.env}=${JSON.stringify(value)}
+`;
+    generated.push(requirement.env);
+  }
+  await writeFile2(target, next, { mode: 384 });
+  await chmod(target, 384);
+  await ensureIgnored(directory, [".env.local"]);
+  return { ok: true, package: directory, env_file: target, generated, preserved };
+}
+async function secretValues(input) {
+  const directory = await packageDirectory(input);
+  let local = {};
+  if (directory) {
+    try {
+      local = parseEnv(await readFile2(join2(directory, ".env.local"), "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  const result = {};
+  for (const requirement of await requirements(input)) {
+    const value = String(process.env[requirement.env] || local[requirement.env] || "");
+    if (value) result[requirement.key] = value;
+  }
+  return result;
+}
+
+// src/cli-pull.ts
+import { createInterface } from "readline/promises";
+async function confirmPull(parsed, plan) {
+  if (flag(parsed, "yes") === "true") return;
+  if (flag(parsed, "json") === "true") throw new Error("pull requires --yes with --json");
+  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("pull requires --yes in noninteractive mode");
+  const files = Array.isArray(plan.files) ? plan.files : [];
+  for (const item of files) process.stdout.write(`${String(item.status || "M")}  ${String(item.path || "")}
+`);
+  const summary = plan.summary && typeof plan.summary === "object" ? plan.summary : {};
   const prompt = createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await prompt.question(`Import ${resources.length} resource draft(s)? [y/N] `);
+  const answer = await prompt.question(
+    `Pull platform drafts (${summary.files_added || 0} added, ${summary.files_modified || 0} modified, ${summary.files_removed || 0} removed)? [y/N] `
+  );
   prompt.close();
-  if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Import cancelled");
+  if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Pull cancelled");
+}
+async function pullPackage(options) {
+  const { parsed, input, client, installationId } = options;
+  const preview = await client.resourceInstallations.planPull(
+    installationId,
+    packageUpload(await packPackageSnapshot(input), input)
+  );
+  const plan = preview.plan && typeof preview.plan === "object" ? preview.plan : {};
+  await confirmPull(parsed, plan);
+  const pullId = String(preview.pull_id || "");
+  const payload = await client.resourceInstallations.downloadPull(installationId, pullId);
+  if (payload.platform_snapshot_hash !== preview.platform_snapshot_hash || payload.package_hash !== preview.package_hash || !payload.files || typeof payload.files !== "object" || Array.isArray(payload.files)) throw new Error("Pulled package snapshot does not match its preview");
+  let accepted = {};
+  await replacePackageFiles(input, payload.files, async () => {
+    accepted = await client.resourceInstallations.acceptPull(
+      installationId,
+      pullId,
+      {
+        platform_snapshot_hash: String(preview.platform_snapshot_hash || ""),
+        package_hash: String(preview.package_hash || "")
+      },
+      { idempotencyKey: `pull-${pullId}` }
+    );
+  });
+  return {
+    ok: true,
+    phase: "pulled",
+    installation_id: installationId,
+    pull_id: preview.pull_id,
+    package_hash: preview.package_hash,
+    summary: plan.summary || {},
+    files: Array.isArray(plan.files) ? plan.files : [],
+    status: accepted.status
+  };
+}
+
+// src/cli-status.ts
+async function installedPackageStatus(input, client, status) {
+  const callableBindings = Array.isArray(status.callable_bindings) ? status.callable_bindings : [];
+  const publicationCurrent = status.publication_state === "current";
+  const healthy = callableBindings.filter((item) => item.draft_status === "attached" && (!publicationCurrent || item.published_status === "attached")).length;
+  const compiled = await client.resourcePackages.validatePackage(
+    packageUpload(await packPackage(input), input)
+  );
+  const localPackageHash = typeof compiled.package_hash === "string" ? compiled.package_hash : null;
+  return {
+    ok: true,
+    installed: true,
+    binding_summary: {
+      total: callableBindings.length,
+      healthy,
+      unhealthy: callableBindings.length - healthy
+    },
+    synchronization: {
+      direction: status.last_sync_direction || null,
+      synchronized_at: status.last_synchronized_at || null,
+      synchronized_package_hash: status.synchronized_package_hash || null,
+      local_package_hash: localPackageHash,
+      diverged: Boolean(localPackageHash && status.synchronized_package_hash && localPackageHash !== status.synchronized_package_hash)
+    },
+    installation: status
+  };
 }
-async function promptMappings(parsed, client, preview, current) {
-  if (!process.stdin.isTTY || !process.stdout.isTTY || flag(parsed, "yes") === "true") return current;
+
+// src/cli-requirements.ts
+import { createHash } from "crypto";
+import { createInterface as createInterface2 } from "readline/promises";
+async function promptImportMappings(client, preview, current, enabled) {
+  if (!enabled) return current;
   const dependencies = Array.isArray(preview.dependencies) ? preview.dependencies.filter((item) => Boolean(item && typeof item === "object" && item.status === "unresolved")) : [];
   const unique = new Map(dependencies.map((item) => [String(item.requirement_key || item.id), item]));
   if (!unique.size) return current;
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
   try {
     const next = { ...current };
     for (const [key, dependency] of unique) {
-      if (!shouldPromptForDependency(dependency)) {
-        continue;
-      }
+      if (!shouldPromptForDependency(dependency)) continue;
       if (dependency.kind === "secret") {
         const answer2 = await prompt.question(`${dependency.source_name || key} secret ($secret:name, blank to omit): `);
         if (answer2.trim()) next[key] = answer2.trim();
         continue;
       }
-      const response = await client.resourceBundles.candidates({
+      const response = await client.resourcePackages.candidates({
         kind: String(dependency.kind),
         query: String(dependency.source_name || ""),
         requiredCapability: dependency.required_capability === "embedding" ? "embedding" : dependency.required_capability === "chat" ? "chat" : void 0
@@ -104,26 +344,257 @@ async function promptMappings(parsed, client, preview, current) {
     prompt.close();
   }
 }
-async function compiledPackage(parsed, client) {
+async function promptInstallationRequirementLinks(client, installationId, plan, enabled) {
+  if (!enabled) return false;
