@codemation/cli 0.0.1

package/dist/CliBin-vjSSUDWE.js

@@ -0,0 +1,2304 @@
+import { createRequire } from "node:module";
+import process$1 from "node:process";
+import { CodemationConsumerConfigLoader, CodemationPluginDiscovery, WorkflowDiscoveryPathSegmentsComputer, WorkflowModulePathFinder } from "@codemation/host/server";
+import { ServerLoggerFactory, logLevelPolicyFactory } from "@codemation/host/next/server";
+import { randomUUID } from "node:crypto";
+import { access, copyFile, cp, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { spawn } from "node:child_process";
+import { ApiPaths, ApplicationTokens, CodemationApplication, CodemationBootstrapRequest, ListUserAccountsQuery, PrismaClient, UpsertLocalBootstrapUserCommand } from "@codemation/host";
+import { existsSync, readFileSync } from "node:fs";
+import { config, parse } from "dotenv";
+import { watch } from "chokidar";
+import ts from "typescript";
+import { DatabasePersistenceResolver, PrismaMigrationDeployer } from "@codemation/host/persistence";
+import boxen from "boxen";
+import chalk from "chalk";
+import figlet from "figlet";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { createServer } from "node:net";
+import { Command } from "commander";
+
+//#region src/build/ConsumerBuildArtifactsPublisher.ts
+var ConsumerBuildArtifactsPublisher = class {
+	async publish(snapshot, discoveredPlugins) {
+		const pluginEntryPath = await this.writeDiscoveredPluginsOutput(snapshot, discoveredPlugins);
+		return await this.writeBuildManifest(snapshot, pluginEntryPath);
+	}
+	async writeDiscoveredPluginsOutput(snapshot, discoveredPlugins) {
+		const outputPath = path.resolve(snapshot.emitOutputRoot, "plugins.js");
+		await mkdir(path.dirname(outputPath), { recursive: true });
+		const outputLines = ["const codemationDiscoveredPlugins = [];", ""];
+		discoveredPlugins.forEach((discoveredPlugin, index) => {
+			const pluginFileUrl = pathToFileURL(path.resolve(discoveredPlugin.packageRoot, discoveredPlugin.manifest.entry)).href;
+			const exportNameAccessor = discoveredPlugin.manifest.exportName ? `pluginModule${index}[${JSON.stringify(discoveredPlugin.manifest.exportName)}]` : `pluginModule${index}.default ?? pluginModule${index}.codemationPlugin`;
+			outputLines.push(`const pluginModule${index} = await import(${JSON.stringify(pluginFileUrl)});`);
+			outputLines.push(`const pluginValue${index} = ${exportNameAccessor};`);
+			outputLines.push(`if (pluginValue${index} && typeof pluginValue${index}.register === "function") {`);
+			outputLines.push(`  codemationDiscoveredPlugins.push(pluginValue${index});`);
+			outputLines.push(`} else if (typeof pluginValue${index} === "function" && pluginValue${index}.prototype && typeof pluginValue${index}.prototype.register === "function") {`);
+			outputLines.push(`  codemationDiscoveredPlugins.push(new pluginValue${index}());`);
+			outputLines.push("}");
+			outputLines.push("");
+		});
+		outputLines.push("export { codemationDiscoveredPlugins };");
+		outputLines.push("export default codemationDiscoveredPlugins;");
+		outputLines.push("");
+		await writeFile(outputPath, outputLines.join("\n"), "utf8");
+		return outputPath;
+	}
+	async writeBuildManifest(snapshot, pluginEntryPath) {
+		const manifest = {
+			buildVersion: snapshot.buildVersion,
+			consumerRoot: snapshot.consumerRoot,
+			entryPath: snapshot.outputEntryPath,
+			manifestPath: snapshot.manifestPath,
+			pluginEntryPath,
+			workflowSourcePaths: snapshot.workflowSourcePaths
+		};
+		await mkdir(path.dirname(snapshot.manifestPath), { recursive: true });
+		const temporaryManifestPath = `${snapshot.manifestPath}.${snapshot.buildVersion}.${randomUUID()}.tmp`;
+		await writeFile(temporaryManifestPath, JSON.stringify(manifest, null, 2), "utf8");
+		await rename(temporaryManifestPath, snapshot.manifestPath);
+		return manifest;
+	}
+};
+
+//#endregion
+//#region src/build/ConsumerBuildOptionsParser.ts
+var ConsumerBuildOptionsParser = class {
+	parse(args) {
+		return {
+			sourceMaps: args.noSourceMaps !== true,
+			target: this.parseTarget(args.target)
+		};
+	}
+	parseTarget(raw) {
+		if (raw === void 0 || raw.trim() === "") return "es2022";
+		const normalized = raw.trim();
+		if (normalized === "es2020" || normalized === "es2022") return normalized;
+		throw new Error(`Invalid --target "${raw}". Use es2020 or es2022.`);
+	}
+};
+
+//#endregion
+//#region src/commands/BuildCommand.ts
+var BuildCommand = class {
+	constructor(cliLogger, pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, outputBuilderLoader) {
+		this.cliLogger = cliLogger;
+		this.pathResolver = pathResolver;
+		this.pluginDiscovery = pluginDiscovery;
+		this.artifactsPublisher = artifactsPublisher;
+		this.tsRuntime = tsRuntime;
+		this.outputBuilderLoader = outputBuilderLoader;
+	}
+	async execute(consumerRoot, buildOptions) {
+		const paths = await this.pathResolver.resolve(consumerRoot);
+		this.tsRuntime.configure(paths.repoRoot);
+		const snapshot = await this.outputBuilderLoader.create(paths.consumerRoot, buildOptions).ensureBuilt();
+		const discoveredPlugins = await this.pluginDiscovery.discover(paths.consumerRoot);
+		const manifest = await this.artifactsPublisher.publish(snapshot, discoveredPlugins);
+		this.cliLogger.info(`Built consumer output: ${snapshot.outputEntryPath}`);
+		this.cliLogger.info(`Discovered plugins: ${discoveredPlugins.length}`);
+		this.cliLogger.info(`Published build: ${manifest.buildVersion}`);
+	}
+};
+
+//#endregion
+//#region src/commands/DbMigrateCommand.ts
+var DbMigrateCommand = class {
+	constructor(databaseMigrationsApplyService) {
+		this.databaseMigrationsApplyService = databaseMigrationsApplyService;
+	}
+	async execute(options) {
+		await this.databaseMigrationsApplyService.applyForConsumerRequiringPersistence(options.consumerRoot ?? process.cwd(), { configPath: options.configPath });
+	}
+};
+
+//#endregion
+//#region src/commands/DevCommand.ts
+var DevCommand = class {
+	require = createRequire(import.meta.url);
+	constructor(pathResolver, pluginDiscovery, tsRuntime, devLockFactory, devSourceWatcherFactory, cliLogger, session, databaseMigrationsApplyService, devBootstrapSummaryFetcher, devCliBannerRenderer, devConsumerPublishBootstrap, consumerEnvDotenvFilePredicate, devTrackedProcessTreeKiller) {
+		this.pathResolver = pathResolver;
+		this.pluginDiscovery = pluginDiscovery;
+		this.tsRuntime = tsRuntime;
+		this.devLockFactory = devLockFactory;
+		this.devSourceWatcherFactory = devSourceWatcherFactory;
+		this.cliLogger = cliLogger;
+		this.session = session;
+		this.databaseMigrationsApplyService = databaseMigrationsApplyService;
+		this.devBootstrapSummaryFetcher = devBootstrapSummaryFetcher;
+		this.devCliBannerRenderer = devCliBannerRenderer;
+		this.devConsumerPublishBootstrap = devConsumerPublishBootstrap;
+		this.consumerEnvDotenvFilePredicate = consumerEnvDotenvFilePredicate;
+		this.devTrackedProcessTreeKiller = devTrackedProcessTreeKiller;
+	}
+	async execute(consumerRoot) {
+		const paths = await this.pathResolver.resolve(consumerRoot);
+		this.devCliBannerRenderer.renderBrandHeader();
+		this.tsRuntime.configure(paths.repoRoot);
+		await this.databaseMigrationsApplyService.applyForConsumer(paths.consumerRoot);
+		await this.devConsumerPublishBootstrap.ensurePublished(paths);
+		const devMode = this.resolveDevModeFromEnv();
+		const { nextPort, gatewayPort } = await this.session.sessionPorts.resolve({
+			devMode,
+			portEnv: process$1.env.PORT,
+			gatewayPortEnv: process$1.env.CODEMATION_DEV_GATEWAY_HTTP_PORT
+		});
+		const devLock = this.devLockFactory.create();
+		await devLock.acquire({
+			consumerRoot: paths.consumerRoot,
+			nextPort: devMode === "framework" ? nextPort : gatewayPort
+		});
+		const authSettings = await this.session.devAuthLoader.loadForConsumer(paths.consumerRoot);
+		const watcher = this.devSourceWatcherFactory.create();
+		try {
+			const prepared = await this.prepareDevRuntime(paths, devMode, nextPort, gatewayPort, authSettings);
+			const processState = this.createInitialProcessState();
+			const stopPromise = this.wireStopPromise(processState);
+			const uiProxyBase = await this.startConsumerUiProxyWhenNeeded(prepared, processState);
+			const gatewayBaseUrl = this.gatewayBaseHttpUrl(gatewayPort);
+			await this.spawnGatewayChildAndWaitForHealth(prepared, processState, gatewayBaseUrl, uiProxyBase);
+			await this.session.devHttpProbe.waitUntilBootstrapSummaryReady(gatewayBaseUrl);
+			const initialSummary = await this.devBootstrapSummaryFetcher.fetch(gatewayBaseUrl);
+			if (initialSummary) this.devCliBannerRenderer.renderRuntimeSummary(initialSummary);
+			this.bindShutdownSignalsToChildProcesses(processState);
+			this.spawnFrameworkNextHostWhenNeeded(prepared, processState, gatewayBaseUrl);
+			await this.startWatcherForSourceRestart(prepared, watcher, devMode, gatewayBaseUrl);
+			this.logConsumerDevHintWhenNeeded(devMode, gatewayPort);
+			await stopPromise;
+		} finally {
+			await watcher.stop();
+			await devLock.release();
+		}
+	}
+	resolveDevModeFromEnv() {
+		return process$1.env.CODEMATION_DEV_MODE === "framework" ? "framework" : "consumer";
+	}
+	async prepareDevRuntime(paths, devMode, nextPort, gatewayPort, authSettings) {
+		const developmentServerToken = this.session.devAuthLoader.resolveDevelopmentServerToken(process$1.env.CODEMATION_DEV_SERVER_TOKEN);
+		const gatewayEntrypoint = await this.session.runtimeEntrypointResolver.resolve({
+			packageName: "@codemation/dev-gateway",
+			repoRoot: paths.repoRoot,
+			sourceEntrypoint: "packages/dev-gateway/src/bin.ts"
+		});
+		const runtimeEntrypoint = await this.session.runtimeEntrypointResolver.resolve({
+			packageName: "@codemation/runtime-dev",
+			repoRoot: paths.repoRoot,
+			sourceEntrypoint: "packages/runtime-dev/src/bin.ts"
+		});
+		const runtimeWorkingDirectory = paths.repoRoot ?? paths.consumerRoot;
+		const consumerEnv = this.session.consumerEnvLoader.load(paths.consumerRoot);
+		return {
+			paths,
+			devMode,
+			nextPort,
+			gatewayPort,
+			authSettings,
+			developmentServerToken,
+			gatewayEntrypoint,
+			runtimeEntrypoint,
+			runtimeWorkingDirectory,
+			discoveredPluginPackagesJson: JSON.stringify(await this.pluginDiscovery.discover(paths.consumerRoot)),
+			consumerEnv
+		};
+	}
+	createInitialProcessState() {
+		return {
+			currentGateway: null,
+			currentNextHost: null,
+			currentUiNext: null,
+			stopRequested: false,
+			stopResolve: null,
+			stopReject: null
+		};
+	}
+	wireStopPromise(state) {
+		return new Promise((resolve, reject) => {
+			state.stopResolve = resolve;
+			state.stopReject = reject;
+		});
+	}
+	gatewayBaseHttpUrl(gatewayPort) {
+		return `http://127.0.0.1:${gatewayPort}`;
+	}
+	/**
+	* Consumer mode: run `next start` for the host UI and wait until it responds, so the gateway can proxy to it.
+	* Framework mode: no separate UI child (Next runs in dev later).
