@agents24/cli 0.2.0 → 0.3.0

package/dist/cli.js

@@ -2,30 +2,33 @@
 import {
   assertImportAllowed,
   createRemoteClient,
+  forkPackage,
   initializePackage,
   loadPackageFiles,
   packPackage,
+  packPackageSnapshot,
   parseMappings,
+  replacePackageFiles,
   shouldPromptForDependency,
   validatePackage
-} from "./chunk-NLUCQTMN.js";
+} from "./chunk-YOT3B62P.js";
 
 // src/cli.ts
-import { basename, join, resolve } from "path";
-import { chmod, mkdir, readFile, stat, writeFile } from "fs/promises";
-import { createInterface } from "readline/promises";
-import { createHash, createHmac, randomBytes } from "crypto";
+import { basename as basename2, dirname, join as join3, resolve as resolve3 } from "path";
+import { chmod as chmod2, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { createInterface as createInterface3 } from "readline/promises";
+import { createHash as createHash2 } from "crypto";
 import { spawn } from "child_process";
-import { hostname } from "os";
-import { parse as parseYaml } from "yaml";
 import { isCancel, password, select, text } from "@clack/prompts";
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["json", "remote", "yes", "allow-incomplete", "no-write-env", "prune"]);
-var LIFECYCLE_COMMANDS = /* @__PURE__ */ new Set(["prepare", "plan", "apply", "dev", "publish", "setup", "status", "link", "resources"]);
-var DEFAULT_API_BASE_URL = "https://api.agents24.dev";
-var DEFAULT_LOCAL_CLIENT_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
-function parse(argv) {
+
+// src/cli-arguments.ts
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["json", "remote", "yes", "allow-incomplete", "no-write-env", "prune", "apply"]);
+var LIFECYCLE_COMMANDS = /* @__PURE__ */ new Set(["prepare", "plan", "apply", "pull", "dev", "publish", "setup", "status", "link", "resources", "fork"]);
+function parseArguments(argv) {
   const lifecycle = LIFECYCLE_COMMANDS.has(argv[0]);
-  if (!lifecycle && (argv[0] !== "package" || !argv[1])) throw new Error("Usage: agents24 <prepare|plan|apply|dev|publish|setup|status|link|resources> | agents24 package <init|validate|pack|export|compile|preview|import>");
+  if (!lifecycle && (argv[0] !== "package" || !argv[1])) {
+    throw new Error("Usage: agents24 <prepare|plan|apply|pull|dev|publish|setup|status|link|resources|fork> | agents24 package <init|validate|pack|export|preview|import>");
+  }
   const flags = /* @__PURE__ */ new Map();
   const positionals = [];
   for (let index = lifecycle ? 1 : 2; index < argv.length; index += 1) {
@@ -51,11 +54,76 @@ function flag(parsed, name) {
 function values(parsed, name) {
   return parsed.flags.get(name) || [];
 }
-function mappings(parsed) {
-  return parseMappings(values(parsed, "map"));
+
+// src/cli-output.ts
+var sensitiveValues = /* @__PURE__ */ new Set();
+function registerSensitiveValue(value) {
+  if (value.length >= 8) sensitiveValues.add(value);
+}
+function redactText(value) {
+  let result = value;
+  for (const secret of sensitiveValues) result = result.split(secret).join("[REDACTED]");
+  return result;
+}
+function sanitize(value) {
+  if (typeof value === "string") return redactText(value);
+  if (Array.isArray(value)) return value.map(sanitize);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [key, sanitize(item)])
+  );
+}
+function readDiagnostics(value) {
+  return Array.isArray(value) ? value : void 0;
+}
+function diagnostics(error) {
+  if (!error || typeof error !== "object") return void 0;
+  const record = error;
+  const fromError = readDiagnostics(record.diagnostics);
+  if (fromError) return fromError;
+  if (!record.details || typeof record.details !== "object" || Array.isArray(record.details)) return void 0;
+  const details = record.details;
+  const fromDetails = readDiagnostics(details.diagnostics);
+  if (fromDetails) return fromDetails;
+  const nested = details.detail;
+  if (!nested || typeof nested !== "object" || Array.isArray(nested)) return void 0;
+  return readDiagnostics(nested.diagnostics);
+}
+function failurePayload(error) {
+  const diagnosticList = diagnostics(error);
+  return {
+    ok: false,
+    error: redactText(error instanceof Error ? error.message : "Unexpected CLI failure"),
+    ...error && typeof error === "object" && "phase" in error ? { phase: error.phase } : {},
+    ...error && typeof error === "object" && "imported" in error ? { import_result: error.imported } : {},
+    ...diagnosticList ? { diagnostics: diagnosticList } : {}
+  };
+}
+function writeResult(result, parsed) {
+  const compact = flag(parsed, "json") === "true";
+  const safeResult = sanitize(result);
+  const body = compact ? JSON.stringify(safeResult) : JSON.stringify(safeResult, null, 2);
+  const stream = result.ok === false ? process.stderr : process.stdout;
+  stream.write(`${body}
+`);
+}
+
+// src/cli-installation-state.ts
+import { basename, join, resolve } from "path";
+import { readFile, stat, writeFile } from "fs/promises";
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+  return JSON.stringify(value);
 }
-function upload(data, input) {
-  return { data, filename: basename(input).endsWith(".zip") ? basename(input) : "resource.agents24.zip" };
+function isNotFoundResponse(error) {
+  return Boolean(error && typeof error === "object" && "status" in error && Number(error.status) === 404);
+}
+function packageUpload(data, input) {
+  return {
+    data,
+    filename: basename(input).endsWith(".zip") ? basename(input) : "resource.agents24.zip"
+  };
 }
 async function packageDirectory(input) {
   try {
@@ -64,31 +132,6 @@ async function packageDirectory(input) {
     return void 0;
   }
 }
-async function installationId(input) {
-  const explicit = String(process.env.AGENTS24_INSTALLATION_ID || "").trim();
-  if (explicit) return explicit;
-  const directory = await packageDirectory(input);
-  if (!directory) return void 0;
-  try {
-    return (await readFile(join(directory, ".agents24/installation-id"), "utf8")).trim() || void 0;
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
-  }
-}
-async function writeInstallationId(input, id) {
-  if (String(process.env.AGENTS24_INSTALLATION_ID || "").trim()) return void 0;
-  const directory = await packageDirectory(input);
-  if (!directory) return void 0;
-  const stateDirectory = join(directory, ".agents24");
-  await mkdir(stateDirectory, { recursive: true, mode: 448 });
-  const target = join(stateDirectory, "installation-id");
-  await writeFile(target, `${id}
-`, { mode: 384 });
-  await chmod(target, 384);
-  await ensureIgnored(directory, [".agents24/", ".env.local"]);
-  return target;
-}
 async function ensureIgnored(directory, entries) {
   const target = join(directory, ".gitignore");
   let current = "";
@@ -104,6 +147,12 @@ async function ensureIgnored(directory, entries) {
   await writeFile(target, `${current}${separator}${missing.join("\n")}
 `);
 }
+
+// src/cli-secrets.ts
+import { randomBytes } from "crypto";
+import { chmod, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+import { parse as parseYaml } from "yaml";
 function parseEnv(textValue) {
   const result = {};
   for (const line of textValue.split(/\r?\n/)) {
@@ -118,7 +167,7 @@ function parseEnv(textValue) {
   }
   return result;
 }
-async function packageSecretRequirements(input) {
+async function requirements(input) {
   const files = await loadPackageFiles(input);
   const manifest = parseYaml(files.get("agents24.yaml") || "");
   const requires = manifest.requires && typeof manifest.requires === "object" ? manifest.requires : {};
@@ -135,10 +184,10 @@ async function preparePackage(input) {
   if (!directory) throw new Error("prepare requires a Resource Package directory");
   const local = await validatePackage(input);
   if (!local.valid) throw Object.assign(new Error("Resource package is invalid"), { diagnostics: local.diagnostics });
-  const target = join(directory, ".env.local");
+  const target = join2(directory, ".env.local");
   let current = "";
   try {
-    current = await readFile(target, "utf8");
+    current = await readFile2(target, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -146,7 +195,7 @@ async function preparePackage(input) {
   const generated = [];
   const preserved = [];
   let next = current;
-  for (const requirement of await packageSecretRequirements(input)) {
+  for (const requirement of await requirements(input)) {