+  const requirements2 = Array.isArray(plan.external_requirements) ? plan.external_requirements.filter((item) => Boolean(
+    item && typeof item === "object" && item.required === true && item.configured !== true && !["model", "secret"].includes(String(item.kind))
+  )) : [];
+  if (!requirements2.length) return false;
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
+  let linked = false;
+  try {
+    for (const requirement of requirements2) {
+      const key = String(requirement.requirement_key || "");
+      const response = await client.resourcePackages.candidates({ kind: String(requirement.kind), query: String(requirement.name || "") });
+      const candidates = Array.isArray(response.items) ? response.items : [];
+      process.stdout.write(`${requirement.name || key}: ${candidates.map((item, index) => `${index + 1}) ${item.name}`).join("  ")}
+`);
+      const answer = await prompt.question("Choose a candidate number (blank to leave unresolved): ");
+      const selected = candidates[Number(answer) - 1];
+      if (!selected?.id) continue;
+      await client.resourceInstallations.link(installationId, { resource_key: key, resource_id: String(selected.id) }, {
+        idempotencyKey: `link-${createHash("sha256").update(`${installationId}:${key}:${selected.id}`).digest("hex").slice(0, 40)}`
+      });
+      linked = true;
+    }
+    return linked;
+  } finally {
+    prompt.close();
+  }
+}
+
+// src/cli-development.ts
+import { createHmac } from "crypto";
+import { hostname } from "os";
+import { resolve as resolve2 } from "path";
+import { parse as parseYaml2 } from "yaml";
+var DEFAULT_API_BASE_URL = "https://api.agents24.dev";
+var MANIFEST_POLL_INTERVAL_MS = 2e3;
+async function developmentArtifacts(input) {
+  const directory = await packageDirectory(input);
+  if (!directory) throw new Error("dev requires a Resource Package directory");
+  const files = await loadPackageFiles(input);
+  const manifest = parseYaml2(files.get("agents24.yaml") || "");
+  const resources = Array.isArray(manifest.resources) ? manifest.resources : [];
+  const requires = manifest.requires && typeof manifest.requires === "object" ? manifest.requires : {};
+  const requiredSecrets = requires.secrets && typeof requires.secrets === "object" ? requires.secrets : {};
+  const result = [];
+  for (const resource of resources) {
+    const path = String(resource.path || "");
+    if (!/^artifacts\/[a-z0-9][a-z0-9-]*\/artifact\.yaml$/.test(path)) continue;
+    const sourceText = files.get(path);
+    if (!sourceText) continue;
+    const source = parseYaml2(sourceText);
+    if (source.execution_target !== "self_hosted") continue;
+    const development = source.development && typeof source.development === "object" ? source.development : void 0;
+    if (!development) continue;
+    const server = source.server && typeof source.server === "object" ? source.server : {};
+    const auth = server.auth && typeof server.auth === "object" ? server.auth : {};
+    const secretRequirement = String(auth.secret || "");
+    const secretKey = secretRequirement.startsWith("$secrets.") ? secretRequirement.slice("$secrets.".length) : "";
+    const secretDeclaration = secretKey && requiredSecrets[secretKey] && typeof requiredSecrets[secretKey] === "object" ? requiredSecrets[secretKey] : void 0;
+    const cwd = resolve2(directory, String(development.cwd || "."));
+    if (cwd !== directory && !cwd.startsWith(`${directory}/`)) throw new Error(`Artifact ${resource.key} development.cwd must remain inside the package`);
+    result.push({
+      key: String(resource.key || ""),
+      baseUrl: String(development.base_url || ""),
+      command: development.command ? String(development.command) : void 0,
+      args: Array.isArray(development.args) ? development.args.map(String) : [],
+      cwd,
+      protocol: {
+        manifest_path: server.manifest_path,
+        health_path: server.health_path,
+        verify_path: server.verify_path,
+        invoke_path: server.invoke_path,
+        auth_mode: auth.mode,
+        signing_secret_requirement: auth.secret
+      },
+      signingSecretEnv: secretDeclaration?.env ? String(secretDeclaration.env) : void 0
+    });
+  }
+  return result;
+}
+async function waitForServer(baseUrl, healthPath) {
+  const target = new URL(String(healthPath || "/.well-known/agents24/artifact/health"), baseUrl);
+  for (let attempt = 0; attempt < 60; attempt += 1) {
+    try {
+      const response = await fetch(target);
+      if (response.ok) return;
+    } catch {
+    }
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 250));
+  }
+  throw new Error(`Local Artifact server did not become healthy at ${target}`);
+}
+async function openDevelopmentRelay(client, installationIdValue, artifact, localEnv) {
+  const admission = await client.resourceInstallations.prepareDevelopmentSession(installationIdValue, {
+    resource_key: artifact.key,
+    machine_label: hostname()
+  });
+  const apiUrl = new URL(String(process.env.AGENTS24_BASE_URL || DEFAULT_API_BASE_URL));
+  apiUrl.protocol = apiUrl.protocol === "https:" ? "wss:" : "ws:";
+  apiUrl.pathname = String(admission.relay_path);
+  const socket = new WebSocket(apiUrl, [
+    "agents24-artifact-relay",
+    `agents24-credential-${String(admission.relay_token)}`
+  ]);
+  const state = {};
+  let manifestHash;
+  let pendingHash;
+  let polling = false;
+  const manifestUrl = new URL(String(artifact.protocol.manifest_path || "/.well-known/agents24/artifact"), artifact.baseUrl);
+  const localManifestHash = async () => {
+    const response = await fetch(manifestUrl);
+    if (!response.ok) throw new Error("Local Artifact manifest is unavailable");
+    return canonicalJson(await response.json());
+  };
+  const pollManifest = async () => {
+    if (polling || socket.readyState !== WebSocket.OPEN || pendingHash !== void 0) return;
+    polling = true;
+    try {
+      const nextHash = await localManifestHash();
+      if (manifestHash !== void 0 && nextHash === manifestHash) return;
+      if (manifestHash === void 0) {
+        manifestHash = nextHash;
+        return;
+      }
+      pendingHash = nextHash;
+      socket.send(JSON.stringify({ type: "manifest_changed" }));
+    } catch {
+      pendingHash = "unavailable";
+      socket.send(JSON.stringify({ type: "manifest_changed" }));
+    } finally {
+      polling = false;
+    }
+  };
+  await new Promise((resolveReady, rejectReady) => {
+    socket.addEventListener("error", () => rejectReady(new Error(`Artifact relay failed for ${artifact.key}`)), { once: true });
+    socket.addEventListener("message", async (event) => {