+	*/
+	async startConsumerUiProxyWhenNeeded(prepared, state) {
+		if (prepared.devMode !== "consumer") return "";
+		const websocketPort = prepared.gatewayPort;
+		const uiPort = await this.session.loopbackPortAllocator.allocate();
+		const uiProxyBase = `http://127.0.0.1:${uiPort}`;
+		const nextHostPackageJsonPath = this.require.resolve("@codemation/next-host/package.json");
+		const nextHostRoot = path.dirname(nextHostPackageJsonPath);
+		const consumerOutputManifestPath = path.resolve(prepared.paths.consumerRoot, ".codemation", "output", "current.json");
+		state.currentUiNext = spawn("pnpm", [
+			"exec",
+			"next",
+			"start"
+		], {
+			cwd: nextHostRoot,
+			...this.devDetachedChildSpawnOptions(),
+			env: {
+				...process$1.env,
+				...prepared.consumerEnv,
+				PORT: String(uiPort),
+				CODEMATION_AUTH_CONFIG_JSON: prepared.authSettings.authConfigJson,
+				CODEMATION_CONSUMER_ROOT: prepared.paths.consumerRoot,
+				CODEMATION_CONSUMER_OUTPUT_MANIFEST_PATH: consumerOutputManifestPath,
+				CODEMATION_SKIP_UI_AUTH: prepared.authSettings.skipUiAuth ? "true" : "false",
+				NEXT_PUBLIC_CODEMATION_SKIP_UI_AUTH: prepared.authSettings.skipUiAuth ? "true" : "false",
+				CODEMATION_WS_PORT: String(websocketPort),
+				NEXT_PUBLIC_CODEMATION_WS_PORT: String(websocketPort),
+				CODEMATION_DEV_SERVER_TOKEN: prepared.developmentServerToken,
+				NODE_OPTIONS: this.session.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS),
+				WS_NO_BUFFER_UTIL: "1",
+				WS_NO_UTF_8_VALIDATE: "1"
+			}
+		});
+		state.currentUiNext.on("error", (error) => {
+			if (!state.stopRequested) {
+				state.stopRequested = true;
+				state.stopReject?.(error instanceof Error ? error : new Error(String(error)));
+			}
+		});
+		state.currentUiNext.on("exit", (code) => {
+			if (state.stopRequested) return;
+			state.stopRequested = true;
+			if (state.currentGateway?.exitCode === null) this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(state.currentGateway);
+			state.stopReject?.(/* @__PURE__ */ new Error(`next start (consumer UI) exited unexpectedly with code ${code ?? 0}.`));
+		});
+		await this.session.devHttpProbe.waitUntilUrlRespondsOk(`${uiProxyBase}/`);
+		return uiProxyBase;
+	}
+	async spawnGatewayChildAndWaitForHealth(prepared, state, gatewayBaseUrl, uiProxyBase) {
+		const gatewayProcessEnv = this.session.consumerEnvLoader.mergeIntoProcessEnvironment(process$1.env, prepared.consumerEnv);
+		state.currentGateway = spawn(prepared.gatewayEntrypoint.command, prepared.gatewayEntrypoint.args, {
+			cwd: prepared.runtimeWorkingDirectory,
+			...this.devDetachedChildSpawnOptions(),
+			env: {
+				...gatewayProcessEnv,
+				...prepared.gatewayEntrypoint.env,
+				CODEMATION_DEV_GATEWAY_HTTP_PORT: String(prepared.gatewayPort),
+				CODEMATION_RUNTIME_CHILD_BIN: prepared.runtimeEntrypoint.command,
+				CODEMATION_RUNTIME_CHILD_ARGS_JSON: JSON.stringify(prepared.runtimeEntrypoint.args),
+				CODEMATION_RUNTIME_CHILD_ENV_JSON: JSON.stringify(prepared.runtimeEntrypoint.env),
+				CODEMATION_RUNTIME_CHILD_CWD: prepared.runtimeWorkingDirectory,
+				CODEMATION_CONSUMER_ROOT: prepared.paths.consumerRoot,
+				CODEMATION_DISCOVERED_PLUGIN_PACKAGES_JSON: prepared.discoveredPluginPackagesJson,
+				CODEMATION_PREFER_PLUGIN_SOURCE_ENTRY: "true",
+				CODEMATION_DEV_SERVER_TOKEN: prepared.developmentServerToken,
+				CODEMATION_SKIP_STARTUP_MIGRATIONS: "true",
+				NODE_OPTIONS: this.session.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS),
+				WS_NO_BUFFER_UTIL: "1",
+				WS_NO_UTF_8_VALIDATE: "1",
+				...uiProxyBase.length > 0 ? { CODEMATION_DEV_UI_PROXY_TARGET: uiProxyBase } : {}
+			}
+		});
+		state.currentGateway.on("error", (error) => {
+			if (!state.stopRequested) {
+				state.stopRequested = true;
+				state.stopReject?.(error instanceof Error ? error : new Error(String(error)));
+			}
+		});
+		state.currentGateway.on("exit", (code) => {
+			if (state.stopRequested) return;
+			state.stopRequested = true;
+			state.stopReject?.(/* @__PURE__ */ new Error(`codemation dev-gateway exited unexpectedly with code ${code ?? 0}.`));
+		});
+		await this.session.devHttpProbe.waitUntilGatewayHealthy(gatewayBaseUrl);
+	}
+	devDetachedChildSpawnOptions() {
+		return process$1.platform === "win32" ? {
+			stdio: "inherit",
+			detached: true,
+			windowsHide: true
+		} : {
+			stdio: "inherit",
+			detached: true
+		};
+	}
+	bindShutdownSignalsToChildProcesses(state) {
+		let shutdownInProgress = false;
+		const runShutdown = async () => {
+			if (shutdownInProgress) return;
+			shutdownInProgress = true;
+			state.stopRequested = true;
+			process$1.stdout.write("\n[codemation] Stopping..\n");
+			const children = [];
+			for (const child of [
+				state.currentUiNext,
+				state.currentNextHost,
+				state.currentGateway
+			]) if (child && child.exitCode === null && child.signalCode === null) children.push(child);
+			await Promise.all(children.map((child) => this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(child)));
+			process$1.stdout.write("[codemation] Stopped.\n");
+			state.stopResolve?.();
+		};
+		for (const signal of [
+			"SIGINT",
+			"SIGTERM",
+			"SIGQUIT"
+		]) process$1.on(signal, () => {
+			runShutdown();
+		});
+	}
+	/**
+	* Framework mode: run `next dev` for the Next host with HMR, pointed at the dev gateway runtime URL.
+	*/
+	spawnFrameworkNextHostWhenNeeded(prepared, state, gatewayBaseUrl) {
+		if (prepared.devMode !== "framework") return;
+		const websocketPort = prepared.gatewayPort;
+		const nextHostPackageJsonPath = this.require.resolve("@codemation/next-host/package.json");
+		const nextHostRoot = path.dirname(nextHostPackageJsonPath);
+		const nextHostEnvironment = this.session.nextHostEnvBuilder.build({
+			authConfigJson: prepared.authSettings.authConfigJson,
+			consumerRoot: prepared.paths.consumerRoot,
+			developmentServerToken: prepared.developmentServerToken,
+			nextPort: prepared.nextPort,
+			skipUiAuth: prepared.authSettings.skipUiAuth,
+			websocketPort,
+			runtimeDevUrl: gatewayBaseUrl
+		});
+		state.currentNextHost = spawn("pnpm", [
+			"exec",
+			"next",
+			"dev"
+		], {
+			cwd: nextHostRoot,
+			...this.devDetachedChildSpawnOptions(),
+			env: nextHostEnvironment
+		});
+		state.currentNextHost.on("exit", (code) => {
+			const normalizedCode = code ?? 0;
+			if (state.stopRequested) return;
+			if (normalizedCode === 0) {
+				state.stopRequested = true;
+				if (state.currentGateway?.exitCode === null) this.devTrackedProcessTreeKiller.killProcessTreeRootedAt(state.currentGateway);
+				state.stopResolve?.();
+				return;
+			}
+			state.stopRequested = true;
+			state.stopReject?.(/* @__PURE__ */ new Error(`next host exited with code ${normalizedCode}.`));
+		});
+		state.currentNextHost.on("error", (error) => {
+			if (!state.stopRequested) {
+				state.stopRequested = true;
+				state.stopReject?.(error instanceof Error ? error : new Error(String(error)));
+			}
+		});
+	}
+	async startWatcherForSourceRestart(prepared, watcher, devMode, gatewayBaseUrl) {
+		await watcher.start({
+			roots: this.session.watchRootsResolver.resolve({
+				consumerRoot: prepared.paths.consumerRoot,
+				devMode,
+				repoRoot: prepared.paths.repoRoot
+			}),
+			onChange: async ({ changedPaths }) => {
+				if (changedPaths.length > 0 && changedPaths.every((p) => this.consumerEnvDotenvFilePredicate.matches(p))) {
+					process$1.stdout.write("\n[codemation] Consumer environment file changed (e.g. .env). Restart the `codemation dev` process so the gateway and runtime pick up updated variables (host `process.env` does not hot-reload).\n");
+					return;
+				}
+				process$1.stdout.write("\n[codemation] Source change detected — rebuilding consumer…\n");
+				await this.session.sourceRestartCoordinator.runHandshakeAfterSourceChange(gatewayBaseUrl, prepared.developmentServerToken);
+				process$1.stdout.write("[codemation] Waiting for runtime to accept traffic…\n");
+				await this.session.devHttpProbe.waitUntilBootstrapSummaryReady(gatewayBaseUrl);
+				const json = await this.devBootstrapSummaryFetcher.fetch(gatewayBaseUrl);
+				if (json) this.devCliBannerRenderer.renderCompact(json);
+				process$1.stdout.write("[codemation] Runtime ready.\n");
+			}
+		});
+	}
+	logConsumerDevHintWhenNeeded(devMode, gatewayPort) {
+		if (devMode !== "consumer") return;
+		this.cliLogger.info(`codemation dev (consumer): open http://127.0.0.1:${gatewayPort} — requires a built @codemation/next-host (next build). For Next HMR use CODEMATION_DEV_MODE=framework.`);
+	}
+};
+
+//#endregion
+//#region src/commands/ServeWebCommand.ts
+var ServeWebCommand = class {
+	require = createRequire(import.meta.url);
+	constructor(pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, envLoader, listenPortResolver) {
+		this.pathResolver = pathResolver;
+		this.pluginDiscovery = pluginDiscovery;
+		this.artifactsPublisher = artifactsPublisher;
+		this.tsRuntime = tsRuntime;
+		this.sourceMapNodeOptions = sourceMapNodeOptions;
+		this.outputBuilderLoader = outputBuilderLoader;
+		this.envLoader = envLoader;
+		this.listenPortResolver = listenPortResolver;
+	}
+	async execute(consumerRoot, buildOptions) {
+		const paths = await this.pathResolver.resolve(consumerRoot);
+		this.tsRuntime.configure(paths.repoRoot);
+		const snapshot = await this.outputBuilderLoader.create(paths.consumerRoot, buildOptions).ensureBuilt();
+		const discoveredPlugins = await this.pluginDiscovery.discover(paths.consumerRoot);
+		const manifest = await this.artifactsPublisher.publish(snapshot, discoveredPlugins);
+		const nextHostRoot = path.dirname(this.require.resolve("@codemation/next-host/package.json"));
+		const consumerEnv = this.envLoader.load(paths.consumerRoot);
+		const nextPort = this.listenPortResolver.resolvePrimaryApplicationPort(process$1.env.PORT);
+		const websocketPort = this.listenPortResolver.resolveWebsocketPortRelativeToHttp({
+			nextPort,
+			publicWebsocketPort: process$1.env.NEXT_PUBLIC_CODEMATION_WS_PORT,
+			websocketPort: process$1.env.CODEMATION_WS_PORT
+		});
+		const child = spawn("pnpm", [
+			"exec",
+			"next",
+			"start"
+		], {
+			cwd: nextHostRoot,
+			stdio: "inherit",
+			env: {
+				...process$1.env,
+				...consumerEnv,
+				PORT: String(nextPort),
+				CODEMATION_CONSUMER_OUTPUT_MANIFEST_PATH: manifest.manifestPath,
+				CODEMATION_CONSUMER_ROOT: paths.consumerRoot,
+				CODEMATION_WS_PORT: String(websocketPort),
+				NEXT_PUBLIC_CODEMATION_WS_PORT: String(websocketPort),
+				NODE_OPTIONS: this.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS),
+				WS_NO_BUFFER_UTIL: "1",
+				WS_NO_UTF_8_VALIDATE: "1"
+			}
+		});
+		await new Promise((resolve, reject) => {
+			child.on("exit", (code) => {
+				if ((code ?? 0) === 0) {
+					resolve();
+					return;
+				}
+				reject(/* @__PURE__ */ new Error(`next start exited with code ${code ?? 0}.`));
+			});
+			child.on("error", reject);
+		});
+	}
+};
+
+//#endregion
+//#region src/commands/ServeWorkerCommand.ts
+var ServeWorkerCommand = class {
+	require = createRequire(import.meta.url);
+	constructor(sourceMapNodeOptions) {
+		this.sourceMapNodeOptions = sourceMapNodeOptions;
+	}
+	async execute(consumerRoot, configPathOverride) {
+		const workerPackageRoot = path.dirname(this.require.resolve("@codemation/worker-cli/package.json"));
+		const args = [path.join(workerPackageRoot, "bin", "codemation-worker.js")];
+		if (configPathOverride !== void 0 && configPathOverride.trim().length > 0) args.push("--config", path.resolve(process$1.cwd(), configPathOverride.trim()));
+		args.push("--consumer-root", consumerRoot);
+		const child = spawn(process$1.execPath, args, {
+			cwd: consumerRoot,
+			stdio: "inherit",
+			env: {
+				...process$1.env,
+				NODE_OPTIONS: this.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS)
+			}
+		});
+		await new Promise((resolve, reject) => {
+			child.on("exit", (code) => {
+				if ((code ?? 0) === 0) {
+					resolve();
+					return;
+				}
+				reject(/* @__PURE__ */ new Error(`codemation-worker exited with code ${code ?? 0}.`));
+			});
+			child.on("error", reject);
+		});
+	}
+};
+
+//#endregion
+//#region src/commands/UserCreateCommand.ts
+var UserCreateCommand = class {
+	constructor(localUserCreator, userAdminCliOptionsParser) {
+		this.localUserCreator = localUserCreator;
+		this.userAdminCliOptionsParser = userAdminCliOptionsParser;
+	}
+	async execute(opts) {
+		const options = {
+			...this.userAdminCliOptionsParser.parse(opts),
+			email: opts.email,
+			password: opts.password
+		};
+		await this.localUserCreator.run(options);
+	}
+};
+
+//#endregion
+//#region src/commands/UserListCommand.ts
+var UserListCommand = class {
+	constructor(cliLogger, userAdminBootstrap, databaseUrlDescriptor, userAdminCliOptionsParser) {
+		this.cliLogger = cliLogger;
+		this.userAdminBootstrap = userAdminBootstrap;
+		this.databaseUrlDescriptor = databaseUrlDescriptor;
+		this.userAdminCliOptionsParser = userAdminCliOptionsParser;
+	}
+	async execute(opts) {
+		await this.userAdminBootstrap.withSession(this.userAdminCliOptionsParser.parse(opts), async (session) => {
+			const where = this.databaseUrlDescriptor.describeForDisplay(process.env.DATABASE_URL);
+			const users = await session.getQueryBus().execute(new ListUserAccountsQuery());
+			if (users.length === 0) {
+				this.cliLogger.info(`No users found (${where}). If this is the wrong database, fix DATABASE_URL or CodemationConfig.runtime.database.url.`);
+				return;
+			}
+			this.cliLogger.info(`${where}\n${this.formatUserAccountsTable(users)}`);
+		});
+	}
+	formatUserAccountsTable(users) {
+		const headers = [
+			"Email",
+			"Status",
+			"Id",
+			"Login methods"
+		];
+		const rows = users.map((user) => [
+			user.email,
+			user.status,
+			user.id,
+			user.loginMethods.length > 0 ? user.loginMethods.join(", ") : "—"
+		]);
+		const columnCount = headers.length;
+		const widths = [];
+		for (let columnIndex = 0; columnIndex < columnCount; columnIndex += 1) {
+			const headerWidth = headers[columnIndex].length;
+			const cellWidths = rows.map((row) => row[columnIndex].length);
+			widths.push(Math.max(headerWidth, ...cellWidths, 3));
+		}
+		const padCell = (text, columnIndex) => text.padEnd(widths[columnIndex] ?? text.length);
+		const horizontal = `+${widths.map((width) => "-".repeat(width + 2)).join("+")}+`;
+		const formatRow = (cells) => `| ${cells.map((cell, index) => padCell(cell, index)).join(" | ")} |`;
+		return [
+			horizontal,
+			formatRow([...headers]),
+			horizontal,
+			...rows.map((row) => formatRow([...row])),
+			horizontal
+		].join("\n");
+	}
+};
+
+//#endregion
+//#region src/consumer/ConsumerCliTsconfigPreparation.ts
+/**
+* Ensures `CODEMATION_TSCONFIG_PATH` points at the repo's `tsconfig.codemation-tsx.json` when present,
+* so tsx can load consumer `codemation.config.ts` files that import decorator-using workspace packages.