     if (values2[requirement.env] || process.env[requirement.env]) {
       preserved.push(requirement.env);
       continue;
@@ -157,9 +206,9 @@ async function preparePackage(input) {
 `;
     generated.push(requirement.env);
   }
-  await writeFile(target, next, { mode: 384 });
+  await writeFile2(target, next, { mode: 384 });
   await chmod(target, 384);
-  await ensureIgnored(directory, [".env.local", ".agents24/"]);
+  await ensureIgnored(directory, [".env.local"]);
   return { ok: true, package: directory, env_file: target, generated, preserved };
 }
 async function secretValues(input) {
@@ -167,21 +216,341 @@ async function secretValues(input) {
   let local = {};
   if (directory) {
     try {
-      local = parseEnv(await readFile(join(directory, ".env.local"), "utf8"));
+      local = parseEnv(await readFile2(join2(directory, ".env.local"), "utf8"));
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
   }
   const result = {};
-  for (const requirement of await packageSecretRequirements(input)) {
+  for (const requirement of await requirements(input)) {
     const value = String(process.env[requirement.env] || local[requirement.env] || "");
     if (value) result[requirement.key] = value;
   }
   return result;
 }
-function safeResult(result) {
+
+// src/cli-pull.ts
+import { createInterface } from "readline/promises";
+async function confirmPull(parsed, plan) {
+  if (flag(parsed, "yes") === "true") return;
+  if (flag(parsed, "json") === "true") throw new Error("pull requires --yes with --json");
+  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("pull requires --yes in noninteractive mode");
+  const files = Array.isArray(plan.files) ? plan.files : [];
+  for (const item of files) process.stdout.write(`${String(item.status || "M")}  ${String(item.path || "")}
+`);
+  const summary = plan.summary && typeof plan.summary === "object" ? plan.summary : {};
+  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await prompt.question(
+    `Pull platform drafts (${summary.files_added || 0} added, ${summary.files_modified || 0} modified, ${summary.files_removed || 0} removed)? [y/N] `
+  );
+  prompt.close();
+  if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Pull cancelled");
+}
+async function pullPackage(options) {
+  const { parsed, input, client, installationId } = options;
+  const preview = await client.resourceInstallations.planPull(
+    installationId,
+    packageUpload(await packPackageSnapshot(input), input)
+  );
+  const plan = preview.plan && typeof preview.plan === "object" ? preview.plan : {};
+  await confirmPull(parsed, plan);
+  const pullId = String(preview.pull_id || "");
+  const payload = await client.resourceInstallations.downloadPull(installationId, pullId);
+  if (payload.platform_snapshot_hash !== preview.platform_snapshot_hash || payload.package_hash !== preview.package_hash || !payload.files || typeof payload.files !== "object" || Array.isArray(payload.files)) throw new Error("Pulled package snapshot does not match its preview");
+  let accepted = {};
+  await replacePackageFiles(input, payload.files, async () => {
+    accepted = await client.resourceInstallations.acceptPull(
+      installationId,
+      pullId,
+      {
+        platform_snapshot_hash: String(preview.platform_snapshot_hash || ""),
+        package_hash: String(preview.package_hash || "")
+      },
+      { idempotencyKey: `pull-${pullId}` }
+    );
+  });
+  return {
+    ok: true,
+    phase: "pulled",
+    installation_id: installationId,
+    pull_id: preview.pull_id,
+    package_hash: preview.package_hash,
+    summary: plan.summary || {},
+    files: Array.isArray(plan.files) ? plan.files : [],
+    status: accepted.status
+  };
+}
+
+// src/cli-status.ts
+async function installedPackageStatus(input, client, status) {
+  const callableBindings = Array.isArray(status.callable_bindings) ? status.callable_bindings : [];
+  const publicationCurrent = status.publication_state === "current";
+  const healthy = callableBindings.filter((item) => item.draft_status === "attached" && (!publicationCurrent || item.published_status === "attached")).length;
+  const compiled = await client.resourcePackages.validatePackage(
+    packageUpload(await packPackage(input), input)
+  );
+  const localPackageHash = typeof compiled.package_hash === "string" ? compiled.package_hash : null;
+  return {
+    ok: true,
+    installed: true,
+    binding_summary: {
+      total: callableBindings.length,
+      healthy,
+      unhealthy: callableBindings.length - healthy
+    },
+    synchronization: {
+      direction: status.last_sync_direction || null,
+      synchronized_at: status.last_synchronized_at || null,
+      synchronized_package_hash: status.synchronized_package_hash || null,
+      local_package_hash: localPackageHash,
+      diverged: Boolean(localPackageHash && status.synchronized_package_hash && localPackageHash !== status.synchronized_package_hash)
+    },
+    installation: status
+  };
+}
+
+// src/cli-requirements.ts
+import { createHash } from "crypto";
+import { createInterface as createInterface2 } from "readline/promises";
+async function promptImportMappings(client, preview, current, enabled) {
+  if (!enabled) return current;
+  const dependencies = Array.isArray(preview.dependencies) ? preview.dependencies.filter((item) => Boolean(item && typeof item === "object" && item.status === "unresolved")) : [];
+  const unique = new Map(dependencies.map((item) => [String(item.requirement_key || item.id), item]));
+  if (!unique.size) return current;
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
+  try {
+    const next = { ...current };
+    for (const [key, dependency] of unique) {
+      if (!shouldPromptForDependency(dependency)) continue;
+      if (dependency.kind === "secret") {
+        const answer2 = await prompt.question(`${dependency.source_name || key} secret ($secret:name, blank to omit): `);
+        if (answer2.trim()) next[key] = answer2.trim();
+        continue;
+      }
+      const response = await client.resourcePackages.candidates({
+        kind: String(dependency.kind),
+        query: String(dependency.source_name || ""),
+        requiredCapability: dependency.required_capability === "embedding" ? "embedding" : dependency.required_capability === "chat" ? "chat" : void 0
+      });
+      const candidates = Array.isArray(response.items) ? response.items : [];
+      process.stdout.write(`${dependency.source_name || key}: ${candidates.map((item, index) => `${index + 1}) ${item.name}`).join("  ")}
+`);
+      const answer = await prompt.question("Choose a candidate number (blank to omit): ");
+      const selected = candidates[Number(answer) - 1];
+      if (selected?.id) next[key] = String(selected.id);
+    }
+    return next;
+  } finally {
+    prompt.close();
+  }
+}
+async function promptInstallationRequirementLinks(client, installationId, plan, enabled) {
+  if (!enabled) return false;
+  const requirements2 = Array.isArray(plan.external_requirements) ? plan.external_requirements.filter((item) => Boolean(
+    item && typeof item === "object" && item.required === true && item.configured !== true && !["model", "secret"].includes(String(item.kind))
+  )) : [];
+  if (!requirements2.length) return false;
+  const prompt = createInterface2({ input: process.stdin, output: process.stdout });
+  let linked = false;
+  try {
+    for (const requirement of requirements2) {
+      const key = String(requirement.requirement_key || "");
+      const response = await client.resourcePackages.candidates({ kind: String(requirement.kind), query: String(requirement.name || "") });
+      const candidates = Array.isArray(response.items) ? response.items : [];
+      process.stdout.write(`${requirement.name || key}: ${candidates.map((item, index) => `${index + 1}) ${item.name}`).join("  ")}
+`);
+      const answer = await prompt.question("Choose a candidate number (blank to leave unresolved): ");
+      const selected = candidates[Number(answer) - 1];
+      if (!selected?.id) continue;
+      await client.resourceInstallations.link(installationId, { resource_key: key, resource_id: String(selected.id) }, {
+        idempotencyKey: `link-${createHash("sha256").update(`${installationId}:${key}:${selected.id}`).digest("hex").slice(0, 40)}`
+      });
