@convilyn/sdk-author 0.7.0

package/dist/cli.cjs

@@ -0,0 +1,1391 @@
+#!/usr/bin/env node
+'use strict';
+
+var commander = require('commander');
+var promises = require('fs/promises');
+var path = require('path');
+var url = require('url');
+var crypto = require('crypto');
+var http = require('http');
+
+// src/version.ts
+var VERSION = "0.7.0";
+
+// src/errors.ts
+var ConvilynAuthorError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConvilynAuthorError";
+  }
+};
+var InvalidSignatureError = class extends ConvilynAuthorError {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "InvalidSignatureError";
+    this.reason = reason;
+  }
+};
+var ConvilynStartupError = class extends ConvilynAuthorError {
+  constructor(message) {
+    super(message);
+    this.name = "ConvilynStartupError";
+  }
+};
+var ConvilynApiError = class extends ConvilynAuthorError {
+  status;
+  body;
+  constructor(status, message, body) {
+    super(message);
+    this.name = "ConvilynApiError";
+    this.status = status;
+    this.body = body;
+  }
+};
+
+// src/types.ts
+function allChecksPassed(report) {
+  return report.results.every((result) => result.passed);
+}
+
+// src/cli/print.ts
+var consolePrinter = {
+  out: (line) => {
+    process.stdout.write(`${line}
+`);
+  },
+  err: (line) => {
+    process.stderr.write(`${line}
+`);
+  }
+};
+var NAME_RE = /^[a-zA-Z0-9_-]+$/;
+function isValidProjectName(name) {
+  return NAME_RE.test(name);
+}
+function serverTs(name) {
+  return `import { defineTool, ToolServer, ToolResult } from '@convilyn/sdk-author'
+import { z } from 'zod'
+
+const echo = defineTool({
+  name: 'echo',
+  description: 'Echo the input text back.',
+  input: z.object({ text: z.string().min(1) }),
+  idempotent: true,
+  handler: (args) => ToolResult.ok({ echoed: args.text }, \`Echoed \${args.text.length} chars\`),
+})
+
+export const server = new ToolServer(
+  { name: '${name}', version: '0.1.0', description: 'A Convilyn tool server.' },
+  { tools: [echo] }
+)
+
+export default server
+`;
+}
+function packageJson(name) {
+  return `${JSON.stringify(
+    {
+      name,
+      version: "0.1.0",
+      private: true,
+      type: "module",
+      scripts: {
+        build: "tsc",
+        synth: "convilyn-author synth --file dist/server.js",
+        dev: "convilyn-author dev --file dist/server.js",
+        test: "convilyn-author test --file dist/server.js"
+      },
+      dependencies: {
+        "@convilyn/sdk-author": `^${VERSION}`,
+        zod: "^3.23.0"
+      },
+      devDependencies: {
+        typescript: "^5.7.2"
+      }
+    },
+    null,
+    2
+  )}
+`;
+}
+var TSCONFIG = `${JSON.stringify(
+  {
+    compilerOptions: {
+      target: "ES2022",
+      module: "NodeNext",
+      moduleResolution: "NodeNext",
+      outDir: "dist",
+      strict: true,
+      skipLibCheck: true,
+      declaration: false
+    },
+    include: ["server.ts"]
+  },
+  null,
+  2
+)}
+`;
+var GITIGNORE = `node_modules/
+dist/
+convilyn.manifest.json
+.env
+`;
+var ENV_EXAMPLE = `# Inbound HMAC secret (enables POST /mcp signature verification)
+CONVILYN_HMAC_SECRET=
+# Local dev server port
+CONVILYN_PORT=8080
+# Platform API (used by push/deploy once those land)
+CONVILYN_PLATFORM_URL=https://api.convilyn.corenovus.com
+CONVILYN_API_KEY=
+`;
+function readme(name) {
+  return `# ${name}
+
+A Convilyn tool server, scaffolded by \`convilyn-author init\`.
+
+## Develop
+
+\`\`\`bash
+npm install
+npm run build          # server.ts -> dist/server.js
+npx convilyn-author dev     # run the JSON-RPC /mcp server locally
+npx convilyn-author synth   # write convilyn.manifest.json
+npx convilyn-author test    # local compliance checks
+\`\`\`
+
+Edit \`server.ts\` to add tools with \`defineTool\`.