+*/
+var ConsumerCliTsconfigPreparation = class {
+	applyWorkspaceTsconfigForTsxIfPresent(consumerRoot) {
+		if (process.env.CODEMATION_TSCONFIG_PATH && process.env.CODEMATION_TSCONFIG_PATH.trim().length > 0) return;
+		const resolvedRoot = path.resolve(consumerRoot);
+		const candidates = [
+			path.resolve(resolvedRoot, "tsconfig.codemation-tsx.json"),
+			path.resolve(resolvedRoot, "..", "tsconfig.codemation-tsx.json"),
+			path.resolve(resolvedRoot, "..", "..", "tsconfig.codemation-tsx.json")
+		];
+		for (const candidate of candidates) if (existsSync(candidate)) {
+			process.env.CODEMATION_TSCONFIG_PATH = candidate;
+			return;
+		}
+	}
+};
+
+//#endregion
+//#region src/consumer/ConsumerEnvLoader.ts
+/**
+* Loads the consumer project's dotenv files so `codemation dev` can forward them to the Next host.
+* Next.js runs from `packages/next-host` and does not read `apps/<consumer>/.env` automatically.
+*/
+var ConsumerEnvLoader = class {
+	load(consumerRoot) {
+		const merged = {};
+		for (const relativeName of [".env", ".env.local"]) {
+			const absolutePath = path.resolve(consumerRoot, relativeName);
+			if (!existsSync(absolutePath)) continue;
+			const parsed = parse(readFileSync(absolutePath, "utf8"));
+			for (const [key, value] of Object.entries(parsed)) if (value !== void 0) merged[key] = value;
+		}
+		return merged;
+	}
+	/**
+	* Merges consumer `.env` / `.env.local` values into a process environment snapshot.
+	* Consumer keys override the base snapshot for most variables. `DATABASE_URL` and `AUTH_SECRET`
+	* prefer the base (shell) when set, matching the dev Next host spawn behavior.
+	*/
+	mergeIntoProcessEnvironment(processEnv, consumerEnv) {
+		return {
+			...processEnv,
+			...consumerEnv,
+			DATABASE_URL: processEnv.DATABASE_URL ?? consumerEnv.DATABASE_URL,
+			AUTH_SECRET: processEnv.AUTH_SECRET ?? consumerEnv.AUTH_SECRET
+		};
+	}
+	mergeConsumerRootIntoProcessEnvironment(consumerRoot, processEnv) {
+		return this.mergeIntoProcessEnvironment(processEnv, this.load(consumerRoot));
+	}
+};
+
+//#endregion
+//#region src/consumer/ConsumerOutputBuilder.ts
+const defaultConsumerOutputLogger = new ServerLoggerFactory(logLevelPolicyFactory).create("codemation-cli.consumer-output");
+const defaultConsumerBuildOptions = Object.freeze({
+	sourceMaps: true,
+	target: "es2022"
+});
+var ConsumerOutputBuilder = class ConsumerOutputBuilder {
+	static ignoredDirectoryNames = new Set([
+		".codemation",
+		".git",
+		"dist",
+		"node_modules"
+	]);
+	static supportedSourceExtensions = new Set([
+		".ts",
+		".tsx",
+		".mts",
+		".cts"
+	]);
+	static watchBuildDebounceMs = 75;
+	workflowModulePathFinder = new WorkflowModulePathFinder();
+	/** Last promoted build output used to copy-forward unchanged emitted files on incremental watch builds. */
+	lastPromotedSnapshot = null;
+	pendingWatchEvents = [];
+	activeBuildPromise = null;
+	watcher = null;
+	watchBuildLoopPromise = null;
+	watchBuildDebounceTimeout = null;
+	hasQueuedWatchEvent = false;
+	hasPendingWatchBuild = false;
+	lastIssuedBuildVersion = 0;
+	log;
+	buildOptions;
+	constructor(consumerRoot, logOverride, buildOptionsOverride) {
+		this.consumerRoot = consumerRoot;
+		this.log = logOverride ?? defaultConsumerOutputLogger;
+		this.buildOptions = buildOptionsOverride ?? defaultConsumerBuildOptions;
+	}
+	async ensureBuilt() {
+		if (!this.activeBuildPromise) this.activeBuildPromise = this.buildInternal();
+		return await this.activeBuildPromise;
+	}
+	/**
+	* Stops the chokidar watcher and clears debounce timers. Safe to call when not watching.
+	* Used by tests and for clean shutdown when tearing down a dev session.
+	*/
+	async disposeWatching() {
+		if (this.watchBuildDebounceTimeout) {
+			clearTimeout(this.watchBuildDebounceTimeout);
+			this.watchBuildDebounceTimeout = null;
+		}
+		if (this.watcher) {
+			await this.watcher.close();
+			this.watcher = null;
+		}
+		this.watchBuildLoopPromise = null;
+	}
+	async ensureWatching(args) {
+		if (this.watcher) return;
+		this.watcher = watch([this.consumerRoot], {
+			ignoreInitial: true,
+			ignored: this.createIgnoredMatcher()
+		});
+		this.watcher.on("all", (eventName, rawPath) => {
+			if (typeof rawPath === "string" && rawPath.length > 0) this.pendingWatchEvents.push({
+				event: eventName,
+				path: path.resolve(rawPath)
+			});
+			this.scheduleWatchBuild(args);
+		});
+	}
+	async flushWatchBuilds(args) {
+		try {
+			while (this.hasPendingWatchBuild) {
+				this.hasPendingWatchBuild = false;
+				if (args.onBuildStarted) await args.onBuildStarted();
+				try {
+					const watchEvents = this.takePendingWatchEvents();
+					this.activeBuildPromise = this.buildInternal({ watchEvents });
+					await args.onBuildCompleted(await this.activeBuildPromise);
+				} catch (error) {
+					const exception = error instanceof Error ? error : new Error(String(error));
+					if (args.onBuildFailed && !this.hasPendingWatchBuild && !this.hasQueuedWatchEvent) await args.onBuildFailed(exception);
+					this.log.error("consumer output rebuild failed", exception);
+				}
+			}
+		} finally {
+			this.watchBuildLoopPromise = null;
+			if (this.hasPendingWatchBuild) this.watchBuildLoopPromise = this.flushWatchBuilds(args);
+		}
+	}
+	takePendingWatchEvents() {
+		const events = [...this.pendingWatchEvents];
+		this.pendingWatchEvents = [];
+		return events;
+	}
+	async buildInternal(options) {
+		const watchEvents = options?.watchEvents ?? [];
+		const configSourcePath = await this.resolveConfigPath(this.consumerRoot);
+		if (watchEvents.length > 0 && this.lastPromotedSnapshot !== null && configSourcePath !== null && !this.requiresFullConsumerRebuild(watchEvents, configSourcePath)) {
+			const changedSourcePaths = this.resolveIncrementalEmitSourcePaths(watchEvents);
+			if (changedSourcePaths.length > 0) try {
+				await access(this.lastPromotedSnapshot.emitOutputRoot);
+				const snapshot$1 = await this.buildInternalIncremental(changedSourcePaths);
+				this.lastPromotedSnapshot = snapshot$1;
+				return snapshot$1;
+			} catch {}
+		}
+		const snapshot = await this.buildInternalFull();
+		this.lastPromotedSnapshot = snapshot;
+		return snapshot;
+	}
+	requiresFullConsumerRebuild(events, configSourcePath) {
+		const resolvedConfig = path.resolve(configSourcePath);
+		for (const entry of events) {
+			if (entry.event !== "change") return true;
+			if (path.resolve(entry.path) === resolvedConfig) return true;
+			if (this.shouldCopyAssetPath(entry.path)) return true;
+		}
+		return false;
+	}
+	resolveIncrementalEmitSourcePaths(events) {
+		const uniquePaths = /* @__PURE__ */ new Set();
+		for (const entry of events) {
+			if (entry.event !== "change") return [];
+			if (this.shouldCopyAssetPath(entry.path)) return [];
+			if (!this.shouldEmitSourcePath(entry.path)) continue;
+			uniquePaths.add(path.resolve(entry.path));
+		}
+		return [...uniquePaths];
+	}
+	async prepareEmitBuildSnapshot(args) {
+		const outputRoot = this.resolveOutputRoot();
+		const finalBuildRoot = this.resolveFinalBuildOutputRoot();
+		const stagingBuildRoot = this.resolveStagingBuildRoot(args.buildVersion);
+		const outputAppRoot = path.resolve(stagingBuildRoot, "app");
+		const configMetadata = await this.loadConfigMetadata(args.configSourcePath);
+		const workflowSourcePaths = await this.resolveWorkflowSources(this.consumerRoot, configMetadata);
+		const pathSegmentsComputer = new WorkflowDiscoveryPathSegmentsComputer();
+		const workflowDiscoveryPathSegmentsList = workflowSourcePaths.map((sourcePath) => {
+			return pathSegmentsComputer.compute({
+				consumerRoot: this.consumerRoot,
+				workflowDiscoveryDirectories: configMetadata.workflowDiscoveryDirectories,
+				absoluteWorkflowModulePath: sourcePath
+			}) ?? [];
+		});
+		return {
+			stagedSnapshot: {
+				buildVersion: args.buildVersion,
+				configSourcePath: args.configSourcePath,
+				consumerRoot: this.consumerRoot,
+				manifestPath: this.resolveCurrentManifestPath(),
+				outputEntryPath: path.resolve(stagingBuildRoot, "index.js"),
+				outputRoot,
+				emitOutputRoot: stagingBuildRoot,
+				workflowSourcePaths,
+				workflowDiscoveryPathSegmentsList
+			},
+			outputAppRoot,
+			finalBuildRoot,
+			stagingBuildRoot
+		};
+	}
+	async emitStagingBuildAndPromote(args) {
+		let promoted = false;
+		try {
+			await args.emitOutputFiles();
+			await this.writeEntryFile({
+				configSourcePath: args.configSourcePath,
+				outputAppRoot: args.outputAppRoot,
+				snapshot: args.stagedSnapshot
+			});
+			await this.promoteStagingToFinalBuild({
+				finalBuildRoot: args.finalBuildRoot,
+				stagingBuildRoot: args.stagingBuildRoot
+			});
+			promoted = true;
+			return {
+				...args.stagedSnapshot,
+				outputEntryPath: path.resolve(args.finalBuildRoot, "index.js"),
+				emitOutputRoot: args.finalBuildRoot
+			};
+		} finally {
+			if (!promoted) await rm(args.stagingBuildRoot, {
+				force: true,
+				recursive: true
+			}).catch(() => null);
+		}
+	}
+	async buildInternalIncremental(changedSourcePaths) {
+		const previous = this.lastPromotedSnapshot;
+		if (!previous) throw new Error("Incremental consumer build requires a previous successful build output.");
+		const configSourcePath = await this.resolveConfigPath(this.consumerRoot);
+		if (!configSourcePath) throw new Error("Codemation config not found. Expected \"codemation.config.ts\" in the consumer project root or \"src/\".");
+		const runtimeSourcePaths = await this.collectRuntimeSourcePaths();
+		const runtimeSourceSet = new Set(runtimeSourcePaths.map((sourcePath) => path.resolve(sourcePath)));
+		for (const changedPath of changedSourcePaths) if (!runtimeSourceSet.has(path.resolve(changedPath))) throw new Error("Incremental build saw a changed path outside the current runtime source set; rebuild full.");
+		const buildVersion = this.createBuildVersion();
+		const { stagedSnapshot, outputAppRoot, finalBuildRoot, stagingBuildRoot } = await this.prepareEmitBuildSnapshot({
+			configSourcePath,
+			buildVersion
+		});
+		return await this.emitStagingBuildAndPromote({
+			configSourcePath,
+			stagedSnapshot,
+			outputAppRoot,
+			finalBuildRoot,
+			stagingBuildRoot,
+			emitOutputFiles: async () => {
+				await cp(previous.emitOutputRoot, stagingBuildRoot, { recursive: true });
+				for (const sourcePath of changedSourcePaths) await this.emitSourceFile({
+					outputAppRoot,
+					sourcePath
+				});
+			}
+		});
+	}
+	async buildInternalFull() {
+		const configSourcePath = await this.resolveConfigPath(this.consumerRoot);
+		if (!configSourcePath) throw new Error("Codemation config not found. Expected \"codemation.config.ts\" in the consumer project root or \"src/\".");
+		const runtimeSourcePaths = await this.collectRuntimeSourcePaths();
+		const buildVersion = this.createBuildVersion();
+		const { stagedSnapshot, outputAppRoot, finalBuildRoot, stagingBuildRoot } = await this.prepareEmitBuildSnapshot({