+      linked = true;
+    }
+    return linked;
+  } finally {
+    prompt.close();
+  }
+}
+
+// src/cli-development.ts
+import { createHmac } from "crypto";
+import { hostname } from "os";
+import { resolve as resolve2 } from "path";
+import { parse as parseYaml2 } from "yaml";
+var DEFAULT_API_BASE_URL = "https://api.agents24.dev";
+var MANIFEST_POLL_INTERVAL_MS = 2e3;
+async function developmentArtifacts(input) {
+  const directory = await packageDirectory(input);
+  if (!directory) throw new Error("dev requires a Resource Package directory");
+  const files = await loadPackageFiles(input);
+  const manifest = parseYaml2(files.get("agents24.yaml") || "");
+  const resources = Array.isArray(manifest.resources) ? manifest.resources : [];
+  const requires = manifest.requires && typeof manifest.requires === "object" ? manifest.requires : {};
+  const requiredSecrets = requires.secrets && typeof requires.secrets === "object" ? requires.secrets : {};
+  const result = [];
+  for (const resource of resources) {
+    const path = String(resource.path || "");
+    if (!/^artifacts\/[a-z0-9][a-z0-9-]*\/artifact\.yaml$/.test(path)) continue;
+    const sourceText = files.get(path);
+    if (!sourceText) continue;
+    const source = parseYaml2(sourceText);
+    if (source.execution_target !== "self_hosted") continue;
+    const development = source.development && typeof source.development === "object" ? source.development : void 0;
+    if (!development) continue;
+    const server = source.server && typeof source.server === "object" ? source.server : {};
+    const auth = server.auth && typeof server.auth === "object" ? server.auth : {};
+    const secretRequirement = String(auth.secret || "");
+    const secretKey = secretRequirement.startsWith("$secrets.") ? secretRequirement.slice("$secrets.".length) : "";
+    const secretDeclaration = secretKey && requiredSecrets[secretKey] && typeof requiredSecrets[secretKey] === "object" ? requiredSecrets[secretKey] : void 0;
+    const cwd = resolve2(directory, String(development.cwd || "."));
+    if (cwd !== directory && !cwd.startsWith(`${directory}/`)) throw new Error(`Artifact ${resource.key} development.cwd must remain inside the package`);
+    result.push({
+      key: String(resource.key || ""),
+      baseUrl: String(development.base_url || ""),
+      command: development.command ? String(development.command) : void 0,
+      args: Array.isArray(development.args) ? development.args.map(String) : [],
+      cwd,
+      protocol: {
+        manifest_path: server.manifest_path,
+        health_path: server.health_path,
+        verify_path: server.verify_path,
+        invoke_path: server.invoke_path,
+        auth_mode: auth.mode,
+        signing_secret_requirement: auth.secret
+      },
+      signingSecretEnv: secretDeclaration?.env ? String(secretDeclaration.env) : void 0
+    });
+  }
   return result;
 }
+async function waitForServer(baseUrl, healthPath) {
+  const target = new URL(String(healthPath || "/.well-known/agents24/artifact/health"), baseUrl);
+  for (let attempt = 0; attempt < 60; attempt += 1) {
+    try {
+      const response = await fetch(target);
+      if (response.ok) return;
+    } catch {
+    }
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, 250));
+  }
+  throw new Error(`Local Artifact server did not become healthy at ${target}`);
+}
+async function openDevelopmentRelay(client, installationIdValue, artifact, localEnv) {
+  const admission = await client.resourceInstallations.prepareDevelopmentSession(installationIdValue, {
+    resource_key: artifact.key,
+    machine_label: hostname()
+  });
+  const apiUrl = new URL(String(process.env.AGENTS24_BASE_URL || DEFAULT_API_BASE_URL));
+  apiUrl.protocol = apiUrl.protocol === "https:" ? "wss:" : "ws:";
+  apiUrl.pathname = String(admission.relay_path);
+  const socket = new WebSocket(apiUrl, [
+    "agents24-artifact-relay",
+    `agents24-credential-${String(admission.relay_token)}`
+  ]);
+  const state = {};
+  let manifestHash;
+  let pendingHash;
+  let polling = false;
+  const manifestUrl = new URL(String(artifact.protocol.manifest_path || "/.well-known/agents24/artifact"), artifact.baseUrl);
+  const localManifestHash = async () => {
+    const response = await fetch(manifestUrl);
+    if (!response.ok) throw new Error("Local Artifact manifest is unavailable");
+    return canonicalJson(await response.json());
+  };
+  const pollManifest = async () => {
+    if (polling || socket.readyState !== WebSocket.OPEN || pendingHash !== void 0) return;
+    polling = true;
+    try {
+      const nextHash = await localManifestHash();
+      if (manifestHash !== void 0 && nextHash === manifestHash) return;
+      if (manifestHash === void 0) {
+        manifestHash = nextHash;
+        return;
+      }
+      pendingHash = nextHash;
+      socket.send(JSON.stringify({ type: "manifest_changed" }));
+    } catch {
+      pendingHash = "unavailable";
+      socket.send(JSON.stringify({ type: "manifest_changed" }));
+    } finally {
+      polling = false;
+    }
+  };
+  await new Promise((resolveReady, rejectReady) => {
+    socket.addEventListener("error", () => rejectReady(new Error(`Artifact relay failed for ${artifact.key}`)), { once: true });
+    socket.addEventListener("message", async (event) => {
+      const message = JSON.parse(String(event.data));
+      if (message.type === "ready") {
+        try {
+          manifestHash = await localManifestHash();
+        } catch {
+          manifestHash = void 0;
+        }
+        resolveReady();
+        return;
+      }
+      if (message.type === "manifest_refreshed") {
+        if (pendingHash && pendingHash !== "unavailable") manifestHash = pendingHash;
+        pendingHash = void 0;
+        return;
+      }
+      if (message.type === "manifest_refresh_failed") {
+        pendingHash = void 0;
+        return;
+      }
+      if (message.type === "superseded" || message.type === "revoked") {
+        state.terminalReason = String(message.type);
+        socket.close();
+        return;
+      }
+      if (message.type !== "request") return;
+      const method = message.operation === "health" || message.operation === "manifest" ? "GET" : "POST";
+      try {
+        const requestBody = method === "POST" ? JSON.stringify(message.body || {}) : void 0;
+        const headers = method === "POST" ? { "content-type": "application/json" } : {};
+        if (method === "POST" && String(artifact.protocol.auth_mode || "hmac_sha256") === "hmac_sha256") {
+          const signingSecret = String(
+            artifact.signingSecretEnv && (localEnv[artifact.signingSecretEnv] || process.env[artifact.signingSecretEnv]) || ""
+          );
+          if (!signingSecret) throw new Error(`Artifact ${artifact.key} signing secret is unavailable`);
+          const timestamp = String(Date.now());
+          const signature = createHmac("sha256", signingSecret).update(`${timestamp}.${requestBody}`).digest("hex");
+          headers["x-agents24-timestamp"] = timestamp;
+          headers["x-agents24-signature"] = `sha256=${signature}`;
+        }
+        const response = await fetch(new URL(String(message.path || "/"), artifact.baseUrl), { method, headers, body: requestBody });
+        const textBody = await response.text();
+        let body = textBody;
+        try {
+          body = textBody ? JSON.parse(textBody) : null;
+        } catch {
+        }
+        socket.send(JSON.stringify({ type: "response", request_id: message.request_id, status: response.status, body }));
+      } catch {
+        socket.send(JSON.stringify({ type: "response", request_id: message.request_id, status: 502, body: { status: "failed" } }));
+      }
+    });
+    const heartbeat = setInterval(() => {
+      if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify({ type: "heartbeat" }));
+    }, 15e3);
+    const manifestPoll = setInterval(() => {
+      void pollManifest();
+    }, MANIFEST_POLL_INTERVAL_MS);
+    socket.addEventListener("close", () => {
+      clearInterval(heartbeat);
+      clearInterval(manifestPoll);
+    }, { once: true });
+  });
+  return { sessionId: String(admission.id), socket, state };
+}
+
+// src/cli.ts
+var DEFAULT_API_BASE_URL2 = "https://api.agents24.dev";
+var DEFAULT_LOCAL_CLIENT_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