+      const message = JSON.parse(String(event.data));
+      if (message.type === "ready") {
+        try {
+          manifestHash = await localManifestHash();
+        } catch {
+          manifestHash = void 0;
+        }
+        resolveReady();
+        return;
+      }
+      if (message.type === "manifest_refreshed") {
+        if (pendingHash && pendingHash !== "unavailable") manifestHash = pendingHash;
+        pendingHash = void 0;
+        return;
+      }
+      if (message.type === "manifest_refresh_failed") {
+        pendingHash = void 0;
+        return;
+      }
+      if (message.type === "superseded" || message.type === "revoked") {
+        state.terminalReason = String(message.type);
+        socket.close();
+        return;
+      }
+      if (message.type !== "request") return;
+      const method = message.operation === "health" || message.operation === "manifest" ? "GET" : "POST";
+      try {
+        const requestBody = method === "POST" ? JSON.stringify(message.body || {}) : void 0;
+        const headers = method === "POST" ? { "content-type": "application/json" } : {};
+        if (method === "POST" && String(artifact.protocol.auth_mode || "hmac_sha256") === "hmac_sha256") {
+          const signingSecret = String(
+            artifact.signingSecretEnv && (localEnv[artifact.signingSecretEnv] || process.env[artifact.signingSecretEnv]) || ""
+          );
+          if (!signingSecret) throw new Error(`Artifact ${artifact.key} signing secret is unavailable`);
+          const timestamp = String(Date.now());
+          const signature = createHmac("sha256", signingSecret).update(`${timestamp}.${requestBody}`).digest("hex");
+          headers["x-agents24-timestamp"] = timestamp;
+          headers["x-agents24-signature"] = `sha256=${signature}`;
+        }
+        const response = await fetch(new URL(String(message.path || "/"), artifact.baseUrl), { method, headers, body: requestBody });
+        const textBody = await response.text();
+        let body = textBody;
+        try {
+          body = textBody ? JSON.parse(textBody) : null;
+        } catch {
+        }
+        socket.send(JSON.stringify({ type: "response", request_id: message.request_id, status: response.status, body }));
+      } catch {
+        socket.send(JSON.stringify({ type: "response", request_id: message.request_id, status: 502, body: { status: "failed" } }));
+      }
+    });
+    const heartbeat = setInterval(() => {
+      if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify({ type: "heartbeat" }));
+    }, 15e3);
+    const manifestPoll = setInterval(() => {
+      void pollManifest();
+    }, MANIFEST_POLL_INTERVAL_MS);
+    socket.addEventListener("close", () => {
+      clearInterval(heartbeat);
+      clearInterval(manifestPoll);
+    }, { once: true });
+  });
+  return { sessionId: String(admission.id), socket, state };
+}
+
+// src/cli.ts
+var DEFAULT_API_BASE_URL2 = "https://api.agents24.dev";
+var DEFAULT_LOCAL_CLIENT_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
+function mappings(parsed) {
+  return parseMappings(values(parsed, "map"));
+}
+async function confirmation(parsed, preview) {
+  const resources = Array.isArray(preview.resources) ? preview.resources : [];
+  const yes = flag(parsed, "yes") === "true";
+  assertImportAllowed(preview, {
+    allowIncomplete: flag(parsed, "allow-incomplete") === "true",
+    yes,
+    interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY)
+  });
+  if (yes) return;
+  const prompt = createInterface3({ input: process.stdin, output: process.stdout });
+  const answer = await prompt.question(`Import ${resources.length} resource draft(s)? [y/N] `);
+  prompt.close();
+  if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Import cancelled");
+}
+async function applyConfirmation(parsed, plan) {
+  if (flag(parsed, "yes") === "true") return;
+  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("apply requires --yes in noninteractive mode");
+  const actions = Array.isArray(plan.actions) ? plan.actions.length : 0;
+  const removals = Array.isArray(plan.content) ? plan.content.reduce((count, item) => count + (Array.isArray(item.remove) ? item.remove.length : 0), 0) : 0;
+  const prompt = createInterface3({ input: process.stdin, output: process.stdout });
+  const answer = await prompt.question(`Apply ${actions} resource action(s)${removals ? ` and ${removals} content removal(s)` : ""}? [y/N] `);
+  prompt.close();
+  if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Apply cancelled");
+}
+async function pollOperation(client, operation) {
+  let current = operation;
+  for (let attempt = 0; attempt < 900; attempt += 1) {
+    const status = String(current.status || "");
+    if (["completed", "failed"].includes(status)) return current;
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 1e3));
+    current = await client.resourceInstallations.operationStatus(String(current.operation_id));
+  }
+  throw new Error("Resource apply did not finish within 15 minutes");
+}
+async function packedValidatedPackage(parsed) {
   const input = parsed.positionals[0];
   if (!input) throw new Error(`${parsed.command} requires a package directory or ZIP`);
   const local = await validatePackage(input);
   if (!local.valid) throw Object.assign(new Error("Resource package is invalid"), { diagnostics: local.diagnostics });
   const data = await packPackage(input);
-  const remoteClient = client || await createRemoteClient();
-  const result = await remoteClient.resourcePackages.compilePackage(upload(data, input));
-  return { data, result };
-}
-function canonical(value) {
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
-  return JSON.stringify(value);
-}
-function installKey(bundle, map) {
-  return `install-${createHash("sha256").update(canonical({ bundle, mappings: map })).digest("hex").slice(0, 40)}`;
+  return { data, filename: `${basename2(resolve3(input))}.agents24.zip` };
 }
-function importedRows(imported) {
-  return Array.isArray(imported.resources) ? imported.resources.filter((item) => Boolean(item && typeof item === "object")) : [];
+function importKey(packageHash, map) {
+  return `import-${createHash2("sha256").update(canonicalJson({ package_hash: packageHash, mappings: map })).digest("hex").slice(0, 40)}`;
 }
 function interactive(parsed) {
   return flag(parsed, "yes") !== "true" && Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -131,20 +602,47 @@ function interactive(parsed) {
 function cancelled(value) {
   if (isCancel(value)) throw new Error("Installation cancelled");
 }
-async function apiKeyForInstall(parsed) {
+async function apiKeyForLifecycle(parsed) {