+			configSourcePath,
+			buildVersion
+		});
+		return await this.emitStagingBuildAndPromote({
+			configSourcePath,
+			stagedSnapshot,
+			outputAppRoot,
+			finalBuildRoot,
+			stagingBuildRoot,
+			emitOutputFiles: async () => {
+				for (const sourcePath of runtimeSourcePaths) {
+					if (this.shouldCopyAssetPath(sourcePath)) {
+						await this.copyAssetFile({
+							outputAppRoot,
+							sourcePath
+						});
+						continue;
+					}
+					await this.emitSourceFile({
+						outputAppRoot,
+						sourcePath
+					});
+				}
+			}
+		});
+	}
+	scheduleWatchBuild(args) {
+		this.hasQueuedWatchEvent = true;
+		if (this.watchBuildDebounceTimeout) clearTimeout(this.watchBuildDebounceTimeout);
+		this.watchBuildDebounceTimeout = setTimeout(() => {
+			this.watchBuildDebounceTimeout = null;
+			this.hasQueuedWatchEvent = false;
+			this.hasPendingWatchBuild = true;
+			if (!this.watchBuildLoopPromise) this.watchBuildLoopPromise = this.flushWatchBuilds(args);
+		}, ConsumerOutputBuilder.watchBuildDebounceMs);
+	}
+	async collectRuntimeSourcePaths() {
+		const sourcePaths = [];
+		await this.collectSourcePathsRecursively(this.consumerRoot, sourcePaths);
+		return sourcePaths.filter((sourcePath) => this.shouldEmitSourcePath(sourcePath)).sort((left, right) => left.localeCompare(right));
+	}
+	async collectSourcePathsRecursively(directoryPath, sourcePaths) {
+		const entries = await readdir(directoryPath, { withFileTypes: true });
+		for (const entry of entries) {
+			const entryPath = path.resolve(directoryPath, entry.name);
+			if (entry.isDirectory()) {
+				if (ConsumerOutputBuilder.ignoredDirectoryNames.has(entry.name)) continue;
+				await this.collectSourcePathsRecursively(entryPath, sourcePaths);
+				continue;
+			}
+			sourcePaths.push(entryPath);
+		}
+	}
+	shouldEmitSourcePath(sourcePath) {
+		if (this.shouldCopyAssetPath(sourcePath)) return true;
+		if (sourcePath.endsWith(".d.ts")) return false;
+		const extension = path.extname(sourcePath);
+		return ConsumerOutputBuilder.supportedSourceExtensions.has(extension);
+	}
+	shouldCopyAssetPath(sourcePath) {
+		const fileName = path.basename(sourcePath);
+		return fileName === ".env" || fileName.startsWith(".env.");
+	}
+	async copyAssetFile(args) {
+		const outputPath = path.resolve(args.outputAppRoot, this.toConsumerRelativePath(args.sourcePath));
+		await mkdir(path.dirname(outputPath), { recursive: true });
+		await copyFile(args.sourcePath, outputPath);
+	}
+	async emitSourceFile(args) {
+		const sourceText = await readFile(args.sourcePath, "utf8");
+		const transpiledOutput = ts.transpileModule(sourceText, {
+			compilerOptions: this.createCompilerOptions(),
+			fileName: args.sourcePath,
+			reportDiagnostics: false
+		});
+		const rewrittenOutputText = await this.rewriteRelativeImportSpecifiers(args.sourcePath, transpiledOutput.outputText);
+		const outputPath = this.resolveOutputPath(args.outputAppRoot, args.sourcePath);
+		await mkdir(path.dirname(outputPath), { recursive: true });
+		await writeFile(outputPath, rewrittenOutputText, "utf8");
+		if (transpiledOutput.sourceMapText) await writeFile(`${outputPath}.map`, transpiledOutput.sourceMapText, "utf8");
+	}
+	createCompilerOptions() {
+		const scriptTarget = this.buildOptions.target === "es2020" ? ts.ScriptTarget.ES2020 : ts.ScriptTarget.ES2022;
+		return {
+			emitDecoratorMetadata: true,
+			esModuleInterop: true,
+			experimentalDecorators: true,
+			inlineSources: this.buildOptions.sourceMaps,
+			jsx: ts.JsxEmit.ReactJSX,
+			module: ts.ModuleKind.ESNext,
+			sourceMap: this.buildOptions.sourceMaps,
+			target: scriptTarget,
+			useDefineForClassFields: false
+		};
+	}
+	async writeEntryFile(args) {
+		const configImportPath = this.resolveOutputImportPath(args.outputAppRoot, args.snapshot.outputEntryPath, args.configSourcePath);
+		if (!configImportPath) throw new Error("Consumer output build requires a resolved codemation config source.");
+		const workflowImportBlocks = args.snapshot.workflowSourcePaths.map((workflowSourcePath, index) => {
+			const importPath = this.resolveOutputImportPath(args.outputAppRoot, args.snapshot.outputEntryPath, workflowSourcePath);
+			if (!importPath) throw new Error(`Could not resolve workflow output path: ${workflowSourcePath}`);
+			return `import * as workflowModule${index} from "${importPath}";`;
+		}).join("\n");
+		const workflowModulesExpression = args.snapshot.workflowSourcePaths.length > 0 ? `[${args.snapshot.workflowSourcePaths.map((_, index) => `workflowModule${index}`).join(", ")}]` : "[]";
+		const workflowSourcePathsExpression = args.snapshot.workflowSourcePaths.length > 0 ? `[${args.snapshot.workflowSourcePaths.map((workflowSourcePath) => JSON.stringify(workflowSourcePath)).join(", ")}]` : "[]";
+		const workflowDiscoveryPathSegmentsListExpression = JSON.stringify(args.snapshot.workflowDiscoveryPathSegmentsList);
+		const outputText = [
+			`import * as configModule from "${configImportPath}";`,
+			"import { CodemationConsumerAppResolver } from \"@codemation/host/consumer\";",
+			workflowImportBlocks,
+			"const resolver = new CodemationConsumerAppResolver();",
+			`export const codemationConsumerBuildVersion = ${JSON.stringify(args.snapshot.buildVersion)};`,
+			`export const codemationConsumerApp = resolver.resolve({`,
+			"  configModule,",
+			`  workflowModules: ${workflowModulesExpression},`,
+			`  workflowSourcePaths: ${workflowSourcePathsExpression},`,
+			`  workflowDiscoveryPathSegmentsList: ${workflowDiscoveryPathSegmentsListExpression},`,
+			"});",
+			"export default codemationConsumerApp;",
+			""
+		].filter((line) => line.length > 0).join("\n");
+		await writeFile(args.snapshot.outputEntryPath, outputText, "utf8");
+	}
+	async rewriteRelativeImportSpecifiers(sourcePath, outputText) {
+		let nextOutputText = await this.rewritePatternMatches(sourcePath, outputText, /(from\s+["'])(\.{1,2}\/[^"']+)(["'])/g);
+		nextOutputText = await this.rewritePatternMatches(sourcePath, nextOutputText, /(import\s+["'])(\.{1,2}\/[^"']+)(["'])/g);
+		nextOutputText = await this.rewritePatternMatches(sourcePath, nextOutputText, /(import\s*\(\s*["'])(\.{1,2}\/[^"']+)(["']\s*\))/g);
+		return nextOutputText;
+	}
+	async rewritePatternMatches(sourcePath, outputText, pattern) {
+		const matches = [...outputText.matchAll(pattern)];
+		let rewrittenText = outputText;
+		for (const match of matches) {
+			const currentSpecifier = match[2];
+			const nextSpecifier = await this.resolveRelativeRuntimeSpecifier(sourcePath, currentSpecifier);
+			if (nextSpecifier === currentSpecifier) continue;
+			rewrittenText = rewrittenText.replace(`${match[1]}${currentSpecifier}${match[3]}`, `${match[1]}${nextSpecifier}${match[3]}`);
+		}
+		return rewrittenText;
+	}
+	async resolveRelativeRuntimeSpecifier(sourcePath, importSpecifier) {
+		if (!importSpecifier.startsWith(".")) return importSpecifier;
+		const extension = path.extname(importSpecifier);
+		if (this.isRuntimeExtension(extension)) return importSpecifier;
+		if (this.isSourceExtension(extension)) return `${importSpecifier.slice(0, importSpecifier.length - extension.length)}${this.toJavascriptExtension(extension)}`;
+		const resolvedSpecifier = await this.resolveFileImportSpecifier(sourcePath, importSpecifier);
+		if (resolvedSpecifier) return resolvedSpecifier;
+		return await this.resolveIndexImportSpecifier(sourcePath, importSpecifier) ?? importSpecifier;
+	}
+	async resolveFileImportSpecifier(sourcePath, importSpecifier) {
+		const resolvedBasePath = path.resolve(path.dirname(sourcePath), importSpecifier);
+		for (const sourceExtension of ConsumerOutputBuilder.supportedSourceExtensions) if (await this.fileExists(`${resolvedBasePath}${sourceExtension}`)) return `${importSpecifier}${this.toJavascriptExtension(sourceExtension)}`;
+		return null;
+	}
+	async resolveIndexImportSpecifier(sourcePath, importSpecifier) {
+		const resolvedDirectoryPath = path.resolve(path.dirname(sourcePath), importSpecifier);
+		for (const sourceExtension of ConsumerOutputBuilder.supportedSourceExtensions) {
+			const indexSourcePath = path.resolve(resolvedDirectoryPath, `index${sourceExtension}`);
+			if (await this.fileExists(indexSourcePath)) return `${importSpecifier}/index${this.toJavascriptExtension(sourceExtension)}`;
+		}
+		return null;
+	}
+	resolveOutputImportPath(outputAppRoot, outputEntryPath, sourcePath) {
+		if (!sourcePath) return null;
+		const outputPath = this.resolveOutputPath(outputAppRoot, sourcePath);
+		const relativePath = path.relative(path.dirname(outputEntryPath), outputPath).replace(/\\/g, "/");
+		return relativePath.startsWith(".") ? relativePath : `./${relativePath}`;
+	}
+	resolveOutputPath(outputAppRoot, sourcePath) {
+		const relativePath = this.toConsumerRelativePath(sourcePath);
+		const nextExtension = this.toJavascriptExtension(path.extname(relativePath));
+		const pathWithoutExtension = relativePath.slice(0, relativePath.length - path.extname(relativePath).length);
+		return path.resolve(outputAppRoot, `${pathWithoutExtension}${nextExtension}`);
+	}
+	resolveOutputRoot() {
+		return path.resolve(this.consumerRoot, ".codemation", "output");
+	}
+	resolveFinalBuildOutputRoot() {
+		return path.resolve(this.resolveOutputRoot(), "build");
+	}
+	resolveStagingBuildRoot(buildVersion) {
+		return path.resolve(this.resolveOutputRoot(), "staging", `${buildVersion}-${randomUUID()}`);
+	}
+	resolveCurrentManifestPath() {
+		return path.resolve(this.resolveOutputRoot(), "current.json");
+	}
+	async promoteStagingToFinalBuild(args) {
+		await mkdir(path.dirname(args.finalBuildRoot), { recursive: true });
+		await rm(args.finalBuildRoot, {
+			force: true,
+			recursive: true
+		}).catch(() => null);
+		await rename(args.stagingBuildRoot, args.finalBuildRoot);
+	}
+	isRuntimeExtension(extension) {
+		return extension === ".cjs" || extension === ".js" || extension === ".json" || extension === ".mjs";
+	}
+	isSourceExtension(extension) {
+		return ConsumerOutputBuilder.supportedSourceExtensions.has(extension);
+	}
+	toJavascriptExtension(extension) {
+		if (extension === ".cts") return ".cjs";
+		if (extension === ".mts") return ".mjs";
+		return ".js";
+	}
+	createIgnoredMatcher() {
+		return (watchPath) => {
+			const relativePath = path.relative(this.consumerRoot, watchPath);
+			if (relativePath.startsWith("..")) return false;
+			return relativePath.replace(/\\/g, "/").split("/").some((segment) => ConsumerOutputBuilder.ignoredDirectoryNames.has(segment));
+		};
+	}
+	toConsumerRelativePath(filePath) {
+		return path.relative(this.consumerRoot, filePath);
+	}
+	createBuildVersion() {
+		const nextBuildVersion = Math.max(Date.now(), this.lastIssuedBuildVersion + 1);
+		this.lastIssuedBuildVersion = nextBuildVersion;
+		return `${nextBuildVersion}-${process$1.pid}`;
+	}
+	async resolveConfigPath(consumerRoot) {