+function mappings(parsed) {
+  return parseMappings(values(parsed, "map"));
+}
 async function confirmation(parsed, preview) {
   const resources = Array.isArray(preview.resources) ? preview.resources : [];
   const yes = flag(parsed, "yes") === "true";
@@ -191,7 +560,7 @@ async function confirmation(parsed, preview) {
     interactive: Boolean(process.stdin.isTTY && process.stdout.isTTY)
   });
   if (yes) return;
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const prompt = createInterface3({ input: process.stdin, output: process.stdout });
   const answer = await prompt.question(`Import ${resources.length} resource draft(s)? [y/N] `);
   prompt.close();
   if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Import cancelled");
@@ -201,7 +570,7 @@ async function applyConfirmation(parsed, plan) {
   if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("apply requires --yes in noninteractive mode");
   const actions = Array.isArray(plan.actions) ? plan.actions.length : 0;
   const removals = Array.isArray(plan.content) ? plan.content.reduce((count, item) => count + (Array.isArray(item.remove) ? item.remove.length : 0), 0) : 0;
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
+  const prompt = createInterface3({ input: process.stdin, output: process.stdout });
   const answer = await prompt.question(`Apply ${actions} resource action(s)${removals ? ` and ${removals} content removal(s)` : ""}? [y/N] `);
   prompt.close();
   if (!/^y(?:es)?$/i.test(answer.trim())) throw new Error("Apply cancelled");
@@ -216,57 +585,16 @@ async function pollOperation(client, operation) {
   }
   throw new Error("Resource apply did not finish within 15 minutes");
 }
-async function promptMappings(parsed, client, preview, current) {
-  if (!process.stdin.isTTY || !process.stdout.isTTY || flag(parsed, "yes") === "true") return current;
-  const dependencies = Array.isArray(preview.dependencies) ? preview.dependencies.filter((item) => Boolean(item && typeof item === "object" && item.status === "unresolved")) : [];
-  const unique = new Map(dependencies.map((item) => [String(item.requirement_key || item.id), item]));
-  if (!unique.size) return current;
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const next = { ...current };
-    for (const [key, dependency] of unique) {
-      if (!shouldPromptForDependency(dependency)) {
-        continue;
-      }
-      if (dependency.kind === "secret") {
-        const answer2 = await prompt.question(`${dependency.source_name || key} secret ($secret:name, blank to omit): `);
-        if (answer2.trim()) next[key] = answer2.trim();
-        continue;
-      }
-      const response = await client.resourceBundles.candidates({
-        kind: String(dependency.kind),
-        query: String(dependency.source_name || ""),
-        requiredCapability: dependency.required_capability === "embedding" ? "embedding" : dependency.required_capability === "chat" ? "chat" : void 0
-      });
-      const candidates = Array.isArray(response.items) ? response.items : [];
-      process.stdout.write(`${dependency.source_name || key}: ${candidates.map((item, index) => `${index + 1}) ${item.name}`).join("  ")}
-`);
-      const answer = await prompt.question("Choose a candidate number (blank to omit): ");
-      const selected = candidates[Number(answer) - 1];
-      if (selected?.id) next[key] = String(selected.id);
-    }
-    return next;
-  } finally {
-    prompt.close();
-  }
-}
-async function compiledPackage(parsed, client) {
+async function packedValidatedPackage(parsed) {
   const input = parsed.positionals[0];
   if (!input) throw new Error(`${parsed.command} requires a package directory or ZIP`);
   const local = await validatePackage(input);
   if (!local.valid) throw Object.assign(new Error("Resource package is invalid"), { diagnostics: local.diagnostics });
   const data = await packPackage(input);
-  const remoteClient = client || await createRemoteClient();
-  const result = await remoteClient.resourcePackages.compilePackage(upload(data, input));
-  return { data, result };
-}
-function canonical(value) {
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
-  return JSON.stringify(value);
+  return { data, filename: `${basename2(resolve3(input))}.agents24.zip` };
 }
-function importKey(bundle, map) {
-  return `import-${createHash("sha256").update(canonical({ bundle, mappings: map })).digest("hex").slice(0, 40)}`;
+function importKey(packageHash, map) {
+  return `import-${createHash2("sha256").update(canonicalJson({ package_hash: packageHash, mappings: map })).digest("hex").slice(0, 40)}`;
 }
 function interactive(parsed) {
   return flag(parsed, "yes") !== "true" && Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -275,6 +603,7 @@ function cancelled(value) {
   if (isCancel(value)) throw new Error("Installation cancelled");
 }
 async function apiKeyForLifecycle(parsed) {
+  await loadPackageLifecycleEnvironment(parsed.positionals[0]);
   let apiKey = String(process.env.AGENTS24_API_KEY || "").trim();
   if (!apiKey && interactive(parsed)) {
     const answer = await password({ message: "Agents24 API key", validate: (value) => String(value || "").trim() ? void 0 : "The API key is required." });
@@ -283,11 +612,37 @@ async function apiKeyForLifecycle(parsed) {
   }
   if (!apiKey) throw new Error("AGENTS24_API_KEY is required for noninteractive resource management");
   if (/[\r\n\0]/.test(apiKey)) throw new Error("AGENTS24_API_KEY contains invalid control characters");
+  registerSensitiveValue(apiKey);
   return apiKey;
 }
+async function loadPackageLifecycleEnvironment(input) {
+  if (!input) return;
+  const directory = await packageDirectory(input);
+  if (!directory) return;
+  for (const path of [join3(dirname(directory), ".env.local"), join3(directory, ".env.local")]) {
+    try {
+      const values2 = parseEnv(await readFile3(path, "utf8"));
+      for (const [name, value] of Object.entries(values2)) {
+        if (!process.env[name]) process.env[name] = value;
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+}
+function publicationProjection(publication) {
+  return {
+    installation_id: publication.installation_id,
+    operation_id: publication.operation_id,
+    package_hash: publication.package_hash,
+    status: publication.status,
+    ...publication.published_at ? { published_at: publication.published_at } : {},
+    ...publication.client_deployment_id ? { client_deployment_id: publication.client_deployment_id } : {}
+  };
+}
 function clientAppBaseUrl(environment = process.env) {
   const baseUrl = String(environment.AGENTS24_BASE_URL || "").trim().replace(/\/+$/, "");
-  if (!baseUrl || baseUrl === DEFAULT_API_BASE_URL) return void 0;
+  if (!baseUrl || baseUrl === DEFAULT_API_BASE_URL2) return void 0;
   let parsed;
   try {
     parsed = new URL(baseUrl);
@@ -300,9 +655,9 @@ function clientAppBaseUrl(environment = process.env) {
   return baseUrl;
 }
 async function appInfoAt(directory, explicit) {
-  const target = resolve(directory);
+  const target = resolve3(directory);
   try {
-    const manifest = JSON.parse(await readFile(join(target, "package.json"), "utf8"));
+    const manifest = JSON.parse(await readFile3(join3(target, "package.json"), "utf8"));
     const metadata = manifest.agents24 && typeof manifest.agents24 === "object" ? manifest.agents24 : {};
     const integration = String(metadata.integration || "");
     if (integration !== "client-deployment" && integration !== "bff") {
@@ -365,66 +720,106 @@ async function clientDeployment(parsed, client, agent, app) {
     allowed_origins: origins,
     ...oidcRaw ? { oidc: JSON.parse(oidcRaw) } : {}
   };
-  return client.clientDeployments.create(request, { idempotencyKey: `deploy-${createHash("sha256").update(canonical(request)).digest("hex").slice(0, 40)}` });
+  return client.clientDeployments.create(request, { idempotencyKey: `deploy-${createHash2("sha256").update(canonicalJson(request)).digest("hex").slice(0, 40)}` });
 }
 async function updateEnvFile(app, values2) {
-  const target = join(app.directory, ".env.local");
+  const target = join3(app.directory, ".env.local");
   let content = "";
   try {
-    content = await readFile(target, "utf8");
+    content = await readFile3(target, "utf8");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
   let next = content;