+`;
+}
+function projectFiles(name) {
+  return {
+    "server.ts": serverTs(name),
+    "package.json": packageJson(name),
+    "tsconfig.json": TSCONFIG,
+    ".gitignore": GITIGNORE,
+    ".env.example": ENV_EXAMPLE,
+    "README.md": readme(name)
+  };
+}
+async function isNonEmptyDir(dir) {
+  try {
+    const entries = await promises.readdir(dir);
+    return entries.length > 0;
+  } catch {
+    return false;
+  }
+}
+async function scaffoldProject(options) {
+  const { name } = options;
+  if (!isValidProjectName(name)) {
+    throw new Error(
+      `Invalid project name "${name}": use letters, digits, hyphens, underscores only.`
+    );
+  }
+  const path$1 = path.resolve(options.dir ?? `./${name}`);
+  if (await isNonEmptyDir(path$1)) {
+    throw new Error(`Target directory "${path$1}" is not empty \u2014 refusing to overwrite.`);
+  }
+  await promises.mkdir(path$1, { recursive: true });
+  const files = projectFiles(name);
+  const written = [];
+  for (const [rel, content] of Object.entries(files)) {
+    await promises.writeFile(path.join(path$1, rel), content, "utf8");
+    written.push(rel);
+  }
+  return { path: path$1, files: written.sort() };
+}
+function isToolServerLike(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.manifest === "function" && typeof candidate.dispatch === "function" && typeof candidate.server === "object" && candidate.server !== null;
+}
+function pickServer(mod) {
+  if (isToolServerLike(mod.default)) {
+    return mod.default;
+  }
+  if (isToolServerLike(mod.server)) {
+    return mod.server;
+  }
+  for (const value of Object.values(mod)) {
+    if (isToolServerLike(value)) {
+      return value;
+    }
+  }
+  return void 0;
+}
+async function loadToolServer(file) {
+  const absolute = path.resolve(file);
+  let mod;
+  try {
+    mod = await import(url.pathToFileURL(absolute).href);
+  } catch (err) {
+    throw new Error(
+      `Could not import server module "${file}": ${err.message}. Point --file at a built .js module (e.g. "npm run build" then --file dist/server.js).`
+    );
+  }
+  const server = pickServer(mod);
+  if (server === void 0) {
+    throw new Error(
+      `No ToolServer found in "${file}". Export it as the default export or as a named "server" export.`
+    );
+  }
+  return server;
+}
+var PUBLIC_SCHEMA_VERSION = "1";
+var DEFAULT_SCHEMA_VERSION = "1.0";
+var MAX_NAME = 80;
+var MAX_DESCRIPTION = 500;
+var MAX_SYSTEM_PROMPT = 8e3;
+var MAX_TOOLS = 20;
+var MAX_TOOL_NAME = 128;
+var MAX_NOTE = 200;
+var MAX_TAGS = 8;
+var MAX_TAG_LEN = 24;
+var ORIGIN = { x: 0, y: 0 };
+var FORBIDDEN_TOOL = "request_user_input";
+var DEFAULT_VERSION = "1.0.0";
+var MAX_SPEC_ID = 128;
+var SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+function validateName(name) {
+  if (name.length < 1 || name.length > MAX_NAME) {
+    throw new ConvilynAuthorError(`name must be 1\u2013${MAX_NAME} characters (got ${name.length})`);
+  }
+}
+function validateSpecId(specId) {
+  if (specId.length < 1 || specId.length > MAX_SPEC_ID || /\s/.test(specId)) {
+    throw new ConvilynAuthorError(
+      `specId must be 1\u2013${MAX_SPEC_ID} characters with no whitespace (the portal expects the "dev_<developer-id>.<name>" namespace)`
+    );
+  }
+}
+function validateVersion(version) {
+  if (!SEMVER_RE.test(version)) {
+    throw new ConvilynAuthorError(`version must be valid semver (e.g. "1.0.0"; got "${version}")`);
+  }
+}
+function validateDescription(description) {
+  if (description.length > MAX_DESCRIPTION) {
+    throw new ConvilynAuthorError(`description must be \u2264 ${MAX_DESCRIPTION} characters`);
+  }
+}
+function validateSystemPrompt(systemPrompt) {
+  if (systemPrompt.length > MAX_SYSTEM_PROMPT) {
+    throw new ConvilynAuthorError(`systemPrompt must be \u2264 ${MAX_SYSTEM_PROMPT} characters`);
+  }
+}