+		for (const candidate of this.getConventionCandidates(consumerRoot)) if (await this.fileExists(candidate)) return candidate;
+		return null;
+	}
+	getConventionCandidates(consumerRoot) {
+		return [
+			path.resolve(consumerRoot, "codemation.config.ts"),
+			path.resolve(consumerRoot, "codemation.config.js"),
+			path.resolve(consumerRoot, "src", "codemation.config.ts"),
+			path.resolve(consumerRoot, "src", "codemation.config.js")
+		];
+	}
+	async loadConfigMetadata(configSourcePath) {
+		const sourceText = await readFile(configSourcePath, "utf8");
+		const sourceFile = ts.createSourceFile(configSourcePath, sourceText, ts.ScriptTarget.Latest, true, this.resolveScriptKind(configSourcePath));
+		const configObjectLiteral = this.resolveConfigObjectLiteral(sourceFile);
+		if (!configObjectLiteral) return {
+			hasInlineWorkflows: false,
+			workflowDiscoveryDirectories: [...WorkflowModulePathFinder.defaultWorkflowDirectories]
+		};
+		const workflowDiscovery = this.readObjectLiteralProperty(configObjectLiteral, "workflowDiscovery");
+		const workflowDiscoveryDirectories = this.readStringArrayProperty(workflowDiscovery, "directories");
+		return {
+			hasInlineWorkflows: this.hasProperty(configObjectLiteral, "workflows"),
+			workflowDiscoveryDirectories: workflowDiscoveryDirectories.length > 0 ? workflowDiscoveryDirectories : [...WorkflowModulePathFinder.defaultWorkflowDirectories]
+		};
+	}
+	resolveScriptKind(filePath) {
+		const extension = path.extname(filePath);
+		if (extension === ".js" || extension === ".mjs" || extension === ".cjs") return ts.ScriptKind.JS;
+		if (extension === ".tsx") return ts.ScriptKind.TSX;
+		return ts.ScriptKind.TS;
+	}
+	resolveConfigObjectLiteral(sourceFile) {
+		const objectLiteralsByIdentifier = /* @__PURE__ */ new Map();
+		const exportedObjectLiterals = [];
+		for (const statement of sourceFile.statements) {
+			if (!ts.isVariableStatement(statement)) continue;
+			const isExported = this.hasExportModifier(statement);
+			for (const declaration of statement.declarationList.declarations) {
+				if (!ts.isIdentifier(declaration.name)) continue;
+				const objectLiteral = this.unwrapObjectLiteralExpression(declaration.initializer);
+				if (!objectLiteral) continue;
+				objectLiteralsByIdentifier.set(declaration.name.text, objectLiteral);
+				if (isExported) exportedObjectLiterals.push(objectLiteral);
+			}
+		}
+		for (const statement of sourceFile.statements) {
+			if (!ts.isExportAssignment(statement)) continue;
+			const directObjectLiteral = this.unwrapObjectLiteralExpression(statement.expression);
+			if (directObjectLiteral) return directObjectLiteral;
+			if (ts.isIdentifier(statement.expression)) {
+				const resolvedObjectLiteral = objectLiteralsByIdentifier.get(statement.expression.text);
+				if (resolvedObjectLiteral) return resolvedObjectLiteral;
+			}
+		}
+		const namedConfigLiteral = objectLiteralsByIdentifier.get("codemationHost") ?? objectLiteralsByIdentifier.get("config");
+		if (namedConfigLiteral) return namedConfigLiteral;
+		return exportedObjectLiterals[0] ?? null;
+	}
+	hasExportModifier(statement) {
+		return ts.canHaveModifiers(statement) ? ts.getModifiers(statement)?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) ?? false : false;
+	}
+	unwrapObjectLiteralExpression(node) {
+		if (!node) return null;
+		if (ts.isObjectLiteralExpression(node)) return node;
+		if (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node)) return this.unwrapObjectLiteralExpression(node.expression);
+		return null;
+	}
+	hasProperty(objectLiteral, propertyName) {
+		return this.getPropertyAssignment(objectLiteral, propertyName) !== null;
+	}
+	readObjectLiteralProperty(objectLiteral, propertyName) {
+		const property = this.getPropertyAssignment(objectLiteral, propertyName);
+		return this.unwrapObjectLiteralExpression(property?.initializer);
+	}
+	readStringArrayProperty(objectLiteral, propertyName) {
+		if (!objectLiteral) return [];
+		const property = this.getPropertyAssignment(objectLiteral, propertyName);
+		if (!property || !ts.isArrayLiteralExpression(property.initializer)) return [];
+		const values = [];
+		for (const element of property.initializer.elements) if (ts.isStringLiteralLike(element)) values.push(element.text);
+		return values;
+	}
+	getPropertyAssignment(objectLiteral, propertyName) {
+		for (const property of objectLiteral.properties) {
+			if (!ts.isPropertyAssignment(property)) continue;
+			if (this.readPropertyName(property.name) === propertyName) return property;
+		}
+		return null;
+	}
+	readPropertyName(propertyName) {
+		if (ts.isIdentifier(propertyName) || ts.isStringLiteralLike(propertyName)) return propertyName.text;
+		return null;
+	}
+	async resolveWorkflowSources(consumerRoot, configMetadata) {
+		if (configMetadata.hasInlineWorkflows) return [];
+		return [...await this.workflowModulePathFinder.discoverModulePaths({
+			consumerRoot,
+			workflowDirectories: configMetadata.workflowDiscoveryDirectories,
+			exists: (absolutePath) => this.fileExists(absolutePath)
+		})].sort((left, right) => left.localeCompare(right));
+	}
+	async fileExists(filePath) {
+		try {
+			await stat(filePath);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+
+//#endregion
+//#region src/consumer/Loader.ts
+var ConsumerOutputBuilderLoader = class {
+	create(consumerRoot, buildOptions) {
+		return new ConsumerOutputBuilder(consumerRoot, void 0, buildOptions);
+	}
+};
+
+//#endregion
+//#region src/database/ConsumerDatabaseConnectionResolver.ts
+/**
+* Resolves TCP PostgreSQL vs PGlite vs none from env + {@link CodemationConfig} (same rules as the host runtime).
+*/
+var ConsumerDatabaseConnectionResolver = class {
+	resolver = new DatabasePersistenceResolver();
+	resolve(processEnv, config$1, consumerRoot) {
+		return this.resolver.resolve({
+			runtimeConfig: config$1.runtime ?? {},
+			env: processEnv,
+			consumerRoot
+		});
+	}
+};
+
+//#endregion
+//#region src/database/DatabaseMigrationsApplyService.ts
+/**
+* Loads consumer config + env, resolves persistence, and runs Prisma migrations.
+* Shared by `codemation db migrate` and `codemation dev` (cold start only).
+*/
+var DatabaseMigrationsApplyService = class {
+	constructor(cliLogger, consumerDotenvLoader, tsconfigPreparation, configLoader, databaseConnectionResolver, databaseUrlDescriptor, hostPackageRoot, migrationDeployer) {
+		this.cliLogger = cliLogger;
+		this.consumerDotenvLoader = consumerDotenvLoader;
+		this.tsconfigPreparation = tsconfigPreparation;
+		this.configLoader = configLoader;
+		this.databaseConnectionResolver = databaseConnectionResolver;
+		this.databaseUrlDescriptor = databaseUrlDescriptor;
+		this.hostPackageRoot = hostPackageRoot;
+		this.migrationDeployer = migrationDeployer;
+	}
+	/**
+	* Applies migrations when persistence is configured; no-op when there is no database (in-memory dev).
+	*/
+	async applyForConsumer(consumerRoot, options) {
+		await this.applyInternal(consumerRoot, options, false);
+	}
+	/**
+	* Same as {@link applyForConsumer} but throws when no database is configured (for `db migrate`).
+	*/
+	async applyForConsumerRequiringPersistence(consumerRoot, options) {
+		await this.applyInternal(consumerRoot, options, true);
+	}
+	async applyInternal(consumerRoot, options, requirePersistence) {
+		this.consumerDotenvLoader.load(consumerRoot);
+		this.tsconfigPreparation.applyWorkspaceTsconfigForTsxIfPresent(consumerRoot);
+		const resolution = await this.configLoader.load({
+			consumerRoot,
+			configPathOverride: options?.configPath
+		});
+		const persistence = this.databaseConnectionResolver.resolve(process.env, resolution.config, consumerRoot);
+		if (persistence.kind === "none") {
+			if (requirePersistence) throw new Error("Database persistence is not configured. Set CodemationConfig.runtime.database (postgresql URL or PGlite).");
+			return;
+		}
+		process.env.CODEMATION_HOST_PACKAGE_ROOT = this.hostPackageRoot;
+		this.cliLogger.debug(`Applying database migrations (${this.databaseUrlDescriptor.describePersistence(persistence)})`);
+		await this.migrationDeployer.deployPersistence(persistence, process.env);
+		this.cliLogger.info(`Database migrations applied (${this.databaseUrlDescriptor.describePersistence(persistence)}).`);
+	}
+};
+
+//#endregion
+//#region src/database/HostPackageRootResolver.ts
+/**
+* Locates the installed `@codemation/host` package root (contains `prisma/` and Prisma CLI).
+* Uses ESM resolution (`@codemation/host` does not expose a CJS `require` entry).
+*/
+var HostPackageRootResolver = class {
+	resolveHostPackageRoot() {
+		const entry = fileURLToPath(import.meta.resolve("@codemation/host"));
+		let dir = path.dirname(entry);
+		for (let depth = 0; depth < 8; depth += 1) {
+			if (existsSync(path.join(dir, "prisma", "schema.prisma"))) return dir;
+			const parent = path.dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+		throw new Error(`Could not locate prisma/schema.prisma near @codemation/host entry: ${entry}`);
+	}
+};
+
+//#endregion
+//#region src/dev/DevBootstrapSummaryFetcher.ts
+/**
+* Fetches {@link DevBootstrapSummaryJson} from the dev gateway (proxied to runtime-dev).
+*/
+var DevBootstrapSummaryFetcher = class {
+	async fetch(gatewayBaseUrl) {
+		const normalized = gatewayBaseUrl.replace(/\/$/, "");
+		const response = await fetch(`${normalized}/api/dev/bootstrap-summary`);
+		if (!response.ok) return null;
+		return await response.json();
+	}
+};
+
+//#endregion
+//#region src/dev/DevCliBannerRenderer.ts
+/**
+* Dev-only stdout branding (not the structured host logger).
+* Renders the figlet banner once on cold start; append-only compact block after hot reload.
+*/
+var DevCliBannerRenderer = class {
+	/**
+	* Figlet header only — call early so branding appears before migrations / gateway work.
+	*/
+	renderBrandHeader() {
+		const headerBox = boxen(`${this.renderFigletTitle()}\n${chalk.dim.italic("AI Automation framework")}`, {
+			padding: {
+				top: 0,
+				bottom: 1,
+				left: 1,
+				right: 1
+			},
+			margin: { bottom: 0 },
+			borderStyle: "double",
+			borderColor: "cyan",
+			textAlignment: "center"
+		});
+		process.stdout.write(`${headerBox}\n`);
+	}
+	/**
+	* Runtime detail + active workflows (after bootstrap summary is available).
+	*/
+	renderRuntimeSummary(summary) {
+		const detailBox = boxen(this.buildDetailBody(summary), {
+			padding: {
+				top: 0,
+				bottom: 0,
+				left: 1,
+				right: 1
+			},
+			margin: {
+				top: 1,
+				bottom: 0
+			},
+			borderStyle: "round",
+			borderColor: "gray",
+			dimBorder: true,
+			title: chalk.bold("Runtime"),
+			titleAlignment: "center"
+		});
+		const activeSection = this.buildActiveWorkflowsSection(summary);
+		process.stdout.write(`${detailBox}\n${activeSection}\n`);
+	}
+	renderFull(summary) {
+		this.renderBrandHeader();
+		this.renderRuntimeSummary(summary);
+	}
+	/**
+	* Shown after hot reload / watcher restarts (no figlet).