   for (const [name, value] of Object.entries(values2)) {
-    const line = `${name}=${JSON.stringify(value)}`;
+    const line = `${name}=${typeof value === "string" ? JSON.stringify(value) : value.value}`;
     const pattern = new RegExp(`^${name}=.*$`, "m");
     next = pattern.test(next) ? next.replace(pattern, line) : `${next}${next && !next.endsWith("\n") ? "\n" : ""}${line}
 `;
   }
-  await writeFile(target, next, { mode: 384 });
-  await chmod(target, 384);
+  await writeFile3(target, next, { mode: 384 });
+  await chmod2(target, 384);
   return target;
 }
+function primaryAgentAlias(applied) {
+  const aliases = Array.isArray(applied.agent.aliases) ? applied.agent.aliases : [];
+  const agentAlias = String(aliases[0] || applied.result.primary_agent_alias || "");
+  if (!agentAlias) throw new Error("Apply completed without a primary Agent alias");
+  return agentAlias;
+}
+function bffApplicationValues(applied) {
+  const agentAlias = primaryAgentAlias(applied);
+  return {
+    AGENTS24_API_KEY: applied.apiKey,
+    AGENTS24_AGENTS: { value: JSON.stringify([{ agentAlias }]), literal: true }
+  };
+}
+async function packageIdentity(input, requireValid = true) {
+  const result = await validatePackage(input);
+  const packageId = String(result.package.package_id || "");
+  if (!/^pkg_[0-9a-f]{32}$/.test(packageId)) {
+    throw new Error("Resource Package is missing a valid package_id; create an independent package with agents24 fork <source> <target>");
+  }
+  if (requireValid && !result.valid) throw Object.assign(new Error("Resource package is invalid"), { diagnostics: result.diagnostics });
+  return { packageId, packageName: String(result.package.name || "") };
+}
+async function resolveInstallation(input, client, requireValid = true) {
+  const { packageId } = await packageIdentity(input, requireValid);
+  return client.resourceInstallations.getByPackageId(packageId);
+}
+function blockedPlanMessage(plan) {
+  const blockers = Array.isArray(plan.blockers) ? plan.blockers.filter((item) => Boolean(item && typeof item === "object")) : [];
+  if (!blockers.length) return "The Resource Package plan is blocked";
+  const details = blockers.map((blocker) => {
+    const resource = String(blocker.resource_key || blocker.requirement_key || "").trim();
+    const guidance = String(blocker.guidance || "").trim();
+    const code = String(blocker.code || "PLAN_BLOCKED").trim();
+    return `${code}${resource ? ` (${resource})` : ""}${guidance ? `: ${guidance}` : ""}`;
+  });
+  return `The Resource Package plan is blocked: ${details.join("; ")}`;
+}
 async function ensureInstallation(input, client, data) {
-  const current = await installationId(input);
-  if (current) return current;
-  const initial = await client.resourceInstallations.plan(upload(data, input));
+  const identity = await packageIdentity(input);
+  const initial = await client.resourceInstallations.plan(packageUpload(data, input));
+  if (initial.installation_id) return String(initial.installation_id);
   const created = await client.resourceInstallations.create(
-    { package_name: String(initial.package_name), operation_id: String(initial.operation_id) },
-    { idempotencyKey: `installation-${String(initial.package_hash).slice(0, 40)}` }
+    { package_id: identity.packageId, package_name: String(initial.package_name), operation_id: String(initial.operation_id) },
+    { idempotencyKey: `installation-${identity.packageId}` }
   );
-  const id = String(created.id);
-  await writeInstallationId(input, id);
-  return id;
+  return String(created.id);
 }
 async function applyDraft(parsed, options = {}) {
   const input = parsed.positionals[0];
   if (!input) throw new Error(`${parsed.command} requires a Resource Package directory or ZIP`);
-  const apiKey = await apiKeyForLifecycle(parsed);
-  const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+  await packageIdentity(input);
+  const apiKey = options.apiKey || await apiKeyForLifecycle(parsed);
+  const client = options.client || await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
   const data = await packPackage(input);
-  const currentId = await installationId(input);
-  const plan = await client.resourceInstallations.plan({
-    ...upload(data, input),
-    ...currentId ? { installationId: currentId } : {},
-    prune: flag(parsed, "prune") === "true",
-    development: options.development === true
+  let plan = await client.resourceInstallations.plan({
+    ...packageUpload(data, input),
+    prune: flag(parsed, "prune") === "true"
   });
-  if (plan.can_apply !== true) throw Object.assign(new Error("The Resource Package plan is blocked"), { plan });
+  if (plan.can_apply !== true && interactive(parsed)) {
+    const installationId = await ensureInstallation(input, client, data);
+    if (await promptInstallationRequirementLinks(client, installationId, plan, true)) {
+      plan = await client.resourceInstallations.plan({
+        ...packageUpload(data, input),
+        prune: flag(parsed, "prune") === "true"
+      });
+    }
+  }
+  if (plan.can_apply !== true) throw Object.assign(new Error(blockedPlanMessage(plan)), { plan });
   if (!options.skipConfirmation) await applyConfirmation(parsed, plan);
   const secrets = await secretValues(input);
   let operation = await client.resourceInstallations.apply(String(plan.operation_id), {
     primary_resource_key: flag(parsed, "agent"),
     integration_mode: options.integrationMode || flag(parsed, "integration") || "publish-only",
-    secrets,
-    ...options.developmentSessions ? { development_sessions: options.developmentSessions } : {}
+    secrets
   }, { idempotencyKey: `apply-${String(plan.package_hash).slice(0, 40)}` });
   operation = await pollOperation(client, operation);
   if (operation.status !== "completed") throw Object.assign(new Error("Draft apply failed"), { operation });
   const installationIdValue = String(operation.installation_id || "");
   if (!installationIdValue) throw new Error("Apply completed without an installation ID");
-  await writeInstallationId(input, installationIdValue);
   const result = operation.result && typeof operation.result === "object" ? operation.result : {};
   const agentId = String(result.primary_agent_id || "");
   const resources = Array.isArray(result.resources) ? result.resources : [];
@@ -434,164 +829,72 @@ async function applyDraft(parsed, options = {}) {
 async function publishDraft(parsed, applied) {
   const input = applied?.input || parsed.positionals[0];
   if (!input) throw new Error("publish requires a Resource Package directory or ZIP");
+  await packageIdentity(input);
   const apiKey = applied?.apiKey || await apiKeyForLifecycle(parsed);
   const client = applied?.client || await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
-  const id = applied?.installationId || await installationId(input);
-  if (!id) throw new Error("No installation is linked; run agents24 apply first");
+  const installed = applied ? void 0 : await resolveInstallation(input, client);
+  const id = applied?.installationId || String(installed?.id || "");
+  if (!id) throw new Error("No installation exists for this package_id; run agents24 apply first");
   const data = await packPackage(input);
-  const plan = applied?.plan || await client.resourceInstallations.plan({ ...upload(data, input), installationId: id });
+  const plan = applied?.plan || await client.resourceInstallations.plan(packageUpload(data, input));
   const publication = await client.resourceInstallations.publish(id, { package_hash: String(plan.package_hash) }, {
     idempotencyKey: `publish-${String(plan.package_hash).slice(0, 40)}`
   });
-  return { publication, client, apiKey, input, installation_id: id, plan };
-}
-async function developmentArtifacts(input) {
-  const directory = await packageDirectory(input);
-  if (!directory) throw new Error("dev requires a Resource Package directory");
-  const files = await loadPackageFiles(input);
-  const manifest = parseYaml(files.get("agents24.yaml") || "");
-  const resources = Array.isArray(manifest.resources) ? manifest.resources : [];
-  const requires = manifest.requires && typeof manifest.requires === "object" ? manifest.requires : {};
-  const requiredSecrets = requires.secrets && typeof requires.secrets === "object" ? requires.secrets : {};
-  const result = [];
-  for (const resource of resources) {