+function validateTag(tag) {
+  if (tag.length < 1 || tag.length > MAX_TAG_LEN) {
+    throw new ConvilynAuthorError(`tag "${tag}" must be 1\u2013${MAX_TAG_LEN} characters`);
+  }
+}
+function validateTags(tags) {
+  if (tags.length > MAX_TAGS) {
+    throw new ConvilynAuthorError(`at most ${MAX_TAGS} tags are allowed (got ${tags.length})`);
+  }
+  tags.forEach(validateTag);
+}
+function toolKey(toolName) {
+  const parts = toolName.split(":");
+  return parts[parts.length - 1] ?? toolName;
+}
+function validateToolName(toolName) {
+  if (toolName.length < 1 || toolName.length > MAX_TOOL_NAME) {
+    throw new ConvilynAuthorError(`toolName must be 1\u2013${MAX_TOOL_NAME} characters`);
+  }
+  if (toolKey(toolName) === FORBIDDEN_TOOL) {
+    throw new ConvilynAuthorError(
+      `tool "${FORBIDDEN_TOOL}" is not permitted in a workflow palette (the agent cannot pause mid-execution)`
+    );
+  }
+}
+var WorkflowSpec = class _WorkflowSpec {
+  #state;
+  constructor(name, options = {}) {
+    validateName(name);
+    if (options.specId != null) {
+      validateSpecId(options.specId);
+    }
+    const version = options.version ?? DEFAULT_VERSION;
+    validateVersion(version);
+    this.#state = {
+      name,
+      systemPrompt: "",
+      schemaVersion: DEFAULT_SCHEMA_VERSION,
+      specId: options.specId,
+      version,
+      tags: [],
+      toolPalette: []
+    };
+  }
+  #cloneWith(patch) {
+    const next = new _WorkflowSpec(this.#state.name);
+    next.#state = {
+      ...this.#state,
+      ...patch,
+      tags: [...patch.tags ?? this.#state.tags],
+      toolPalette: [...patch.toolPalette ?? this.#state.toolPalette]
+    };
+    return next;
+  }
+  // ── read-only accessors (return copies to preserve immutability) ──────────
+  get name() {
+    return this.#state.name;
+  }
+  get description() {
+    return this.#state.description;
+  }
+  get systemPrompt() {
+    return this.#state.systemPrompt;
+  }
+  get schemaVersion() {
+    return this.#state.schemaVersion;
+  }
+  get specId() {
+    return this.#state.specId;
+  }
+  get version() {
+    return this.#state.version;
+  }
+  get tags() {
+    return [...this.#state.tags];
+  }
+  get toolPalette() {
+    return this.#state.toolPalette.map((item) => ({ ...item, position: { ...item.position } }));
+  }
+  get canvasLayout() {
+    return this.#state.canvasLayout;
+  }
+  // ── builder methods ───────────────────────────────────────────────────────
+  withName(name) {
+    validateName(name);
+    return this.#cloneWith({ name });
+  }
+  withDescription(description) {
+    validateDescription(description);
+    return this.#cloneWith({ description });
+  }
+  withSystemPrompt(systemPrompt) {
+    validateSystemPrompt(systemPrompt);
+    return this.#cloneWith({ systemPrompt });
+  }
+  withSchemaVersion(schemaVersion) {
+    return this.#cloneWith({ schemaVersion });
+  }
+  /** Set the portal spec id (`dev_<developer-id>.<name>` namespace). */
+  withSpecId(specId) {
+    validateSpecId(specId);
+    return this.#cloneWith({ specId });
+  }
+  /** Set the blueprint semver version (default `1.0.0`). */
+  withVersion(version) {
+    validateVersion(version);
+    return this.#cloneWith({ version });
+  }
+  /** Replace the tag set. */
+  withTags(tags) {
+    validateTags(tags);
+    return this.#cloneWith({ tags: [...tags] });
+  }
+  /** Append a tag (no-op if already present). */
+  addTag(tag) {
+    validateTag(tag);
+    if (this.#state.tags.includes(tag)) {
+      return this.#cloneWith({});
+    }
+    const tags = [...this.#state.tags, tag];
+    validateTags(tags);
+    return this.#cloneWith({ tags });
+  }
+  /**
+   * Add (or replace, by `toolName`) one tool on the palette. Rejects the
+   * `request_user_input` tool (invariant I3) and palettes larger than
+   * {@link MAX_TOOLS}.