+	*/
+	renderCompact(summary) {
+		const detailBox = boxen(this.buildDetailBody(summary), {
+			padding: {
+				top: 0,
+				bottom: 0,
+				left: 1,
+				right: 1
+			},
+			margin: {
+				top: 1,
+				bottom: 0
+			},
+			borderStyle: "round",
+			borderColor: "gray",
+			dimBorder: true,
+			title: chalk.bold("Runtime (updated)"),
+			titleAlignment: "center"
+		});
+		const activeSection = this.buildActiveWorkflowsSection(summary);
+		process.stdout.write(`\n${detailBox}\n${activeSection}\n`);
+	}
+	renderFigletTitle() {
+		try {
+			return chalk.cyan(figlet.textSync("Codemation", { font: "Slant" }));
+		} catch {
+			return chalk.cyan.bold("Codemation");
+		}
+	}
+	buildDetailBody(summary) {
+		const label = (text) => chalk.hex("#9ca3af")(text);
+		const value = (text) => chalk.whiteBright(text);
+		const lines = [
+			`${label("Log level")}     ${value(summary.logLevel)}`,
+			`${label("Database")}     ${value(summary.databaseLabel)}`,
+			`${label("Scheduler")}    ${value(summary.schedulerLabel)}`,
+			`${label("Event bus")}    ${value(summary.eventBusLabel)}`
+		];
+		if (summary.redisUrlRedacted) lines.push(`${label("Redis")}        ${value(summary.redisUrlRedacted)}`);
+		return lines.join("\n");
+	}
+	buildActiveWorkflowsSection(summary) {
+		return boxen((summary.activeWorkflows.length === 0 ? [chalk.dim("  (none active)")] : summary.activeWorkflows.map((w) => `${chalk.whiteBright(`  • ${w.name} `)}${chalk.dim(`(${w.id})`)}`)).join("\n"), {
+			padding: {
+				top: 0,
+				bottom: 0,
+				left: 0,
+				right: 0
+			},
+			margin: {
+				top: 1,
+				bottom: 0
+			},
+			borderStyle: "single",
+			borderColor: "magenta",
+			title: chalk.bold("Active workflows"),
+			titleAlignment: "left"
+		});
+	}
+};
+
+//#endregion
+//#region src/dev/DevConsumerPublishBootstrap.ts
+/**
+* Ensures `.codemation/output/current.json` and transpiled consumer config exist before the Next host boots.
+* Without this, `codemation dev` can serve a stale built `codemation.config.js` (e.g. missing whitelabel).
+*/
+var DevConsumerPublishBootstrap = class {
+	constructor(cliLogger, pluginDiscovery, artifactsPublisher, outputBuilderLoader, buildOptionsParser) {
+		this.cliLogger = cliLogger;
+		this.pluginDiscovery = pluginDiscovery;
+		this.artifactsPublisher = artifactsPublisher;
+		this.outputBuilderLoader = outputBuilderLoader;
+		this.buildOptionsParser = buildOptionsParser;
+	}
+	async ensurePublished(paths) {
+		const buildOptions = this.buildOptionsParser.parse({});
+		const snapshot = await this.outputBuilderLoader.create(paths.consumerRoot, buildOptions).ensureBuilt();
+		const discoveredPlugins = await this.pluginDiscovery.discover(paths.consumerRoot);
+		await this.artifactsPublisher.publish(snapshot, discoveredPlugins);
+		this.cliLogger.debug(`Dev: consumer output published (${snapshot.buildVersion}).`);
+	}
+};
+
+//#endregion
+//#region src/runtime/ListenPortResolver.ts
+/**
+* Shared HTTP listen port parsing for CLI commands (dev server, serve web, etc.).
+*/
+var ListenPortResolver = class {
+	resolvePrimaryApplicationPort(rawPort) {
+		const parsedPort = Number(rawPort);
+		if (Number.isInteger(parsedPort) && parsedPort > 0) return parsedPort;
+		return 3e3;
+	}
+	parsePositiveInteger(raw) {
+		const parsed = Number(raw);
+		if (Number.isInteger(parsed) && parsed > 0) return parsed;
+		return null;
+	}
+	resolveWebsocketPortRelativeToHttp(args) {
+		const explicit = this.parsePositiveInteger(args.publicWebsocketPort) ?? this.parsePositiveInteger(args.websocketPort);
+		if (explicit !== null) return explicit;
+		return args.nextPort + 1;
+	}
+};
+
+//#endregion
+//#region src/runtime/SourceMapNodeOptions.ts
+var SourceMapNodeOptions = class {
+	appendToNodeOptions(existingNodeOptions) {
+		const sourceMapOption = "--enable-source-maps";
+		if (!existingNodeOptions || existingNodeOptions.trim().length === 0) return sourceMapOption;
+		if (existingNodeOptions.includes(sourceMapOption)) return existingNodeOptions;
+		return `${existingNodeOptions} ${sourceMapOption}`.trim();
+	}
+};
+
+//#endregion
+//#region src/dev/DevelopmentGatewayNotifier.ts
+var DevelopmentGatewayNotifier = class {
+	constructor(cliLogger) {
+		this.cliLogger = cliLogger;
+	}
+	async notify(args) {
+		const targetUrl = `${args.gatewayBaseUrl.replace(/\/$/, "")}${ApiPaths.devGatewayNotify()}`;
+		try {
+			const response = await fetch(targetUrl, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"x-codemation-dev-token": args.developmentServerToken
+				},
+				body: JSON.stringify(args.payload)
+			});
+			if (!response.ok) this.cliLogger.warn(`failed to notify dev gateway status=${response.status}`);
+		} catch (error) {
+			this.cliLogger.warn(`failed to notify dev gateway: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	}
+};
+
+//#endregion
+//#region src/dev/DevAuthSettingsLoader.ts
+var DevAuthSettingsLoader = class {
+	constructor(configLoader) {
+		this.configLoader = configLoader;
+	}
+	resolveDevelopmentServerToken(rawToken) {
+		if (rawToken && rawToken.trim().length > 0) return rawToken;
+		return randomUUID();
+	}
+	async loadForConsumer(consumerRoot) {
+		const resolution = await this.configLoader.load({ consumerRoot });
+		return {
+			authConfigJson: JSON.stringify(resolution.config.auth ?? null),
+			skipUiAuth: resolution.config.auth?.allowUnauthenticatedInDevelopment === true
+		};
+	}
+};
+
+//#endregion
+//#region src/dev/DevHttpProbe.ts
+var DevHttpProbe = class {
+	async waitUntilUrlRespondsOk(url) {
+		for (let attempt = 0; attempt < 200; attempt += 1) {
+			try {
+				const response = await fetch(url);
+				if (response.ok || response.status === 404) return;
+			} catch {}
+			await setTimeout$1(50);
+		}
+		throw new Error(`Timed out waiting for HTTP response from ${url}`);
+	}
+	async waitUntilGatewayHealthy(gatewayBaseUrl) {
+		const normalizedBase = gatewayBaseUrl.replace(/\/$/, "");
+		for (let attempt = 0; attempt < 200; attempt += 1) {
+			try {
+				if ((await fetch(`${normalizedBase}/api/dev/health`)).ok) return;
+			} catch {}
+			await setTimeout$1(50);
+		}
+		throw new Error("Timed out waiting for dev gateway HTTP health check.");
+	}
+	/**
+	* Polls until the runtime child serves bootstrap summary (after gateway is up, the disposable runtime may still be wiring).
+	*/
+	async waitUntilBootstrapSummaryReady(gatewayBaseUrl) {
+		const url = `${gatewayBaseUrl.replace(/\/$/, "")}/api/dev/bootstrap-summary`;
+		for (let attempt = 0; attempt < 200; attempt += 1) {
+			try {
+				if ((await fetch(url)).ok) return;
+			} catch {}
+			await setTimeout$1(50);
+		}
+		throw new Error("Timed out waiting for dev runtime bootstrap summary.");
+	}
+};
+
+//#endregion
+//#region src/dev/DevNextHostEnvironmentBuilder.ts
+var DevNextHostEnvironmentBuilder = class {
+	constructor(consumerEnvLoader, sourceMapNodeOptions) {
+		this.consumerEnvLoader = consumerEnvLoader;
+		this.sourceMapNodeOptions = sourceMapNodeOptions;
+	}
+	build(args) {
+		const merged = this.consumerEnvLoader.mergeConsumerRootIntoProcessEnvironment(args.consumerRoot, process$1.env);
+		const manifestPath = args.consumerOutputManifestPath ?? path.resolve(args.consumerRoot, ".codemation", "output", "current.json");
+		return {
+			...merged,
+			PORT: String(args.nextPort),
+			CODEMATION_AUTH_CONFIG_JSON: args.authConfigJson,
+			CODEMATION_CONSUMER_ROOT: args.consumerRoot,
+			CODEMATION_CONSUMER_OUTPUT_MANIFEST_PATH: manifestPath,
+			CODEMATION_SKIP_UI_AUTH: args.skipUiAuth ? "true" : "false",
+			NEXT_PUBLIC_CODEMATION_SKIP_UI_AUTH: args.skipUiAuth ? "true" : "false",
+			CODEMATION_WS_PORT: String(args.websocketPort),
+			NEXT_PUBLIC_CODEMATION_WS_PORT: String(args.websocketPort),
+			CODEMATION_DEV_SERVER_TOKEN: args.developmentServerToken,
+			CODEMATION_SKIP_STARTUP_MIGRATIONS: "true",
+			NODE_OPTIONS: this.sourceMapNodeOptions.appendToNodeOptions(process$1.env.NODE_OPTIONS),
+			WS_NO_BUFFER_UTIL: "1",
+			WS_NO_UTF_8_VALIDATE: "1",
+			...args.runtimeDevUrl !== void 0 && args.runtimeDevUrl.trim().length > 0 ? { CODEMATION_RUNTIME_DEV_URL: args.runtimeDevUrl.trim() } : {}
+		};
+	}
+};
+
+//#endregion
+//#region src/dev/DevSessionPortsResolver.ts
+var DevSessionPortsResolver = class {
+	constructor(listenPorts, loopbackPorts) {
+		this.listenPorts = listenPorts;
+		this.loopbackPorts = loopbackPorts;
+	}
+	async resolve(args) {
+		const nextPort = this.listenPorts.resolvePrimaryApplicationPort(args.portEnv);
+		return {
+			nextPort,
+			gatewayPort: this.listenPorts.parsePositiveInteger(args.gatewayPortEnv) ?? (args.devMode === "consumer" ? nextPort : await this.loopbackPorts.allocate())
+		};
+	}
+};
+
+//#endregion
+//#region src/dev/DevSessionServices.ts
+/**
+* Bundles dependencies for {@link DevCommand} so the command stays a thin orchestrator.