-    const path = String(resource.path || "");
-    const sourceText = files.get(path);
-    if (!sourceText) continue;
-    const source = parseYaml(sourceText);
-    if (source.execution_target !== "self_hosted") continue;
-    const development = source.development && typeof source.development === "object" ? source.development : void 0;
-    if (!development) continue;
-    const server = source.server && typeof source.server === "object" ? source.server : {};
-    const auth = server.auth && typeof server.auth === "object" ? server.auth : {};
-    const secretRequirement = String(auth.secret || "");
-    const secretKey = secretRequirement.startsWith("$secrets.") ? secretRequirement.slice("$secrets.".length) : "";
-    const secretDeclaration = secretKey && requiredSecrets[secretKey] && typeof requiredSecrets[secretKey] === "object" ? requiredSecrets[secretKey] : void 0;
-    const cwd = resolve(directory, String(development.cwd || "."));
-    if (cwd !== directory && !cwd.startsWith(`${directory}/`)) throw new Error(`Artifact ${resource.key} development.cwd must remain inside the package`);
-    result.push({
-      key: String(resource.key || ""),
-      baseUrl: String(development.base_url || ""),
-      command: development.command ? String(development.command) : void 0,
-      args: Array.isArray(development.args) ? development.args.map(String) : [],
-      cwd,
-      protocol: {
-        manifest_path: server.manifest_path,
-        health_path: server.health_path,
-        verify_path: server.verify_path,
-        invoke_path: server.invoke_path,
-        auth_mode: auth.mode,
-        signing_secret_requirement: auth.secret
-      },
-      signingSecretEnv: secretDeclaration?.env ? String(secretDeclaration.env) : void 0
-    });
-  }
-  return result;
-}
-async function waitForServer(baseUrl, healthPath) {
-  const target = new URL(String(healthPath || "/.well-known/agents24/artifact/health"), baseUrl);
-  for (let attempt = 0; attempt < 60; attempt += 1) {
-    try {
-      const response = await fetch(target);
-      if (response.ok) return;
-    } catch {
-    }
-    await new Promise((resolvePromise) => setTimeout(resolvePromise, 250));
-  }
-  throw new Error(`Local Artifact server did not become healthy at ${target}`);
-}
-async function openDevelopmentRelay(client, installationIdValue, artifact, localEnv) {
-  const admission = await client.resourceInstallations.prepareDevelopmentSession(installationIdValue, {
-    resource_key: artifact.key,
-    machine_label: hostname()
-  });
-  const apiUrl = new URL(String(process.env.AGENTS24_BASE_URL || DEFAULT_API_BASE_URL));
-  apiUrl.protocol = apiUrl.protocol === "https:" ? "wss:" : "ws:";
-  apiUrl.pathname = String(admission.relay_path);
-  const socket = new WebSocket(apiUrl, [
-    "agents24-artifact-relay",
-    `agents24-credential-${String(admission.relay_token)}`
-  ]);
-  const state = {};
-  await new Promise((resolveReady, rejectReady) => {
-    socket.addEventListener("error", () => rejectReady(new Error(`Artifact relay failed for ${artifact.key}`)), { once: true });
-    socket.addEventListener("message", async (event) => {
-      const message = JSON.parse(String(event.data));
-      if (message.type === "ready") {
-        resolveReady();
-        return;
-      }
-      if (message.type === "superseded" || message.type === "revoked") {
-        state.terminalReason = String(message.type);
-        socket.close();
-        return;
-      }
-      if (message.type !== "request") return;
-      const method = message.operation === "health" || message.operation === "manifest" ? "GET" : "POST";
-      try {
-        const requestBody = method === "POST" ? JSON.stringify(message.body || {}) : void 0;
-        const headers = method === "POST" ? { "content-type": "application/json" } : {};
-        if (method === "POST" && String(artifact.protocol.auth_mode || "hmac_sha256") === "hmac_sha256") {
-          const signingSecret = String(
-            artifact.signingSecretEnv && (localEnv[artifact.signingSecretEnv] || process.env[artifact.signingSecretEnv]) || ""
-          );
-          if (!signingSecret) throw new Error(`Artifact ${artifact.key} signing secret is unavailable`);
-          const timestamp = String(Date.now());
-          const signature = createHmac("sha256", signingSecret).update(`${timestamp}.${requestBody}`).digest("hex");
-          headers["x-agents24-timestamp"] = timestamp;
-          headers["x-agents24-signature"] = `sha256=${signature}`;
-        }
-        const response = await fetch(new URL(String(message.path || "/"), artifact.baseUrl), {
-          method,
-          headers,
-          body: requestBody
-        });
-        const textBody = await response.text();
-        let body = textBody;
-        try {
-          body = textBody ? JSON.parse(textBody) : null;
-        } catch {
-        }
-        socket.send(JSON.stringify({ type: "response", request_id: message.request_id, status: response.status, body }));
-      } catch {
-        socket.send(JSON.stringify({ type: "response", request_id: message.request_id, status: 502, body: { status: "failed" } }));
-      }
-    });
-    const heartbeat = setInterval(() => {
-      if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify({ type: "heartbeat" }));
-    }, 15e3);
-    socket.addEventListener("close", () => clearInterval(heartbeat), { once: true });
-  });
-  return { sessionId: String(admission.id), socket, state };
+  return { publication, installationId: id };
 }
 async function execute(parsed) {
+  if (parsed.command === "fork") {
+    const [source, target] = parsed.positionals;
+    if (!source || !target) throw new Error("Usage: agents24 fork <source> <target> [--name <name>]");
+    const result = await forkPackage(source, target, flag(parsed, "name"));
+    return { ok: true, directory: resolve3(target), package: result.name, package_id: result.packageId };
+  }
   if (parsed.command === "prepare") {
     const input = parsed.positionals[0];
     if (!input) throw new Error("prepare requires a Resource Package directory");
+    await packageIdentity(input);
     return preparePackage(input);
   }
   if (parsed.command === "plan") {
     const input = parsed.positionals[0];
     if (!input) throw new Error("plan requires a Resource Package directory or ZIP");
+    await packageIdentity(input);
     const apiKey = await apiKeyForLifecycle(parsed);
     const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
     const data = await packPackage(input);
-    const currentId = await installationId(input);
     const plan = await client.resourceInstallations.plan({
-      ...upload(data, input),
-      ...currentId ? { installationId: currentId } : {},
+      ...packageUpload(data, input),
       prune: flag(parsed, "prune") === "true"
     });
     return { ok: plan.can_apply === true, plan };
   }
+  if (parsed.command === "pull") {
+    const input = parsed.positionals[0];
+    if (!input) throw new Error("pull requires a Resource Package directory");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    const installation = await resolveInstallation(input, client, false);
+    return pullPackage({ parsed, input, client, installationId: String(installation.id || "") });
+  }
   if (parsed.command === "status") {
     const input = parsed.positionals[0];
     if (!input) throw new Error("status requires a Resource Package directory or ZIP");
-    const id = await installationId(input);
-    if (!id) throw new Error("No installation is linked; run agents24 apply/link first or set AGENTS24_INSTALLATION_ID");
+    const identity = await packageIdentity(input);
     const apiKey = await apiKeyForLifecycle(parsed);
-    const status = await (await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey })).resourceInstallations.get(id);
-    return { ok: true, installation: status };
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    let status;
+    try {
+      status = await resolveInstallation(input, client);
+    } catch (error) {
+      if (!isNotFoundResponse(error)) throw error;
+      return {
+        ok: true,
+        installed: false,
+        package_id: identity.packageId,
+        message: "This package has not been applied to this organization. Run agents24 apply <package-directory> to create its resources."