+   */
+  addTool(toolName, options = {}) {
+    validateToolName(toolName);
+    if (options.note != null && options.note.length > MAX_NOTE) {
+      throw new ConvilynAuthorError(`tool note must be \u2264 ${MAX_NOTE} characters`);
+    }
+    const item = {
+      toolName,
+      position: options.position ? { ...options.position } : { ...ORIGIN },
+      ...options.note != null ? { note: options.note } : {}
+    };
+    const existing = this.#state.toolPalette.findIndex((entry) => entry.toolName === toolName);
+    const toolPalette = existing >= 0 ? this.#state.toolPalette.map((entry, index) => index === existing ? item : entry) : [...this.#state.toolPalette, item];
+    if (toolPalette.length > MAX_TOOLS) {
+      throw new ConvilynAuthorError(`at most ${MAX_TOOLS} tools are allowed`);
+    }
+    return this.#cloneWith({ toolPalette });
+  }
+  /** Add several tools by name (default canvas position), de-duplicated. */
+  useTools(...toolNames) {
+    return toolNames.reduce((spec, toolName) => spec.addTool(toolName), this);
+  }
+  withCanvasLayout(canvasLayout) {
+    return this.#cloneWith({ canvasLayout });
+  }
+  // ── compile / serialize ───────────────────────────────────────────────────
+  /**
+   * The PUBLIC publish blueprint (snake_case; Python-SDK parity). This is the
+   * shape `submitWorkflow` / `convilyn-author push` send to the Developer
+   * Portal. Requires a `specId` (constructor option or {@link withSpecId}).
+   *
+   * Mirrors the Python SDK's `exclude_none` semantics: `agent_config` is
+   * emitted only when a systemPrompt is set, `mcp_config` only when the
+   * palette is non-empty. UI-only metadata (positions, notes, canvasLayout)
+   * is deliberately NOT emitted — the portal's blueprint schema rejects
+   * unknown fields; that data belongs to {@link toExportPayload}.
+   */
+  compile() {
+    const specId = this.#state.specId;
+    if (specId == null) {
+      throw new ConvilynAuthorError(
+        'compile() requires a specId \u2014 pass it to the constructor (new WorkflowSpec(name, { specId })) or call withSpecId(). The Developer Portal expects the "dev_<developer-id>.<name>" namespace.'
+      );
+    }
+    const blueprint = {
+      public_schema_version: PUBLIC_SCHEMA_VERSION,
+      spec_id: specId,
+      version: this.#state.version,
+      name: this.#state.name,
+      keywords: [...this.#state.tags]
+    };
+    if (this.#state.description != null) {
+      blueprint.description = this.#state.description;
+    }
+    if (this.#state.systemPrompt !== "") {
+      blueprint.agent_config = { system_prompt: this.#state.systemPrompt };
+    }
+    if (this.#state.toolPalette.length > 0) {
+      const tools = this.#state.toolPalette.map((item) => item.toolName);
+      const servers = [
+        ...new Set(
+          tools.filter((toolName) => toolName.includes(":")).map((toolName) => toolName.split(":")[0])
+        )
+      ];
+      blueprint.mcp_config = { mcp_servers: servers, tools };
+    }
+    return blueprint;
+  }
+  /** The compiled blueprint serialised as 2-space-indented JSON. */
+  compileJson() {
+    return JSON.stringify(this.compile(), null, 2);
+  }
+  /** Write the compiled blueprint to a JSON file (default `workflow.spec.json`). */
+  async save(path = "workflow.spec.json") {
+    await promises.writeFile(path, this.compileJson(), "utf8");
+    return path;
+  }
+  /**
+   * The camelCase user_workflows `ExportPayload` (canvas/authoring contract).
+   * Carries the UI-only metadata (positions, notes, canvasLayout) that the
+   * publish blueprint omits.