+  await loadPackageLifecycleEnvironment(parsed.positionals[0]);
   let apiKey = String(process.env.AGENTS24_API_KEY || "").trim();
   if (!apiKey && interactive(parsed)) {
     const answer = await password({ message: "Agents24 API key", validate: (value) => String(value || "").trim() ? void 0 : "The API key is required." });
     cancelled(answer);
     apiKey = String(answer).trim();
   }
-  if (!apiKey) throw new Error("AGENTS24_API_KEY is required for noninteractive installation");
+  if (!apiKey) throw new Error("AGENTS24_API_KEY is required for noninteractive resource management");
   if (/[\r\n\0]/.test(apiKey)) throw new Error("AGENTS24_API_KEY contains invalid control characters");
+  registerSensitiveValue(apiKey);
   return apiKey;
 }
+async function loadPackageLifecycleEnvironment(input) {
+  if (!input) return;
+  const directory = await packageDirectory(input);
+  if (!directory) return;
+  for (const path of [join3(dirname(directory), ".env.local"), join3(directory, ".env.local")]) {
+    try {
+      const values2 = parseEnv(await readFile3(path, "utf8"));
+      for (const [name, value] of Object.entries(values2)) {
+        if (!process.env[name]) process.env[name] = value;
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+}
+function publicationProjection(publication) {
+  return {
+    installation_id: publication.installation_id,
+    operation_id: publication.operation_id,
+    package_hash: publication.package_hash,
+    status: publication.status,
+    ...publication.published_at ? { published_at: publication.published_at } : {},
+    ...publication.client_deployment_id ? { client_deployment_id: publication.client_deployment_id } : {}
+  };
+}
 function clientAppBaseUrl(environment = process.env) {
   const baseUrl = String(environment.AGENTS24_BASE_URL || "").trim().replace(/\/+$/, "");
-  if (!baseUrl || baseUrl === DEFAULT_API_BASE_URL) return void 0;
+  if (!baseUrl || baseUrl === DEFAULT_API_BASE_URL2) return void 0;
   let parsed;
   try {
     parsed = new URL(baseUrl);
@@ -157,9 +655,9 @@ function clientAppBaseUrl(environment = process.env) {
   return baseUrl;
 }
 async function appInfoAt(directory, explicit) {
-  const target = resolve(directory);
+  const target = resolve3(directory);
   try {
-    const manifest = JSON.parse(await readFile(join(target, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile3(join3(target, "package.json"), "utf8"));
     const metadata = manifest.agents24 && typeof manifest.agents24 === "object" ? manifest.agents24 : {};
     const integration = String(metadata.integration || "");
     if (integration !== "client-deployment" && integration !== "bff") {
@@ -191,21 +689,6 @@ async function resolveInstallMode(parsed, app) {
   cancelled(answer);
   return answer;
 }
-async function selectInstalledAgent(parsed, imported) {
-  const agents = importedRows(imported).filter((row) => row.kind === "agent");
-  if (!agents.length) throw new Error("The installed package does not contain an Agent");
-  const requested = flag(parsed, "agent");
-  if (requested) {
-    const match = agents.find((row) => [row.id, row.resource_key, row.name].map(String).includes(requested));
-    if (!match) throw new Error(`--agent did not match an imported Agent: ${requested}`);
-    return match;
-  }
-  if (agents.length === 1) return agents[0];
-  if (!interactive(parsed)) throw new Error("--agent is required when the package contains multiple Agents");
-  const answer = await select({ message: "Which Agent should be published?", options: agents.map((row) => ({ value: String(row.id), label: String(row.name) })) });
-  cancelled(answer);
-  return agents.find((row) => String(row.id) === answer);
-}
 async function clientDeployment(parsed, client, agent, app) {
   const policies = (await client.resourcePolicies.list()).filter((row) => row.is_active === true);
   let policyId = flag(parsed, "policy-set");
@@ -237,31 +720,352 @@ async function clientDeployment(parsed, client, agent, app) {
     allowed_origins: origins,
     ...oidcRaw ? { oidc: JSON.parse(oidcRaw) } : {}
   };
-  return client.clientDeployments.create(request, { idempotencyKey: `deploy-${createHash("sha256").update(canonical(request)).digest("hex").slice(0, 40)}` });
+  return client.clientDeployments.create(request, { idempotencyKey: `deploy-${createHash2("sha256").update(canonicalJson(request)).digest("hex").slice(0, 40)}` });
 }
 async function updateEnvFile(app, values2) {
-  const target = join(app.directory, ".env.local");
+  const target = join3(app.directory, ".env.local");
   let content = "";
   try {
-    content = await readFile(target, "utf8");
+    content = await readFile3(target, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
   let next = content;
   for (const [name, value] of Object.entries(values2)) {
-    const line = `${name}=${JSON.stringify(value)}`;
+    const line = `${name}=${typeof value === "string" ? JSON.stringify(value) : value.value}`;
     const pattern = new RegExp(`^${name}=.*$`, "m");
     next = pattern.test(next) ? next.replace(pattern, line) : `${next}${next && !next.endsWith("\n") ? "\n" : ""}${line}
 `;
   }
-  await writeFile(target, next, { mode: 384 });
-  await chmod(target, 384);
+  await writeFile3(target, next, { mode: 384 });
+  await chmod2(target, 384);
   return target;
 }
+function primaryAgentAlias(applied) {
+  const aliases = Array.isArray(applied.agent.aliases) ? applied.agent.aliases : [];
+  const agentAlias = String(aliases[0] || applied.result.primary_agent_alias || "");
+  if (!agentAlias) throw new Error("Apply completed without a primary Agent alias");
+  return agentAlias;
+}
+function bffApplicationValues(applied) {
+  const agentAlias = primaryAgentAlias(applied);
+  return {
+    AGENTS24_API_KEY: applied.apiKey,
+    AGENTS24_AGENTS: { value: JSON.stringify([{ agentAlias }]), literal: true }
+  };
+}
+async function packageIdentity(input, requireValid = true) {
+  const result = await validatePackage(input);
+  const packageId = String(result.package.package_id || "");
+  if (!/^pkg_[0-9a-f]{32}$/.test(packageId)) {
+    throw new Error("Resource Package is missing a valid package_id; create an independent package with agents24 fork <source> <target>");
+  }
+  if (requireValid && !result.valid) throw Object.assign(new Error("Resource package is invalid"), { diagnostics: result.diagnostics });
+  return { packageId, packageName: String(result.package.name || "") };
+}
+async function resolveInstallation(input, client, requireValid = true) {
+  const { packageId } = await packageIdentity(input, requireValid);
+  return client.resourceInstallations.getByPackageId(packageId);
+}