+*/
+var DevSessionServices = class {
+	constructor(consumerEnvLoader, sourceMapNodeOptions, sessionPorts, loopbackPortAllocator, devHttpProbe, runtimeEntrypointResolver, devAuthLoader, nextHostEnvBuilder, watchRootsResolver, sourceRestartCoordinator) {
+		this.consumerEnvLoader = consumerEnvLoader;
+		this.sourceMapNodeOptions = sourceMapNodeOptions;
+		this.sessionPorts = sessionPorts;
+		this.loopbackPortAllocator = loopbackPortAllocator;
+		this.devHttpProbe = devHttpProbe;
+		this.runtimeEntrypointResolver = runtimeEntrypointResolver;
+		this.devAuthLoader = devAuthLoader;
+		this.nextHostEnvBuilder = nextHostEnvBuilder;
+		this.watchRootsResolver = watchRootsResolver;
+		this.sourceRestartCoordinator = sourceRestartCoordinator;
+	}
+};
+
+//#endregion
+//#region src/dev/DevSourceRestartCoordinator.ts
+var DevSourceRestartCoordinator = class {
+	constructor(gatewayNotifier, performanceDiagnosticsLogger, cliLogger) {
+		this.gatewayNotifier = gatewayNotifier;
+		this.performanceDiagnosticsLogger = performanceDiagnosticsLogger;
+		this.cliLogger = cliLogger;
+	}
+	async runHandshakeAfterSourceChange(gatewayBaseUrl, developmentServerToken) {
+		const restartStarted = performance.now();
+		try {
+			await this.gatewayNotifier.notify({
+				gatewayBaseUrl,
+				developmentServerToken,
+				payload: { kind: "buildStarted" }
+			});
+			await this.gatewayNotifier.notify({
+				gatewayBaseUrl,
+				developmentServerToken,
+				payload: {
+					kind: "buildCompleted",
+					buildVersion: `${Date.now()}-${process$1.pid}`
+				}
+			});
+			const totalMs = performance.now() - restartStarted;
+			this.performanceDiagnosticsLogger.info(`triggered source-based runtime restart timingMs={total:${totalMs.toFixed(1)}}`);
+		} catch (error) {
+			const exception = error instanceof Error ? error : new Error(String(error));
+			await this.gatewayNotifier.notify({
+				gatewayBaseUrl,
+				developmentServerToken,
+				payload: {
+					kind: "buildFailed",
+					message: exception.message
+				}
+			});
+			this.cliLogger.error("source-based runtime restart request failed", exception);
+		}
+	}
+};
+
+//#endregion
+//#region src/dev/LoopbackPortAllocator.ts
+var LoopbackPortAllocator = class {
+	async allocate() {
+		return await new Promise((resolve, reject) => {
+			const server = createServer();
+			server.once("error", reject);
+			server.listen(0, "127.0.0.1", () => {
+				const address = server.address();
+				server.close(() => {
+					if (address && typeof address === "object") {
+						resolve(address.port);
+						return;
+					}
+					reject(/* @__PURE__ */ new Error("Failed to resolve a free TCP port."));
+				});
+			});
+		});
+	}
+};
+
+//#endregion
+//#region src/dev/RuntimeToolEntrypointResolver.ts
+var RuntimeToolEntrypointResolver = class {
+	require = createRequire(import.meta.url);
+	async resolve(args) {
+		const sourceEntrypointPath = path.resolve(args.repoRoot, args.sourceEntrypoint);
+		if (await this.exists(sourceEntrypointPath)) return {
+			command: process$1.execPath,
+			args: [
+				"--import",
+				"tsx",
+				sourceEntrypointPath
+			],
+			env: { TSX_TSCONFIG_PATH: path.resolve(args.repoRoot, "tsconfig.codemation-tsx.json") }
+		};
+		return {
+			command: process$1.execPath,
+			args: [this.require.resolve(args.packageName)],
+			env: {}
+		};
+	}
+	async exists(filePath) {
+		try {
+			await access(filePath);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+
+//#endregion
+//#region src/dev/WatchRootsResolver.ts
+var WatchRootsResolver = class {
+	resolve(args) {
+		if (args.devMode === "consumer") return [args.consumerRoot];
+		return [
+			args.consumerRoot,
+			path.resolve(args.repoRoot, "packages", "core"),
+			path.resolve(args.repoRoot, "packages", "core-nodes"),
+			path.resolve(args.repoRoot, "packages", "core-nodes-gmail"),
+			path.resolve(args.repoRoot, "packages", "eventbus-redis"),
+			path.resolve(args.repoRoot, "packages", "host"),
+			path.resolve(args.repoRoot, "packages", "node-example"),
+			path.resolve(args.repoRoot, "packages", "queue-bullmq"),
+			path.resolve(args.repoRoot, "packages", "runtime-dev")
+		];
+	}
+};
+
+//#endregion
+//#region src/dev/Builder.ts
+var DevSessionServicesBuilder = class {
+	constructor(loggerFactory$1) {
+		this.loggerFactory = loggerFactory$1;
+	}
+	build() {
+		const consumerEnvLoader = new ConsumerEnvLoader();
+		const sourceMapNodeOptions = new SourceMapNodeOptions();
+		const listenPortResolver = new ListenPortResolver();
+		const loopbackPortAllocator = new LoopbackPortAllocator();
+		const cliLogger = this.loggerFactory.create("codemation-cli");
+		return new DevSessionServices(consumerEnvLoader, sourceMapNodeOptions, new DevSessionPortsResolver(listenPortResolver, loopbackPortAllocator), loopbackPortAllocator, new DevHttpProbe(), new RuntimeToolEntrypointResolver(), new DevAuthSettingsLoader(new CodemationConsumerConfigLoader()), new DevNextHostEnvironmentBuilder(consumerEnvLoader, sourceMapNodeOptions), new WatchRootsResolver(), new DevSourceRestartCoordinator(new DevelopmentGatewayNotifier(cliLogger), this.loggerFactory.createPerformanceDiagnostics("codemation-cli.performance"), cliLogger));
+	}
+};
+
+//#endregion
+//#region src/dev/DevLock.ts
+var DevLock = class {
+	lockPath = null;
+	async acquire(args) {
+		const lockPath = this.resolveLockPath(args.consumerRoot);
+		await mkdir(path.dirname(lockPath), { recursive: true });
+		const record = {
+			pid: process$1.pid,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			consumerRoot: args.consumerRoot,
+			nextPort: args.nextPort
+		};
+		try {
+			await this.writeExclusive(lockPath, JSON.stringify(record, null, 2));
+			this.lockPath = lockPath;
+			return;
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+		}
+		const existingRecord = await this.readExistingRecord(lockPath);
+		if (existingRecord && this.isProcessAlive(existingRecord.pid)) throw new Error(`codemation dev is already running for ${args.consumerRoot} (pid=${existingRecord.pid}, port=${existingRecord.nextPort}). Stop it before starting a new dev server.`);
+		await rm(lockPath, { force: true }).catch(() => null);
+		await this.writeExclusive(lockPath, JSON.stringify(record, null, 2));
+		this.lockPath = lockPath;
+	}
+	async release() {
+		if (!this.lockPath) return;
+		const lockPath = this.lockPath;
+		this.lockPath = null;
+		await rm(lockPath, { force: true }).catch(() => null);
+	}
+	resolveLockPath(consumerRoot) {
+		return path.resolve(consumerRoot, ".codemation", "dev.lock");
+	}
+	async writeExclusive(filePath, contents) {
+		const handle = await open(filePath, "wx");
+		try {
+			await handle.writeFile(contents, "utf8");
+		} finally {
+			await handle.close().catch(() => null);
+		}
+	}
+	async readExistingRecord(lockPath) {
+		try {
+			const raw = await readFile(lockPath, "utf8");
+			const parsed = JSON.parse(raw);
+			if (typeof parsed.pid !== "number" || typeof parsed.startedAt !== "string" || typeof parsed.consumerRoot !== "string" || typeof parsed.nextPort !== "number") return null;
+			return parsed;
+		} catch {
+			return null;
+		}
+	}
+	isProcessAlive(pid) {
+		if (!Number.isInteger(pid) || pid <= 0) return false;
+		try {
+			process$1.kill(pid, 0);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+
+//#endregion
+//#region src/dev/Factory.ts
+var DevLockFactory = class {
+	create() {
+		return new DevLock();
+	}
+};
+
+//#endregion
+//#region src/dev/ConsumerEnvDotenvFilePredicate.ts
+/**
+* True when `filePath` names a consumer dotenv file (`.env`, `.env.local`, …).
+* Used by `codemation dev` to distinguish env-only changes from source rebuilds.
+*/
+var ConsumerEnvDotenvFilePredicate = class {
+	matches(filePath) {
+		const fileName = path.basename(filePath);
+		return fileName === ".env" || fileName.startsWith(".env.");
+	}
+};
+
+//#endregion
+//#region src/dev/DevTrackedProcessTreeKiller.ts
+/**
+* Stops a spawned dev child and every descendant process.
+*
+* On Unix, children are expected to have been created with `spawn({ detached: true })` so the root
+* child is the process-group leader; we first send `SIGTERM` to the whole group and only escalate to
+* `SIGKILL` when the process does not exit within the grace period.
+* On Windows, uses `taskkill /F /T` to terminate the process tree.
+*/
+var DevTrackedProcessTreeKiller = class {
+	constructor(terminationGracePeriodMs = 1500) {
+		this.terminationGracePeriodMs = terminationGracePeriodMs;
+	}
+	async killProcessTreeRootedAt(child) {
+		const pid = child.pid;
+		if (pid === void 0) {
+			if (!await this.trySigTerm(child)) {
+				this.trySigKill(child);
+				await this.waitForExit(child);
+			}
+			return;
+		}
+		if (process$1.platform === "win32") {
+			await this.killWindowsProcessTree(pid);
+			await this.waitForExit(child);
+		} else if (!await this.trySigTermProcessGroup(pid, child)) {
+			this.trySigKill(child);
+			this.trySigKillProcessGroup(pid);
+			await this.waitForExit(child);
+		}
+	}
+	trySigKill(child) {
+		try {
+			child.kill("SIGKILL");
+		} catch {}
+	}
+	killWindowsProcessTree(pid) {
+		return new Promise((resolve) => {
+			const proc = spawn("taskkill", [
+				"/F",
+				"/T",
+				"/PID",
+				String(pid)
+			], {
+				stdio: "ignore",
+				windowsHide: true
+			});
+			proc.once("exit", () => {
+				resolve();
+			});
+			proc.once("error", () => {
+				resolve();
+			});
+		});
+	}
+	async trySigTerm(child) {
+		try {
+			child.kill("SIGTERM");
+		} catch {
+			return child.exitCode !== null || child.signalCode !== null;
+		}
+		return await this.waitForExit(child, this.terminationGracePeriodMs);
+	}
+	async trySigTermProcessGroup(pid, child) {
+		try {
+			process$1.kill(-pid, "SIGTERM");
+		} catch {
+			return await this.trySigTerm(child);
+		}
+		return await this.waitForExit(child, this.terminationGracePeriodMs);
+	}
+	trySigKillProcessGroup(pid) {
+		try {
+			process$1.kill(-pid, "SIGKILL");
+		} catch {}
+	}
+	waitForExit(child, timeoutMs) {
+		if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(true);
+		return new Promise((resolve) => {
+			let timeout;
+			const onExit = () => {
+				if (timeout) clearTimeout(timeout);
+				resolve(true);
+			};
+			child.once("exit", onExit);
+			if (timeoutMs === void 0) return;
+			timeout = setTimeout(() => {
+				child.removeListener("exit", onExit);
+				resolve(child.exitCode !== null || child.signalCode !== null);
+			}, timeoutMs);
+		});
+	}
+};
+
+//#endregion
+//#region src/dev/DevSourceWatcher.ts
+var DevSourceWatcher = class DevSourceWatcher {
+	static ignoredDirectoryNames = new Set([
+		".codemation",
+		".git",
+		".next",
+		"coverage",
+		"dist",
+		"node_modules"
+	]);
+	watcher = null;
+	debounceTimeout = null;
+	changedPathsBuffer = /* @__PURE__ */ new Set();
+	async start(args) {
+		if (this.watcher) return;
+		this.watcher = watch([...args.roots], {
+			ignoreInitial: true,
+			ignored: (watchPath) => this.isIgnoredPath(watchPath)
+		});
+		this.watcher.on("all", (_eventName, watchPath) => {
+			if (typeof watchPath !== "string" || watchPath.length === 0) return;
+			if (!this.isRelevantPath(watchPath)) return;
+			this.changedPathsBuffer.add(path.resolve(watchPath));
+			this.scheduleDebouncedChange(args.onChange);
+		});
+	}
+	async stop() {
+		if (this.debounceTimeout) {
+			clearTimeout(this.debounceTimeout);
+			this.debounceTimeout = null;
+		}
+		if (this.watcher) {
+			await this.watcher.close();
+			this.watcher = null;
+		}
+	}
+	scheduleDebouncedChange(onChange) {
+		if (this.debounceTimeout) clearTimeout(this.debounceTimeout);
+		this.debounceTimeout = setTimeout(() => {
+			this.debounceTimeout = null;
+			this.flushPendingChange(onChange);
+		}, 75);
+	}
+	async flushPendingChange(onChange) {
+		if (this.changedPathsBuffer.size === 0) return;
+		const changedPaths = [...this.changedPathsBuffer];
+		this.changedPathsBuffer.clear();
+		await onChange({ changedPaths });
+	}
+	isIgnoredPath(watchPath) {
+		return path.resolve(watchPath).replace(/\\/g, "/").split("/").some((segment) => DevSourceWatcher.ignoredDirectoryNames.has(segment));
+	}
+	isRelevantPath(watchPath) {
+		const fileName = path.basename(watchPath);
+		if (fileName === ".env" || fileName.startsWith(".env.")) return true;
+		const extension = path.extname(watchPath).toLowerCase();
+		return extension === ".cts" || extension === ".cjs" || extension === ".js" || extension === ".json" || extension === ".jsx" || extension === ".mts" || extension === ".mjs" || extension === ".prisma" || extension === ".ts" || extension === ".tsx";
+	}
+};
+
+//#endregion
+//#region src/dev/Runner.ts
+var DevSourceWatcherFactory = class {
+	create() {
+		return new DevSourceWatcher();
+	}
+};
+
+//#endregion
+//#region src/Program.ts
+var CliProgram = class {
+	constructor(buildOptionsParser, buildCommand, devCommand, serveWebCommand, serveWorkerCommand, dbMigrateCommand, userCreateCommand, userListCommand) {
+		this.buildOptionsParser = buildOptionsParser;
+		this.buildCommand = buildCommand;
+		this.devCommand = devCommand;
+		this.serveWebCommand = serveWebCommand;
+		this.serveWorkerCommand = serveWorkerCommand;
+		this.dbMigrateCommand = dbMigrateCommand;
+		this.userCreateCommand = userCreateCommand;
+		this.userListCommand = userListCommand;
+	}
+	async run(argv) {
+		const program = new Command();
+		program.name("codemation").description("Build and run the Codemation Next host against a consumer project.").version(this.readCliPackageVersion(), "-V, --version", "Output CLI version").showHelpAfterError("(add --help for usage)").configureHelp({ sortSubcommands: true });
+		const resolveConsumerRoot = (raw) => raw !== void 0 && raw.trim().length > 0 ? path.resolve(process$1.cwd(), raw.trim()) : process$1.cwd();
+		program.command("build").description("Build consumer workflows/plugins output and write the manifest.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--no-source-maps", "Disable .js.map files for emitted workflow modules (recommended for locked-down production bundles).").option("--target <es2020|es2022>", "ECMAScript language version for emitted workflow JavaScript (default: es2022).", "es2022").action(async (opts) => {