+   */
+  toExportPayload() {
+    const payload = {
+      schemaVersion: this.#state.schemaVersion,
+      name: this.#state.name,
+      systemPrompt: this.#state.systemPrompt,
+      toolPalette: this.#state.toolPalette.map((item) => ({
+        toolName: item.toolName,
+        position: { ...item.position },
+        ...item.note != null ? { note: item.note } : {}
+      })),
+      tags: [...this.#state.tags]
+    };
+    if (this.#state.description != null) {
+      payload.description = this.#state.description;
+    }
+    if (this.#state.canvasLayout != null) {
+      payload.canvasLayout = this.#state.canvasLayout;
+    }
+    return payload;
+  }
+  /** Rebuild a {@link WorkflowSpec} from a user_workflows `ExportPayload`. */
+  static fromExportPayload(payload) {
+    let spec = new _WorkflowSpec(payload.name).withSystemPrompt(payload.systemPrompt ?? "").withSchemaVersion(payload.schemaVersion ?? DEFAULT_SCHEMA_VERSION).withTags(payload.tags ?? []);
+    if (payload.description != null) {
+      spec = spec.withDescription(payload.description);
+    }
+    if (payload.canvasLayout != null) {
+      spec = spec.withCanvasLayout(payload.canvasLayout);
+    }
+    for (const item of payload.toolPalette ?? []) {
+      spec = spec.addTool(item.toolName, {
+        position: item.position,
+        ...item.note != null ? { note: item.note } : {}
+      });
+    }
+    return spec;
+  }
+  /**
+   * Rebuild a {@link WorkflowSpec} from a publish blueprint. Lossy for canvas
+   * metadata by design — that data lives in the `ExportPayload` contract.
+   */
+  static fromBlueprint(blueprint) {
+    let spec = new _WorkflowSpec(blueprint.name, {
+      specId: blueprint.spec_id,
+      ...blueprint.version != null ? { version: blueprint.version } : {}
+    }).withSystemPrompt(blueprint.agent_config?.system_prompt ?? "").withTags(blueprint.keywords ?? []);
+    if (blueprint.description != null) {
+      spec = spec.withDescription(blueprint.description);
+    }
+    for (const toolName of blueprint.mcp_config?.tools ?? []) {
+      spec = spec.addTool(toolName);
+    }
+    return spec;
+  }
+  /**
+   * Parse a spec from a JSON string. Shape-sniffs: objects carrying `spec_id`
+   * or `public_schema_version` parse as a blueprint; anything else as an
+   * `ExportPayload` — so `push --workflow-file` accepts both file formats.
+   */
+  static fromJson(data) {
+    const parsed = JSON.parse(data);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new ConvilynAuthorError("workflow spec JSON must be an object");
+    }
+    if ("spec_id" in parsed || "public_schema_version" in parsed) {
+      return _WorkflowSpec.fromBlueprint(parsed);
+    }
+    return _WorkflowSpec.fromExportPayload(parsed);
+  }
+  /** Read a saved spec from a JSON file (default `workflow.spec.json`). */
+  static async load(path = "workflow.spec.json") {
+    return _WorkflowSpec.fromJson(await promises.readFile(path, "utf8"));
+  }
+};
+
+// src/cli/load-workflow.ts
+function isWorkflowSpecLike(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.compile === "function" && typeof candidate.name === "string";
+}
+function pickWorkflow(mod) {
+  if (isWorkflowSpecLike(mod.default)) {
+    return mod.default;
+  }
+  if (isWorkflowSpecLike(mod.workflow)) {
+    return mod.workflow;
+  }
+  for (const value of Object.values(mod)) {
+    if (isWorkflowSpecLike(value)) {
+      return value;
+    }
+  }
+  return void 0;
+}
+async function loadWorkflowSpec(file) {
+  const absolute = path.resolve(file);
+  if (path.extname(absolute).toLowerCase() === ".json") {
+    try {
+      return await WorkflowSpec.load(absolute);