+function blockedPlanMessage(plan) {
+  const blockers = Array.isArray(plan.blockers) ? plan.blockers.filter((item) => Boolean(item && typeof item === "object")) : [];
+  if (!blockers.length) return "The Resource Package plan is blocked";
+  const details = blockers.map((blocker) => {
+    const resource = String(blocker.resource_key || blocker.requirement_key || "").trim();
+    const guidance = String(blocker.guidance || "").trim();
+    const code = String(blocker.code || "PLAN_BLOCKED").trim();
+    return `${code}${resource ? ` (${resource})` : ""}${guidance ? `: ${guidance}` : ""}`;
+  });
+  return `The Resource Package plan is blocked: ${details.join("; ")}`;
+}
+async function ensureInstallation(input, client, data) {
+  const identity = await packageIdentity(input);
+  const initial = await client.resourceInstallations.plan(packageUpload(data, input));
+  if (initial.installation_id) return String(initial.installation_id);
+  const created = await client.resourceInstallations.create(
+    { package_id: identity.packageId, package_name: String(initial.package_name), operation_id: String(initial.operation_id) },
+    { idempotencyKey: `installation-${identity.packageId}` }
+  );
+  return String(created.id);
+}
+async function applyDraft(parsed, options = {}) {
+  const input = parsed.positionals[0];
+  if (!input) throw new Error(`${parsed.command} requires a Resource Package directory or ZIP`);
+  await packageIdentity(input);
+  const apiKey = options.apiKey || await apiKeyForLifecycle(parsed);
+  const client = options.client || await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+  const data = await packPackage(input);
+  let plan = await client.resourceInstallations.plan({
+    ...packageUpload(data, input),
+    prune: flag(parsed, "prune") === "true"
+  });
+  if (plan.can_apply !== true && interactive(parsed)) {
+    const installationId = await ensureInstallation(input, client, data);
+    if (await promptInstallationRequirementLinks(client, installationId, plan, true)) {
+      plan = await client.resourceInstallations.plan({
+        ...packageUpload(data, input),
+        prune: flag(parsed, "prune") === "true"
+      });
+    }
+  }
+  if (plan.can_apply !== true) throw Object.assign(new Error(blockedPlanMessage(plan)), { plan });
+  if (!options.skipConfirmation) await applyConfirmation(parsed, plan);
+  const secrets = await secretValues(input);
+  let operation = await client.resourceInstallations.apply(String(plan.operation_id), {
+    primary_resource_key: flag(parsed, "agent"),
+    integration_mode: options.integrationMode || flag(parsed, "integration") || "publish-only",
+    secrets
+  }, { idempotencyKey: `apply-${String(plan.package_hash).slice(0, 40)}` });
+  operation = await pollOperation(client, operation);
+  if (operation.status !== "completed") throw Object.assign(new Error("Draft apply failed"), { operation });
+  const installationIdValue = String(operation.installation_id || "");
+  if (!installationIdValue) throw new Error("Apply completed without an installation ID");
+  const result = operation.result && typeof operation.result === "object" ? operation.result : {};
+  const agentId = String(result.primary_agent_id || "");
+  const resources = Array.isArray(result.resources) ? result.resources : [];
+  const agent = resources.find((item) => String(item.id) === agentId) || { id: agentId, name: "Agent" };
+  return { client, apiKey, input, installationId: installationIdValue, plan, operation, result, agent };
+}
+async function publishDraft(parsed, applied) {
+  const input = applied?.input || parsed.positionals[0];
+  if (!input) throw new Error("publish requires a Resource Package directory or ZIP");
+  await packageIdentity(input);
+  const apiKey = applied?.apiKey || await apiKeyForLifecycle(parsed);
+  const client = applied?.client || await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+  const installed = applied ? void 0 : await resolveInstallation(input, client);
+  const id = applied?.installationId || String(installed?.id || "");
+  if (!id) throw new Error("No installation exists for this package_id; run agents24 apply first");
+  const data = await packPackage(input);
+  const plan = applied?.plan || await client.resourceInstallations.plan(packageUpload(data, input));
+  const publication = await client.resourceInstallations.publish(id, { package_hash: String(plan.package_hash) }, {
+    idempotencyKey: `publish-${String(plan.package_hash).slice(0, 40)}`
+  });
+  return { publication, installationId: id };
+}
 async function execute(parsed) {
+  if (parsed.command === "fork") {
+    const [source, target] = parsed.positionals;
+    if (!source || !target) throw new Error("Usage: agents24 fork <source> <target> [--name <name>]");
+    const result = await forkPackage(source, target, flag(parsed, "name"));
+    return { ok: true, directory: resolve3(target), package: result.name, package_id: result.packageId };
+  }
+  if (parsed.command === "prepare") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("prepare requires a Resource Package directory");
+    await packageIdentity(input);
+    return preparePackage(input);
+  }
+  if (parsed.command === "plan") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("plan requires a Resource Package directory or ZIP");
+    await packageIdentity(input);
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    const data = await packPackage(input);
+    const plan = await client.resourceInstallations.plan({
+      ...packageUpload(data, input),
+      prune: flag(parsed, "prune") === "true"
+    });
+    return { ok: plan.can_apply === true, plan };
+  }
+  if (parsed.command === "pull") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("pull requires a Resource Package directory");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    const installation = await resolveInstallation(input, client, false);
+    return pullPackage({ parsed, input, client, installationId: String(installation.id || "") });
+  }
+  if (parsed.command === "status") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("status requires a Resource Package directory or ZIP");
+    const identity = await packageIdentity(input);
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    let status;
+    try {
+      status = await resolveInstallation(input, client);
+    } catch (error) {
+      if (!isNotFoundResponse(error)) throw error;
+      return {
+        ok: true,
+        installed: false,
+        package_id: identity.packageId,
+        message: "This package has not been applied to this organization. Run agents24 apply <package-directory> to create its resources."