+      };
+    }
+    return installedPackageStatus(input, client, status);
   }
   if (parsed.command === "resources") {
     if (parsed.positionals[0] !== "list") throw new Error("Usage: agents24 resources list --kind <kind>");
@@ -610,20 +913,11 @@ async function execute(parsed) {
     if (!input) throw new Error("link requires a Resource Package directory or ZIP");
     const assignments = values(parsed, "resource");
     if (!assignments.length) throw new Error("link requires --resource <stable-key>=<uuid>");
+    await packageIdentity(input);
     const apiKey = await apiKeyForLifecycle(parsed);
     const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
-    let id = await installationId(input);
-    if (!id) {
-      const data = await packPackage(input);
-      const initialPlan = await client.resourceInstallations.plan(upload(data, input));
-      const created = await client.resourceInstallations.create(
-        { package_name: String(initialPlan.package_name), operation_id: String(initialPlan.operation_id) },
-        { idempotencyKey: `installation-${String(initialPlan.package_hash).slice(0, 40)}` }
-      );
-      id = String(created.id);
-      await writeInstallationId(input, id);
-      await client.resourceInstallations.plan({ ...upload(data, input), installationId: id });
-    }
+    const data = await packPackage(input);
+    const id = await ensureInstallation(input, client, data);
     const linked = [];
     for (const assignment of assignments) {
       const separator = assignment.indexOf("=");
@@ -631,18 +925,34 @@ async function execute(parsed) {
       const resourceKey = assignment.slice(0, separator);
       const resourceId = assignment.slice(separator + 1);
       linked.push(await client.resourceInstallations.link(id, { resource_key: resourceKey, resource_id: resourceId }, {
-        idempotencyKey: `link-${createHash("sha256").update(`${id}:${assignment}`).digest("hex").slice(0, 40)}`
+        idempotencyKey: `link-${createHash2("sha256").update(`${id}:${assignment}`).digest("hex").slice(0, 40)}`
       }));
     }
     return { ok: true, installation_id: id, linked };
   }
   if (parsed.command === "apply") {
-    const applied = await applyDraft(parsed);
-    return { ok: true, phase: "draft_applied", installation_id: applied.installationId, agent_id: applied.agent.id, plan: applied.plan, operation: applied.operation };
+    const app = await resolveApp(parsed);
+    const integration = app || flag(parsed, "integration") ? await resolveInstallMode(parsed, app) : "publish-only";
+    const applied = await applyDraft(parsed, { integrationMode: integration });
+    const envFile = app && integration === "bff" && flag(parsed, "no-write-env") !== "true" ? await updateEnvFile(app, bffApplicationValues(applied)) : void 0;
+    return {
+      ok: true,
+      phase: "draft_applied",
+      installation_id: applied.installationId,
+      agent_alias: primaryAgentAlias(applied),
+      operation_id: applied.operation.operation_id,
+      operation_status: applied.operation.status,
+      ...envFile ? { env_file: envFile } : {}
+    };
   }
   if (parsed.command === "publish") {
     const published = await publishDraft(parsed);
-    return { ok: true, phase: "published", ...published };
+    return {
+      ok: true,
+      phase: "published",
+      installation_id: published.installationId,
+      publication: publicationProjection(published.publication)
+    };
   }
   if (parsed.command === "setup") {
     const app = await resolveApp(parsed);
@@ -662,26 +972,45 @@ async function execute(parsed) {
     let envFile;
     if (app && flag(parsed, "no-write-env") !== "true" && integration !== "publish-only") {
       const localClientBaseUrl = integration === "client-deployment" ? clientAppBaseUrl() : void 0;
-      envFile = await updateEnvFile(app, integration === "client-deployment" ? { VITE_AGENTS24_DEPLOYMENT_ID: String(deploymentId), ...localClientBaseUrl ? { VITE_AGENTS24_BASE_URL: localClientBaseUrl } : {} } : { AGENTS24_API_KEY: applied.apiKey, AGENTS24_AGENT_ID: String(applied.agent.id) });
+      envFile = await updateEnvFile(app, integration === "client-deployment" ? { VITE_AGENTS24_DEPLOYMENT_ID: String(deploymentId), ...localClientBaseUrl ? { VITE_AGENTS24_BASE_URL: localClientBaseUrl } : {} } : bffApplicationValues(applied));
     }
-    return { ok: true, phase: deployment ? "deployed" : "published", integration, installation_id: applied.installationId, agent_id: applied.agent.id, publication: published.publication, ...deployment ? { deployment, deployment_id: deploymentId } : {}, ...envFile ? { env_file: envFile } : {} };
+    return {
+      ok: true,
+      phase: deployment ? "deployed" : "published",
+      integration,
+      installation_id: applied.installationId,
+      agent_alias: primaryAgentAlias(applied),
+      publication: publicationProjection(published.publication),
+      ...deployment ? { deployment_id: deploymentId } : {},
+      ...envFile ? { env_file: envFile } : {}
+    };
   }
   if (parsed.command === "dev") {
     const input = parsed.positionals[0];
     if (!input) throw new Error("dev requires a Resource Package directory");
+    await packageIdentity(input);
     await preparePackage(input);
-    const apiKey = await apiKeyForLifecycle(parsed);
-    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
-    const data = await packPackage(input);
-    const id = await ensureInstallation(input, client, data);
-    const configuredSecrets = await secretValues(input);
-    if (Object.keys(configuredSecrets).length) await client.resourceInstallations.configureSecrets(id, { secrets: configuredSecrets });
     const declared = await developmentArtifacts(input);
     const selectedKey = flag(parsed, "artifact");
     const artifacts = selectedKey ? declared.filter((item) => item.key === selectedKey) : declared;
     if (!artifacts.length) throw new Error(selectedKey ? `Artifact ${selectedKey} has no development configuration` : "No self-hosted Artifact development configuration was found");
+    const apiKey = await apiKeyForLifecycle(parsed);
+    const client = await createRemoteClient({ ...process.env, AGENTS24_API_KEY: apiKey });
+    const applied = flag(parsed, "apply") === "true" ? await applyDraft(parsed, { apiKey, client }) : void 0;
+    let id = applied?.installationId;
+    if (!id) {
+      try {
+        id = String((await resolveInstallation(input, client)).id || "");
+      } catch (error) {
+        if (!isNotFoundResponse(error)) throw error;
+        throw new Error("Apply the package before starting Artifact development");
+      }
+    }
+    if (!id) throw new Error("Apply the package before starting Artifact development");
+    const configuredSecrets = await secretValues(input);
+    if (Object.keys(configuredSecrets).length) await client.resourceInstallations.configureSecrets(id, { secrets: configuredSecrets });
     const directory = await packageDirectory(input);
-    const localEnv = directory ? parseEnv(await readFile(join(directory, ".env.local"), "utf8")) : {};
+    const localEnv = directory ? parseEnv(await readFile3(join3(directory, ".env.local"), "utf8")) : {};
     const children = [];
     const relays = [];
     try {
@@ -691,14 +1020,7 @@ async function execute(parsed) {
         relays.push(await openDevelopmentRelay(client, id, artifact, localEnv));
       }
       const developmentSessions = Object.fromEntries(artifacts.map((item, index) => [item.key, relays[index].sessionId]));
-      for (const artifact of declared) {
-        if (developmentSessions[artifact.key]) continue;