+    } catch (err) {
+      throw new Error(
+        `Could not load workflow spec "${file}": ${err.message}. Point --workflow-file at a compiled spec JSON (from WorkflowSpec.save()) or a built .js module that exports a WorkflowSpec.`
+      );
+    }
+  }
+  let mod;
+  try {
+    mod = await import(url.pathToFileURL(absolute).href);
+  } catch (err) {
+    throw new Error(
+      `Could not import workflow module "${file}": ${err.message}. Point --workflow-file at a built .js module (e.g. "npm run build" then --workflow-file dist/workflow.js) or a compiled .spec.json.`
+    );
+  }
+  const workflow = pickWorkflow(mod);
+  if (workflow === void 0) {
+    throw new Error(
+      `No WorkflowSpec found in "${file}". Export it as the default export or as a named "workflow" export.`
+    );
+  }
+  return workflow;
+}
+var SIGNATURE_HEADER = "x-convilyn-signature";
+var TIMESTAMP_HEADER = "x-convilyn-timestamp";
+var DEFAULT_HMAC_TOLERANCE_SECONDS = 300;
+function expectedSignature(secret, timestamp, body) {
+  return crypto.createHmac("sha256", secret).update(timestamp).update(".").update(body).digest("hex");
+}
+function constantTimeEqual(a, b) {
+  const aBuf = Buffer.from(a);
+  const bBuf = Buffer.from(b);
+  if (aBuf.length !== bBuf.length) {
+    return false;
+  }
+  return crypto.timingSafeEqual(aBuf, bBuf);
+}
+function verifySignature(secret, body, headers, options = {}) {
+  const tolerance = options.toleranceSeconds != null && options.toleranceSeconds > 0 ? options.toleranceSeconds : DEFAULT_HMAC_TOLERANCE_SECONDS;
+  const now = options.now ?? (() => Math.floor(Date.now() / 1e3));
+  if (!secret) {
+    throw new InvalidSignatureError("missing_secret", "HMAC secret is not configured on the server");
+  }
+  const signature = headers[SIGNATURE_HEADER];
+  const timestamp = headers[TIMESTAMP_HEADER];
+  if (!signature || !timestamp) {
+    throw new InvalidSignatureError(
+      "missing_header",
+      "Missing X-Convilyn-Signature or X-Convilyn-Timestamp"
+    );
+  }
+  if (!/^[+-]?\d+$/.test(timestamp)) {
+    throw new InvalidSignatureError(
+      "invalid_timestamp",
+      "X-Convilyn-Timestamp must be an integer Unix-seconds value"
+    );
+  }
+  const tsValue = Number(timestamp);
+  if (Math.abs(now() - tsValue) > tolerance) {
+    throw new InvalidSignatureError(
+      "timestamp_out_of_range",
+      "Request timestamp outside acceptable tolerance window"
+    );
+  }
+  const expected = expectedSignature(secret, timestamp, body);
+  if (!constantTimeEqual(expected, signature)) {
+    throw new InvalidSignatureError(
+      "signature_mismatch",
+      "Signature did not match expected HMAC-SHA256 digest"
+    );
+  }
+}
+
+// src/config.ts
+function envOr(env, key, fallback) {
+  const value = env[key];
+  return value !== void 0 && value !== "" ? value : fallback;
+}
+function envIntOr(env, key, fallback) {
+  const value = env[key];
+  if (value !== void 0 && value !== "") {
+    const parsed = Number(value);
+    if (Number.isInteger(parsed)) {
+      return parsed;
+    }
+  }
+  return fallback;
+}
+var SDKConfig = class _SDKConfig {
+  serverHost;
+  serverPort;
+  logLevel;
+  awsRegion;
+  dynamodbEndpoint;
+  toolDataTable;
+  environment;
+  apiKey;
+  platformUrl;
+  hmacSecret;
+  hmacToleranceSeconds;
+  toolConfirmationSecret;
+  #lambda;
+  constructor(options = {}) {
+    this.serverHost = options.serverHost ?? "127.0.0.1";
+    this.serverPort = options.serverPort ?? 8080;
+    this.logLevel = options.logLevel ?? "INFO";
+    this.awsRegion = options.awsRegion ?? "ap-northeast-1";
+    this.dynamodbEndpoint = options.dynamodbEndpoint ?? "";