+      };
+    }
+    return installedPackageStatus(input, client, status);
+  }
+  if (parsed.command === "resources") {
+    if (parsed.positionals[0] !== "list") throw new Error("Usage: agents24 resources list --kind <kind>");
+    const kind = flag(parsed, "kind");
+    if (!kind) throw new Error("resources list requires --kind");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const result = await (await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey })).resourceInstallations.resources({
+      kind,
+      query: flag(parsed, "query"),
+      limit: Number(flag(parsed, "limit") || 100)
+    });
+    return { ok: true, ...result };
+  }
+  if (parsed.command === "link") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("link requires a Resource Package directory or ZIP");
+    const assignments = values(parsed, "resource");
+    if (!assignments.length) throw new Error("link requires --resource <stable-key>=<uuid>");
+    await packageIdentity(input);
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    const data = await packPackage(input);
+    const id = await ensureInstallation(input, client, data);
+    const linked = [];
+    for (const assignment of assignments) {
+      const separator = assignment.indexOf("=");
+      if (separator <= 0 || separator === assignment.length - 1) throw new Error("--resource must be <stable-key>=<uuid>");
+      const resourceKey = assignment.slice(0, separator);
+      const resourceId = assignment.slice(separator + 1);
+      linked.push(await client.resourceInstallations.link(id, { resource_key: resourceKey, resource_id: resourceId }, {
+        idempotencyKey: `link-${createHash2("sha256").update(`${id}:${assignment}`).digest("hex").slice(0, 40)}`
+      }));
+    }
+    return { ok: true, installation_id: id, linked };
+  }
+  if (parsed.command === "apply") {
+    const app = await resolveApp(parsed);
+    const integration = app || flag(parsed, "integration") ? await resolveInstallMode(parsed, app) : "publish-only";
+    const applied = await applyDraft(parsed, { integrationMode: integration });
+    const envFile = app && integration === "bff" && flag(parsed, "no-write-env") !== "true" ? await updateEnvFile(app, bffApplicationValues(applied)) : void 0;
+    return {
+      ok: true,
+      phase: "draft_applied",
+      installation_id: applied.installationId,
+      agent_alias: primaryAgentAlias(applied),
+      operation_id: applied.operation.operation_id,
+      operation_status: applied.operation.status,
+      ...envFile ? { env_file: envFile } : {}
+    };
+  }
+  if (parsed.command === "publish") {
+    const published = await publishDraft(parsed);
+    return {
+      ok: true,
+      phase: "published",
+      installation_id: published.installationId,
+      publication: publicationProjection(published.publication)
+    };
+  }
+  if (parsed.command === "setup") {
+    const app = await resolveApp(parsed);
+    const integration = await resolveInstallMode(parsed, app);
+    const applied = await applyDraft(parsed, { integrationMode: integration });
+    const published = await publishDraft(parsed, applied);
+    const installed = await applied.client.resourceInstallations.get(applied.installationId);
+    let deployment;
+    let deploymentId;
+    if (integration === "client-deployment") {
+      deployment = installed.client_deployment_id ? await applied.client.clientDeployments.get(String(installed.client_deployment_id)) : await clientDeployment(parsed, applied.client, applied.agent, app);
+      if (!installed.client_deployment_id) {
+        await applied.client.resourceInstallations.bindDeployment(applied.installationId, { client_deployment_id: String(deployment.id) }, { idempotencyKey: `deployment-bind-${applied.installationId}` });
+      }
+      deploymentId = String(deployment.client_id || "");
+    }
+    let envFile;
+    if (app && flag(parsed, "no-write-env") !== "true" && integration !== "publish-only") {
+      const localClientBaseUrl = integration === "client-deployment" ? clientAppBaseUrl() : void 0;
+      envFile = await updateEnvFile(app, integration === "client-deployment" ? { VITE_AGENTS24_DEPLOYMENT_ID: String(deploymentId), ...localClientBaseUrl ? { VITE_AGENTS24_BASE_URL: localClientBaseUrl } : {} } : bffApplicationValues(applied));
+    }
+    return {
+      ok: true,
+      phase: deployment ? "deployed" : "published",
+      integration,
+      installation_id: applied.installationId,
+      agent_alias: primaryAgentAlias(applied),
+      publication: publicationProjection(published.publication),
+      ...deployment ? { deployment_id: deploymentId } : {},
+      ...envFile ? { env_file: envFile } : {}
+    };
+  }
+  if (parsed.command === "dev") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("dev requires a Resource Package directory");
+    await packageIdentity(input);
+    await preparePackage(input);
+    const declared = await developmentArtifacts(input);
+    const selectedKey = flag(parsed, "artifact");
+    const artifacts = selectedKey ? declared.filter((item) => item.key === selectedKey) : declared;
+    if (!artifacts.length) throw new Error(selectedKey ? `Artifact ${selectedKey} has no development configuration` : "No self-hosted Artifact development configuration was found");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    const applied = flag(parsed, "apply") === "true" ? await applyDraft(parsed, { apiKey, client }) : void 0;
+    let id = applied?.installationId;
+    if (!id) {
+      try {
+        id = String((await resolveInstallation(input, client)).id || "");
+      } catch (error) {
+        if (!isNotFoundResponse(error)) throw error;
+        throw new Error("Apply the package before starting Artifact development");
+      }
+    }
+    if (!id) throw new Error("Apply the package before starting Artifact development");
+    const configuredSecrets = await secretValues(input);
+    if (Object.keys(configuredSecrets).length) await client.resourceInstallations.configureSecrets(id, { secrets: configuredSecrets });
+    const directory = await packageDirectory(input);
+    const localEnv = directory ? parseEnv(await readFile3(join3(directory, ".env.local"), "utf8")) : {};
+    const children = [];
+    const relays = [];
+    try {