-        const status = await client.resourceInstallations.developmentSessionStatus(id, artifact.key);
-        if (status.status !== "connected" || !status.id) throw new Error(`Artifact ${artifact.key} requires an active development connection`);
-        developmentSessions[artifact.key] = String(status.id);
-      }
-      const applied = await applyDraft(parsed, { development: true, developmentSessions, skipConfirmation: true });
-      process.stdout.write(`${JSON.stringify({ ok: true, phase: "development_connected", installation_id: applied.installationId, development_sessions: developmentSessions }, null, 2)}
+      process.stdout.write(`${JSON.stringify({ ok: true, phase: "development_connected", installation_id: id, development_sessions: developmentSessions, draft_applied: Boolean(applied) }, null, 2)}
 `);
       await new Promise((resolveStop) => {
         let stopping = false;
@@ -721,7 +1043,6 @@ async function execute(parsed) {
                 const replacement = await openDevelopmentRelay(client, id, artifacts[index], localEnv);
                 relays[index] = replacement;
                 developmentSessions[artifacts[index].key] = replacement.sessionId;
-                await applyDraft(parsed, { development: true, developmentSessions, skipConfirmation: true });
                 reconnecting.delete(index);
                 watch(replacement, index);
                 return;
@@ -743,8 +1064,8 @@ async function execute(parsed) {
     }
   }
   if (parsed.command === "init") {
-    const directory = resolve(parsed.positionals[0] || ".");
-    const name = flag(parsed, "name") || basename(directory);
+    const directory = resolve3(parsed.positionals[0] || ".");
+    const name = flag(parsed, "name") || basename2(directory);
     const packageName = await initializePackage(directory, name);
     return { ok: true, directory, package: packageName };
   }
@@ -755,7 +1076,7 @@ async function execute(parsed) {
     let remote;
     if (flag(parsed, "remote") === "true" && local.valid) {
       const data = await packPackage(input);
-      remote = await (await createRemoteClient()).resourcePackages.validatePackage(upload(data, input));
+      remote = await (await createRemoteClient()).resourcePackages.validatePackage(packageUpload(data, input));
     }
     return { ok: local.valid && (!remote || remote.valid === true), local: { ...local, files: void 0 }, ...remote ? { remote } : {} };
   }
@@ -763,8 +1084,8 @@ async function execute(parsed) {
     const input = parsed.positionals[0];
     if (!input) throw new Error("pack requires a package directory");
     const data = await packPackage(input);
-    const output = resolve(flag(parsed, "output") || `${basename(resolve(input))}.agents24.zip`);
-    await writeFile(output, data);
+    const output = resolve3(flag(parsed, "output") || `${basename2(resolve3(input))}.agents24.zip`);
+    await writeFile3(output, data);
     return { ok: true, output, bytes: data.byteLength };
   }
   if (parsed.command === "export") {
@@ -780,72 +1101,42 @@ async function execute(parsed) {
     }
     const request = { selectors };
     const archive = await (await createRemoteClient()).resourcePackages.exportPackage(request);
-    const output = resolve(flag(parsed, "output") || archive.filename);
-    await writeFile(output, archive.data);
+    const output = resolve3(flag(parsed, "output") || archive.filename);
+    await writeFile3(output, archive.data);
     return { ok: true, output, bytes: archive.data.byteLength };
   }
-  if (parsed.command === "compile") {
-    const { result } = await compiledPackage(parsed);
-    const output = flag(parsed, "output");
-    if (output) await writeFile(resolve(output), `${JSON.stringify(result.bundle, null, 2)}
-`);
-    return { ok: result.valid === true, ...output ? { output: resolve(output) } : {}, result: safeResult(result) };
-  }
   if (parsed.command === "preview" || parsed.command === "import") {
     const client = await createRemoteClient();
-    const { result } = await compiledPackage(parsed, client);
-    if (result.valid !== true || !result.bundle || typeof result.bundle !== "object") throw new Error("Remote compilation did not produce a bundle");
+    const { data, filename } = await packedValidatedPackage(parsed);
     const request = {
-      bundle: result.bundle,
+      data,
+      filename,
       mappings: mappings(parsed)
     };
-    let preview = await client.resourceBundles.importPreview(request);
-    request.mappings = await promptMappings(parsed, client, preview, request.mappings);
-    if (Object.keys(request.mappings).length) preview = await client.resourceBundles.importPreview(request);
+    let preview = await client.resourcePackages.importPreview(request);
+    request.mappings = await promptImportMappings(client, preview, request.mappings, interactive(parsed));
+    if (Object.keys(request.mappings).length) preview = await client.resourcePackages.importPreview(request);
     if (parsed.command === "preview") return { ok: preview.can_import === true, preview };
     if (preview.can_import !== true) return { ok: false, preview };
     await confirmation(parsed, preview);
-    const imported = await client.resourceBundles.importBundle(request, { idempotencyKey: importKey(request.bundle, request.mappings) });
+    const packageHash = String(preview.package_hash || "");
+    if (!packageHash) throw new Error("Package preview did not return a package hash");
+    const imported = await client.resourcePackages.importPackage(request, { idempotencyKey: importKey(packageHash, request.mappings) });
     return { ok: true, phase: "imported", preview, result: imported };
   }
   throw new Error(`Unknown package command: ${parsed.command}`);
 }
-function diagnostics(error) {
-  if (!error || typeof error !== "object") return void 0;
-  const record = error;
-  if (Array.isArray(record.diagnostics)) return record.diagnostics;
-  if (!record.details || typeof record.details !== "object" || Array.isArray(record.details)) return void 0;
-  const detail = record.details.detail;
-  if (!detail || typeof detail !== "object" || Array.isArray(detail)) return void 0;
-  const value = detail.diagnostics;
-  return Array.isArray(value) ? value : void 0;
-}
-function errorMessage(error, parsed) {
-  void parsed;
-  return error instanceof Error ? error.message : "Unexpected CLI failure";
-}
 async function run(argv = process.argv.slice(2)) {
   let parsed;
   try {
-    parsed = parse(argv);
+    parsed = parseArguments(argv);
     const result = await execute(parsed);
-    if (flag(parsed, "json") === "true") process.stdout.write(`${JSON.stringify(result)}
-`);
-    else if (result.ok === false) process.stderr.write(`${JSON.stringify(result, null, 2)}
-`);
-    else process.stdout.write(`${JSON.stringify(result, null, 2)}
-`);
+    writeResult(result, parsed);
     return result.ok === false ? 1 : 0;
   } catch (error) {
-    const payload = {
-      ok: false,
-      error: errorMessage(error, parsed),
-      ...error && typeof error === "object" && "phase" in error ? { phase: error.phase } : {},
-      ...error && typeof error === "object" && "imported" in error ? { import_result: error.imported } : {},
-      ...diagnostics(error) ? { diagnostics: diagnostics(error) } : {}
-    };
-    const body = parsed && flag(parsed, "json") === "true" ? JSON.stringify(payload) : JSON.stringify(payload, null, 2);
-    process.stderr.write(`${body}
+    const payload = failurePayload(error);
+    if (parsed) writeResult(payload, parsed);
+    else process.stderr.write(`${JSON.stringify(payload, null, 2)}
 `);
     return 1;
   }