+			await this.buildCommand.execute(resolveConsumerRoot(opts.consumerRoot), this.buildOptionsParser.parse(opts));
+		});
+		program.command("dev", { isDefault: true }).description("Start the dev gateway and runtime child. Use CODEMATION_DEV_MODE=framework with Next dev for framework UI HMR; default consumer mode serves API/WebSocket from the gateway only.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").action(async (opts) => {
+			await this.devCommand.execute(resolveConsumerRoot(opts.consumerRoot));
+		});
+		const serve = program.command("serve").description("Run production web or worker processes (no dev watchers).");
+		serve.command("web").description("Start the built Next.js Codemation host (next start).").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--no-source-maps", "Disable .js.map files for emitted workflow modules when this command runs the consumer build step.").option("--target <es2020|es2022>", "ECMAScript language version for emitted workflow JavaScript when building consumer output (default: es2022).", "es2022").action(async (opts) => {
+			await this.serveWebCommand.execute(resolveConsumerRoot(opts.consumerRoot), this.buildOptionsParser.parse(opts));
+		});
+		serve.command("worker").description("Start the Codemation worker process.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--config <path>", "Override path to codemation.config.ts / .js").action(async (opts) => {
+			await this.serveWorkerCommand.execute(resolveConsumerRoot(opts.consumerRoot), opts.config);
+		});
+		program.command("db").description("Database utilities (PostgreSQL / Prisma).").command("migrate").description("Apply pending Prisma migrations using the consumer database URL (DATABASE_URL in `.env`, or CodemationConfig.runtime.database.url).").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--config <path>", "Override path to codemation.config.ts / .js").action(async (opts) => {
+			await this.dbMigrateCommand.execute({
+				consumerRoot: resolveConsumerRoot(opts.consumerRoot),
+				configPath: opts.config
+			});
+		});
+		const user = program.command("user").description("User administration (local auth)");
+		user.command("create").description("Create or update a user in the database when CodemationConfig.auth.kind is \"local\". Uses DATABASE_URL or configured database URL.").requiredOption("--email <email>", "Login email").requiredOption("--password <password>", "Plain password (stored as a bcrypt hash)").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--config <path>", "Override path to codemation.config.ts / .js").action(async (opts) => {
+			await this.userCreateCommand.execute(opts);
+		});
+		user.command("list").description("List users in the database when CodemationConfig.auth.kind is \"local\". Uses DATABASE_URL or configured database URL.").option("--consumer-root <path>", "Path to the consumer project root (defaults to cwd)").option("--config <path>", "Override path to codemation.config.ts / .js").action(async (opts) => {
+			await this.userListCommand.execute(opts);
+		});
+		await program.parseAsync(argv, { from: "user" });
+	}
+	readCliPackageVersion() {
+		try {
+			const packageJsonPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+			const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+			return typeof parsed.version === "string" ? parsed.version : "0.0.0";
+		} catch {
+			return "0.0.0";
+		}
+	}
+};
+
+//#endregion
+//#region src/path/CliPathResolver.ts
+var CliPathResolver = class {
+	async resolve(consumerStartPath) {
+		const consumerRoot = path.resolve(consumerStartPath);
+		return {
+			consumerRoot,
+			repoRoot: await this.detectWorkspaceRoot(consumerRoot) ?? consumerRoot
+		};
+	}
+	async detectWorkspaceRoot(startDirectory) {
+		let currentDirectory = path.resolve(startDirectory);
+		while (true) {
+			if (await this.exists(path.resolve(currentDirectory, "pnpm-workspace.yaml"))) return currentDirectory;
+			const parentDirectory = path.dirname(currentDirectory);
+			if (parentDirectory === currentDirectory) return null;
+			currentDirectory = parentDirectory;
+		}
+	}
+	async exists(filePath) {
+		try {
+			await access(filePath);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+};
+
+//#endregion
+//#region src/runtime/TypeScriptRuntimeConfigurator.ts
+var TypeScriptRuntimeConfigurator = class {
+	configure(repoRoot) {
+		process$1.env.CODEMATION_TSCONFIG_PATH = path.resolve(repoRoot, "tsconfig.base.json");
+	}
+};
+
+//#endregion
+//#region src/user/LocalUserCreator.ts
+var LocalUserCreator = class {
+	log = new ServerLoggerFactory(logLevelPolicyFactory).create("codemation-cli.user");
+	constructor(userAdminBootstrap) {
+		this.userAdminBootstrap = userAdminBootstrap;
+	}
+	async run(options) {
+		const email = options.email;
+		const password = options.password;
+		await this.userAdminBootstrap.withSession({
+			consumerRoot: options.consumerRoot,
+			configPath: options.configPath
+		}, async (session) => {
+			const result = await session.getCommandBus().execute(new UpsertLocalBootstrapUserCommand(email, password));
+			this.log.info(result.outcome === "created" ? `Created local user: ${email}` : `Updated local user: ${email}`);
+		});
+	}
+};
+
+//#endregion
+//#region src/user/CliDatabaseUrlDescriptor.ts
+/**
+* Formats a database URL for CLI messages without exposing credentials (no user/password).
+*/
+var CliDatabaseUrlDescriptor = class {
+	describePersistence(persistence) {
+		if (persistence.kind === "none") return "none";
+		if (persistence.kind === "postgresql") return this.describeForDisplay(persistence.databaseUrl);
+		return `PGlite (${persistence.dataDir})`;
+	}
+	describeForDisplay(databaseUrl) {
+		if (!databaseUrl || databaseUrl.trim().length === 0) return "unknown database target";
+		try {
+			const u = new URL(databaseUrl);
+			const pathPart = u.pathname.replace(/^\//, "").split(/[?#]/)[0] ?? "";
+			const databaseName = pathPart.length > 0 ? pathPart : "(default)";
+			const defaultPort = u.protocol === "postgresql:" || u.protocol === "postgres:" ? "5432" : "";
+			const port = u.port || defaultPort;
+			return `database "${databaseName}" on ${port ? `${u.hostname}:${port}` : u.hostname}`;
+		} catch {
+			return "configured database (URL not shown)";
+		}
+	}
+};
+
+//#endregion
+//#region src/bootstrap/CodemationCliApplicationSession.ts
+/**
+* Opens a {@link CodemationApplication} with persistence + command/query buses (no HTTP/WebSocket servers),
+* for CLI tools that dispatch application commands or queries (e.g. user admin).
+*/
+var CodemationCliApplicationSession = class CodemationCliApplicationSession {
+	constructor(application) {
+		this.application = application;
+	}
+	static async open(args) {
+		const app = new CodemationApplication().useConfig(args.resolution.config);
+		await app.bootCli(new CodemationBootstrapRequest({
+			repoRoot: args.bootstrap.repoRoot,
+			consumerRoot: args.bootstrap.consumerRoot,
+			env: args.bootstrap.env,
+			workflowSources: args.resolution.workflowSources
+		}));
+		return new CodemationCliApplicationSession(app);
+	}
+	getPrismaClient() {
+		const container = this.getContainer();
+		if (!container.isRegistered(PrismaClient, true)) return;
+		return container.resolve(PrismaClient);
+	}
+	getCommandBus() {
+		return this.getContainer().resolve(ApplicationTokens.CommandBus);
+	}
+	getQueryBus() {
+		return this.getContainer().resolve(ApplicationTokens.QueryBus);
+	}
+	async close() {
+		await this.application.stop({ stopWebsocketServer: false });
+	}
+	getContainer() {
+		return this.application.getContainer();
+	}
+};
+
+//#endregion
+//#region src/user/UserAdminCliBootstrap.ts
+/**
+* Shared env/config/session wiring for `codemation user *` commands (local auth + database).
+*/
+var UserAdminCliBootstrap = class {
+	constructor(configLoader, pathResolver, consumerDotenvLoader, tsconfigPreparation, databasePersistenceResolver) {
+		this.configLoader = configLoader;
+		this.pathResolver = pathResolver;
+		this.consumerDotenvLoader = consumerDotenvLoader;
+		this.tsconfigPreparation = tsconfigPreparation;
+		this.databasePersistenceResolver = databasePersistenceResolver;
+	}
+	async withSession(options, fn) {
+		const consumerRoot = options.consumerRoot ?? process.cwd();
+		this.consumerDotenvLoader.load(consumerRoot);
+		this.tsconfigPreparation.applyWorkspaceTsconfigForTsxIfPresent(consumerRoot);
+		const resolution = await this.configLoader.load({
+			consumerRoot,
+			configPathOverride: options.configPath
+		});
+		if (resolution.config.auth?.kind !== "local") throw new Error("Codemation user commands require CodemationConfig.auth.kind to be \"local\".");
+		if (this.databasePersistenceResolver.resolve({
+			runtimeConfig: resolution.config.runtime ?? {},
+			env: process.env,
+			consumerRoot
+		}).kind === "none") throw new Error("Database persistence is not configured. Set CodemationConfig.runtime.database (postgresql URL or PGlite).");
+		const paths = await this.pathResolver.resolve(consumerRoot);
+		const session = await CodemationCliApplicationSession.open({
+			resolution,
+			bootstrap: new CodemationBootstrapRequest({
+				repoRoot: paths.repoRoot,
+				consumerRoot,
+				env: process.env,
+				workflowSources: resolution.workflowSources
+			})
+		});
+		try {
+			return await fn(session);
+		} finally {
+			await session.close();
+		}
+	}
+};
+
+//#endregion
+//#region src/user/UserAdminCliOptionsParser.ts
+var UserAdminCliOptionsParser = class {
+	parse(opts) {
+		return {
+			consumerRoot: opts.consumerRoot !== void 0 && opts.consumerRoot.trim().length > 0 ? path.resolve(process$1.cwd(), opts.consumerRoot.trim()) : void 0,
+			configPath: opts.config !== void 0 && opts.config.trim().length > 0 ? opts.config.trim() : void 0
+		};
+	}
+};
+
+//#endregion
+//#region src/user/UserAdminConsumerDotenvLoader.ts
+/**
+* Loads the consumer project's `.env` for `codemation user *` commands.
+* Uses {@link loadDotenv}'s `override: true` so values in the consumer file win over variables
+* already present in the process environment (e.g. a leftover `DATABASE_URL` from the shell).
+* Otherwise a misconfigured `.env` is silently ignored and the CLI may connect to a different database,
+* surfacing misleading results such as "No users found."
+*/
+var UserAdminConsumerDotenvLoader = class {
+	load(consumerRoot) {
+		config({
+			path: path.resolve(consumerRoot, ".env"),
+			override: true,
+			quiet: true
+		});
+		config({
+			path: path.resolve(consumerRoot, ".env.local"),
+			override: true,
+			quiet: true
+		});
+	}
+};
+
+//#endregion
+//#region src/CliProgramFactory.ts
+const loggerFactory = new ServerLoggerFactory(logLevelPolicyFactory);
+/**
+* Single composition root for the CLI: constructs the object graph and returns {@link CliProgram}.
+* No tsyringe; keeps the package thin while commands remain constructor-injected.
+*/
+var CliProgramFactory = class {
+	create() {
+		const cliLogger = loggerFactory.create("codemation-cli");
+		const pathResolver = new CliPathResolver();
+		const pluginDiscovery = new CodemationPluginDiscovery();
+		const artifactsPublisher = new ConsumerBuildArtifactsPublisher();
+		const tsRuntime = new TypeScriptRuntimeConfigurator();
+		const outputBuilderLoader = new ConsumerOutputBuilderLoader();
+		const sourceMapNodeOptions = new SourceMapNodeOptions();
+		const tsconfigPreparation = new ConsumerCliTsconfigPreparation();
+		const databasePersistenceResolver = new DatabasePersistenceResolver();
+		const userAdminBootstrap = new UserAdminCliBootstrap(new CodemationConsumerConfigLoader(), pathResolver, new UserAdminConsumerDotenvLoader(), tsconfigPreparation, databasePersistenceResolver);
+		const hostPackageRoot = new HostPackageRootResolver().resolveHostPackageRoot();
+		const userAdminCliOptionsParser = new UserAdminCliOptionsParser();
+		const databaseMigrationsApplyService = new DatabaseMigrationsApplyService(cliLogger, new UserAdminConsumerDotenvLoader(), tsconfigPreparation, new CodemationConsumerConfigLoader(), new ConsumerDatabaseConnectionResolver(), new CliDatabaseUrlDescriptor(), hostPackageRoot, new PrismaMigrationDeployer());
+		const buildOptionsParser = new ConsumerBuildOptionsParser();
+		const devConsumerPublishBootstrap = new DevConsumerPublishBootstrap(cliLogger, pluginDiscovery, artifactsPublisher, outputBuilderLoader, buildOptionsParser);
+		return new CliProgram(buildOptionsParser, new BuildCommand(cliLogger, pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, outputBuilderLoader), new DevCommand(pathResolver, pluginDiscovery, tsRuntime, new DevLockFactory(), new DevSourceWatcherFactory(), cliLogger, new DevSessionServicesBuilder(loggerFactory).build(), databaseMigrationsApplyService, new DevBootstrapSummaryFetcher(), new DevCliBannerRenderer(), devConsumerPublishBootstrap, new ConsumerEnvDotenvFilePredicate(), new DevTrackedProcessTreeKiller()), new ServeWebCommand(pathResolver, pluginDiscovery, artifactsPublisher, tsRuntime, sourceMapNodeOptions, outputBuilderLoader, new ConsumerEnvLoader(), new ListenPortResolver()), new ServeWorkerCommand(sourceMapNodeOptions), new DbMigrateCommand(databaseMigrationsApplyService), new UserCreateCommand(new LocalUserCreator(userAdminBootstrap), userAdminCliOptionsParser), new UserListCommand(cliLogger, userAdminBootstrap, new CliDatabaseUrlDescriptor(), userAdminCliOptionsParser));
+	}
+};
+
+//#endregion
+//#region src/CliBin.ts
+var CliBin = class {
+	static async run(argv) {
+		try {
+			await new CliProgramFactory().create().run([...argv]);
+		} catch (error) {
+			console.error("codemation:", error);
+			process$1.exitCode = 1;
+		}
+	}
+};
+
+//#endregion
+export { CliProgram as a, CliPathResolver as i, CliProgramFactory as n, ConsumerOutputBuilder as o, CodemationCliApplicationSession as r, ConsumerBuildOptionsParser as s, CliBin as t };