+      for (const artifact of artifacts) {
+        if (artifact.command) children.push(spawn(artifact.command, artifact.args, { cwd: artifact.cwd, env: { ...process.env, ...localEnv }, stdio: "inherit", shell: false }));
+        await waitForServer(artifact.baseUrl, artifact.protocol.health_path);
+        relays.push(await openDevelopmentRelay(client, id, artifact, localEnv));
+      }
+      const developmentSessions = Object.fromEntries(artifacts.map((item, index) => [item.key, relays[index].sessionId]));
+      process.stdout.write(`${JSON.stringify({ ok: true, phase: "development_connected", installation_id: id, development_sessions: developmentSessions, draft_applied: Boolean(applied) }, null, 2)}
+`);
+      await new Promise((resolveStop) => {
+        let stopping = false;
+        const reconnecting = /* @__PURE__ */ new Set();
+        const stop = () => {
+          stopping = true;
+          resolveStop();
+        };
+        const watch = (relay, index) => {
+          relay.socket.addEventListener("close", async () => {
+            if (stopping) return;
+            if (relay.state.terminalReason || reconnecting.has(index)) {
+              stop();
+              return;
+            }
+            reconnecting.add(index);
+            for (let attempt = 1; attempt <= 3 && !stopping; attempt += 1) {
+              await new Promise((resolveDelay) => setTimeout(resolveDelay, attempt * 500));
+              try {
+                const replacement = await openDevelopmentRelay(client, id, artifacts[index], localEnv);
+                relays[index] = replacement;
+                developmentSessions[artifacts[index].key] = replacement.sessionId;
+                reconnecting.delete(index);
+                watch(replacement, index);
+                return;
+              } catch {
+              }
+            }
+            reconnecting.delete(index);
+            stop();
+          }, { once: true });
+        };
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+        relays.forEach(watch);
+      });
+      return { ok: true, phase: "development_stopped", installation_id: id };
+    } finally {
+      for (const relay of relays) relay.socket.close();
+      for (const child of children) child.kill("SIGTERM");
+    }
+  }
   if (parsed.command === "init") {
-    const directory = resolve(parsed.positionals[0] || ".");
-    const name = flag(parsed, "name") || basename(directory);
+    const directory = resolve3(parsed.positionals[0] || ".");
+    const name = flag(parsed, "name") || basename2(directory);
     const packageName = await initializePackage(directory, name);
     return { ok: true, directory, package: packageName };
   }
@@ -272,7 +1076,7 @@ async function execute(parsed) {
     let remote;
     if (flag(parsed, "remote") === "true" && local.valid) {
       const data = await packPackage(input);
-      remote = await (await createRemoteClient()).resourcePackages.validatePackage(upload(data, input));
+      remote = await (await createRemoteClient()).resourcePackages.validatePackage(packageUpload(data, input));
     }
     return { ok: local.valid && (!remote || remote.valid === true), local: { ...local, files: void 0 }, ...remote ? { remote } : {} };
   }
@@ -280,8 +1084,8 @@ async function execute(parsed) {
     const input = parsed.positionals[0];
     if (!input) throw new Error("pack requires a package directory");
     const data = await packPackage(input);
-    const output = resolve(flag(parsed, "output") || `${basename(resolve(input))}.agents24.zip`);
-    await writeFile(output, data);
+    const output = resolve3(flag(parsed, "output") || `${basename2(resolve3(input))}.agents24.zip`);
+    await writeFile3(output, data);
     return { ok: true, output, bytes: data.byteLength };
   }
   if (parsed.command === "export") {
@@ -297,141 +1101,42 @@ async function execute(parsed) {
     }
     const request = { selectors };
     const archive = await (await createRemoteClient()).resourcePackages.exportPackage(request);
-    const output = resolve(flag(parsed, "output") || archive.filename);
-    await writeFile(output, archive.data);
+    const output = resolve3(flag(parsed, "output") || archive.filename);
+    await writeFile3(output, archive.data);
     return { ok: true, output, bytes: archive.data.byteLength };
   }
-  if (parsed.command === "compile") {
-    const { result } = await compiledPackage(parsed);
-    const output = flag(parsed, "output");
-    if (output) await writeFile(resolve(output), `${JSON.stringify(result.bundle, null, 2)}
-`);
-    return { ok: result.valid === true, ...output ? { output: resolve(output) } : {}, result: safeResult(result) };
-  }
-  if (parsed.command === "preview" || parsed.command === "import" || parsed.command === "install") {
-    const app = parsed.command === "install" ? await resolveApp(parsed) : void 0;
-    const integration = parsed.command === "install" ? await resolveInstallMode(parsed, app) : void 0;
-    const apiKey = parsed.command === "install" ? await apiKeyForInstall(parsed) : void 0;
-    const client = apiKey ? await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey }) : await createRemoteClient();
-    const { result } = await compiledPackage(parsed, client);
-    if (result.valid !== true || !result.bundle || typeof result.bundle !== "object") throw new Error("Remote compilation did not produce a bundle");
+  if (parsed.command === "preview" || parsed.command === "import") {
+    const client = await createRemoteClient();
+    const { data, filename } = await packedValidatedPackage(parsed);
     const request = {
-      bundle: result.bundle,
+      data,
+      filename,
       mappings: mappings(parsed)
     };
-    let preview = await client.resourceBundles.importPreview(request);
-    request.mappings = await promptMappings(parsed, client, preview, request.mappings);
-    if (Object.keys(request.mappings).length) preview = await client.resourceBundles.importPreview(request);
+    let preview = await client.resourcePackages.importPreview(request);
+    request.mappings = await promptImportMappings(client, preview, request.mappings, interactive(parsed));
+    if (Object.keys(request.mappings).length) preview = await client.resourcePackages.importPreview(request);