+    this.toolDataTable = options.toolDataTable ?? "tool-data";
+    this.environment = options.environment ?? "local";
+    this.apiKey = options.apiKey ?? "";
+    this.platformUrl = options.platformUrl ?? "https://api.convilyn.corenovus.com";
+    this.hmacSecret = options.hmacSecret ?? "";
+    this.hmacToleranceSeconds = options.hmacToleranceSeconds ?? DEFAULT_HMAC_TOLERANCE_SECONDS;
+    this.toolConfirmationSecret = options.toolConfirmationSecret ?? "";
+    this.#lambda = options.lambda ?? false;
+  }
+  /** True when running in AWS Lambda. */
+  get isLambda() {
+    return this.#lambda;
+  }
+  /** True for a local/dev environment (relaxes HMAC). */
+  get isLocal() {
+    if (this.environment === "local") {
+      return true;
+    }
+    return !this.#lambda && (this.serverHost === "127.0.0.1" || this.serverHost === "localhost");
+  }
+  /** Load configuration from environment variables, falling back to defaults. */
+  static fromEnv(env = typeof process !== "undefined" ? process.env : {}) {
+    return new _SDKConfig({
+      serverHost: envOr(env, "CONVILYN_HOST", "127.0.0.1"),
+      serverPort: envIntOr(env, "CONVILYN_PORT", 8080),
+      logLevel: envOr(env, "CONVILYN_LOG_LEVEL", "INFO"),
+      awsRegion: envOr(env, "AWS_REGION", "ap-northeast-1"),
+      dynamodbEndpoint: envOr(env, "DYNAMODB_ENDPOINT", ""),
+      toolDataTable: envOr(env, "TOOL_DATA_TABLE", "tool-data"),
+      environment: envOr(env, "CONVILYN_ENVIRONMENT", "local"),
+      apiKey: envOr(env, "CONVILYN_API_KEY", ""),
+      platformUrl: envOr(env, "CONVILYN_PLATFORM_URL", "https://api.convilyn.corenovus.com"),
+      hmacSecret: envOr(env, "CONVILYN_HMAC_SECRET", ""),
+      hmacToleranceSeconds: envIntOr(
+        env,
+        "CONVILYN_HMAC_TOLERANCE_SECONDS",
+        DEFAULT_HMAC_TOLERANCE_SECONDS
+      ),
+      toolConfirmationSecret: envOr(env, "CONVILYN_TOOL_CONFIRMATION_SECRET", ""),
+      lambda: Boolean(env["AWS_LAMBDA_FUNCTION_NAME"])
+    });
+  }
+};
+
+// src/client.ts
+function withApiV1(platformUrl) {
+  const trimmed = platformUrl.replace(/\/+$/, "");
+  return trimmed.endsWith("/api/v1") ? trimmed : `${trimmed}/api/v1`;
+}
+var CONSUMER_KEY_PREFIX = "ck_";
+function isConsumerKey(key) {
+  return key.startsWith(CONSUMER_KEY_PREFIX);
+}
+function maskKey(key) {
+  return key.length <= 8 ? "***" : `${key.slice(0, 4)}\u2026${key.slice(-2)}`;
+}
+var ConvilynClient = class {
+  baseUrl;
+  #apiKey;
+  #fetch;
+  constructor(options = {}) {
+    const config = options.config ?? SDKConfig.fromEnv();
+    this.baseUrl = options.baseUrl ?? withApiV1(config.platformUrl);
+    this.#apiKey = options.apiKey ?? config.apiKey;
+    if (this.#apiKey && isConsumerKey(this.#apiKey)) {
+      throw new ConvilynAuthorError(
+        `${maskKey(this.#apiKey)} looks like a Convilyn consumer API key ("${CONSUMER_KEY_PREFIX}"), not an Author SDK / developer-portal token. The Author SDK authenticates with a cvl_ developer key \u2014 call register() to mint one, or set CONVILYN_API_KEY to your cvl_ key. (Consumer keys call the data-plane API; they do not publish workflows / tools.)`
+      );
+    }
+    this.#fetch = options.fetch ?? globalThis.fetch;
+  }
+  /** The `cvl_` developer key currently in use (empty until set or registered). */
+  get apiKey() {
+    return this.#apiKey;
+  }
+  #headers(auth) {
+    const headers = { "content-type": "application/json" };
+    if (auth) {
+      if (!this.#apiKey) {
+        throw new ConvilynAuthorError(
+          "No developer API key set. Provide `apiKey`, set CONVILYN_API_KEY to a cvl_ developer key, or call register() first."