     if (parsed.command === "preview") return { ok: preview.can_import === true, preview };
-    if (parsed.command === "install") assertInstallPreviewReady(preview);
     if (preview.can_import !== true) return { ok: false, preview };
     await confirmation(parsed, preview);
-    const imported = await client.resourceBundles.importBundle(request, { idempotencyKey: installKey(request.bundle, request.mappings) });
-    if (parsed.command === "import") return { ok: true, phase: "imported", preview, result: imported };
-    const agent = await selectInstalledAgent(parsed, imported);
-    if (importedRows(imported).some((row) => row.status === "incomplete") && flag(parsed, "allow-incomplete") !== "true") {
-      throw Object.assign(new Error("Publication is blocked by incomplete imported dependencies"), { phase: "post_import", imported });
-    }
-    try {
-      await client.agents.publish(String(agent.id), {
-        idempotencyKey: `publish-${createHash("sha256").update(`agent:${String(agent.id)}`).digest("hex").slice(0, 40)}`
-      });
-    } catch (error) {
-      throw Object.assign(error instanceof Error ? error : new Error("Agent publication failed"), {
-        phase: "publish",
-        imported
-      });
-    }
-    let deployment;
-    try {
-      if (integration === "client-deployment") deployment = await clientDeployment(parsed, client, agent, app);
-    } catch (error) {
-      throw Object.assign(error instanceof Error ? error : new Error("Client deployment setup failed"), {
-        phase: "deployment",
-        imported
-      });
-    }
-    const deploymentId = deployment && typeof deployment.client_id === "string" ? deployment.client_id : void 0;
-    let envFile;
-    if (app && flag(parsed, "no-write-env") !== "true" && integration !== "publish-only") {
-      try {
-        const localClientBaseUrl = integration === "client-deployment" ? clientAppBaseUrl() : void 0;
-        envFile = await updateEnvFile(app, integration === "client-deployment" ? {
-          VITE_AGENTS24_DEPLOYMENT_ID: String(deploymentId),
-          ...localClientBaseUrl ? { VITE_AGENTS24_BASE_URL: localClientBaseUrl } : {}
-        } : { AGENTS24_API_KEY: apiKey, AGENTS24_AGENT_ID: String(agent.id) });
-      } catch (error) {
-        throw Object.assign(error instanceof Error ? error : new Error("Could not configure the generated app"), {
-          phase: "env_write",
-          imported
-        });
-      }
-    }
-    const packageManager = app?.packageManager || "pnpm";
-    const nextCommand = app && integration !== "publish-only" ? packageManager === "npm" ? "npm run dev" : packageManager === "bun" ? "bun run dev" : `${packageManager} dev` : void 0;
-    return {
-      ok: true,
-      phase: deployment ? "deployed" : "published",
-      integration,
-      agent_id: String(agent.id),
-      ...deployment ? { deployment, deployment_id: deploymentId } : {},
-      env_written: Boolean(envFile),
-      ...envFile ? { env_file: envFile } : {},
-      ...nextCommand ? { next_command: nextCommand } : {},
-      preview,
-      result: imported
-    };
+    const packageHash = String(preview.package_hash || "");
+    if (!packageHash) throw new Error("Package preview did not return a package hash");
+    const imported = await client.resourcePackages.importPackage(request, { idempotencyKey: importKey(packageHash, request.mappings) });
+    return { ok: true, phase: "imported", preview, result: imported };
   }
   throw new Error(`Unknown package command: ${parsed.command}`);
 }
-function diagnostics(error) {
-  if (!error || typeof error !== "object") return void 0;
-  const record = error;
-  if (Array.isArray(record.diagnostics)) return record.diagnostics;
-  if (!record.details || typeof record.details !== "object" || Array.isArray(record.details)) return void 0;
-  const detail = record.details.detail;
-  if (!detail || typeof detail !== "object" || Array.isArray(detail)) return void 0;
-  const value = detail.diagnostics;
-  return Array.isArray(value) ? value : void 0;
-}
-function errorMessage(error, parsed) {
-  if (parsed?.command === "install" && error && typeof error === "object" && "status" in error && error.status === 403) {
-    return "This API key cannot install Agents. Create a new Agent integration API key in Settings; existing keys cannot gain additional scopes.";
-  }
-  return error instanceof Error ? error.message : "Unexpected CLI failure";
-}
-function installSummary(result) {
-  const lines = ["Agent installed and published.", `Agent ID: ${String(result.agent_id)}`];
-  if (result.deployment_id) lines.push(`Deployment ID: ${String(result.deployment_id)}`);
-  if (result.env_written) lines.push(`Configured: ${String(result.env_file)}`);
-  else if (result.integration !== "publish-only") lines.push("Environment configuration was not written.");
-  if (result.next_command) lines.push(`Next: ${String(result.next_command)}`);
-  return `${lines.join("\n")}
-`;
-}
 async function run(argv = process.argv.slice(2)) {
   let parsed;
   try {
-    parsed = parse(argv);
+    parsed = parseArguments(argv);
     const result = await execute(parsed);
-    if (flag(parsed, "json") === "true") process.stdout.write(`${JSON.stringify(result)}
-`);
-    else if (result.ok === false) process.stderr.write(`${JSON.stringify(result, null, 2)}
-`);
-    else if (parsed.command === "install") process.stdout.write(installSummary(result));
-    else process.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
+    writeResult(result, parsed);
     return result.ok === false ? 1 : 0;
   } catch (error) {
-    const payload = {
-      ok: false,
-      error: errorMessage(error, parsed),
-      ...error && typeof error === "object" && "phase" in error ? { phase: error.phase } : {},
-      ...error && typeof error === "object" && "imported" in error ? { import_result: error.imported } : {},
-      ...diagnostics(error) ? { diagnostics: diagnostics(error) } : {}
-    };
-    const body = parsed && flag(parsed, "json") === "true" ? JSON.stringify(payload) : JSON.stringify(payload, null, 2);
-    process.stderr.write(`${body}
+    const payload = failurePayload(error);
+    if (parsed) writeResult(payload, parsed);
+    else process.stderr.write(`${JSON.stringify(payload, null, 2)}
 `);
     return 1;
   }