+        );
+      }
+      headers.authorization = `Bearer ${this.#apiKey}`;
+    }
+    return headers;
+  }
+  async #request(method, path, body, auth = true) {
+    const res = await this.#fetch(`${this.baseUrl}${path}`, {
+      method,
+      headers: this.#headers(auth),
+      body: body !== void 0 ? JSON.stringify(body) : void 0
+    });
+    if (!res.ok) {
+      let parsed;
+      try {
+        parsed = await res.json();
+      } catch {
+        parsed = void 0;
+      }
+      throw new ConvilynApiError(
+        res.status,
+        `${method} ${path} failed (HTTP ${res.status})`,
+        parsed
+      );
+    }
+    if (res.status === 204) {
+      return void 0;
+    }
+    return await res.json();
+  }
+  // ── Developer registration ──────────────────────────────────────
+  /**
+   * `POST /developers/register` — create a developer account and mint a `cvl_`
+   * key. No auth required. The returned key is captured on this client for
+   * subsequent calls (and returned so the caller can persist it — it is shown
+   * only once).
+   */
+  async register(request) {
+    const result = await this.#request(
+      "POST",
+      "/developers/register",
+      request,
+      false
+    );
+    if (result.api_key && !this.#apiKey) {
+      this.#apiKey = result.api_key;
+    }
+    return result;
+  }
+  // ── Server operations ───────────────────────────────────────────
+  /** `POST /developers/servers` — submit a tool-server manifest for verification. */
+  async submitServer(request) {
+    return this.#request("POST", "/developers/servers", request);
+  }
+  /** `GET /developers/servers` — list this developer's servers. */
+  async listServers() {
+    return this.#request("GET", "/developers/servers");
+  }
+  /** `GET /developers/servers/{id}/status` — verification status of a server. */
+  async serverStatus(serverId) {
+    return this.#request(
+      "GET",
+      `/developers/servers/${encodeURIComponent(serverId)}/status`
+    );
+  }
+  /** `POST /developers/servers/{id}/test` — trigger a sandbox test run. */
+  async testServer(serverId, slots = {}) {
+    return this.#request(
+      "POST",
+      `/developers/servers/${encodeURIComponent(serverId)}/test`,
+      { slots }
+    );
+  }
+  /** `DELETE /developers/servers/{id}` — deactivate a server. */
+  async deactivateServer(serverId) {
+    await this.#request("DELETE", `/developers/servers/${encodeURIComponent(serverId)}`);
+  }
+  // ── Workflow operations ─────────────────────────────────────────
+  /** `POST /developers/workflows` — submit a compiled workflow spec + its server ids. */
+  async submitWorkflow(request) {
+    return this.#request("POST", "/developers/workflows", request);
+  }
+  /** `GET /developers/workflows` — list this developer's workflows. */
+  async listWorkflows() {
+    return this.#request("GET", "/developers/workflows");
+  }
+  /** `GET /developers/workflows/{id}/status` — verification status of a workflow. */
+  async workflowStatus(workflowId) {
+    return this.#request(
+      "GET",
+      `/developers/workflows/${encodeURIComponent(workflowId)}/status`
+    );
+  }
+  /** `POST /developers/workflows/{id}/test` — sandbox-test a submitted workflow. */
+  async testWorkflow(workflowId, testInput = {}) {
+    return this.#request(
+      "POST",
+      `/developers/workflows/${encodeURIComponent(workflowId)}/test`,
+      { test_input: testInput }
+    );
+  }
+  /** `DELETE /developers/workflows/{id}` — deactivate a workflow. */
+  async deactivateWorkflow(workflowId) {
+    await this.#request("DELETE", `/developers/workflows/${encodeURIComponent(workflowId)}`);
+  }
+  // ── Convilyn-Hosted Author Runtime (port of the Python client) ─────────────
+  /**
+   * `POST /developers/runtimes/hosted` — deploy a tool server into the
+   * Convilyn-Hosted Author Runtime. Counterpart to {@link submitServer}:
+   * instead of registering a caller-deployed endpoint, the platform
+   * provisions a sandboxed Lambda and returns its public endpoint URL.
+   *
+   * Backends without the hosted stack answer 503 `HOSTED_NOT_AVAILABLE`
+   * (older builds: 501); environments with the router unmounted answer 404.
+   * All surface as {@link ConvilynApiError} — catch and fall back to
+   * `push --endpoint-url` (BYO) when a hard guarantee is needed.
+   */
+  async deployHostedRuntime(manifest, options) {
+    const body = { manifest, region: options.region };
+    if (options.workflowSpec !== void 0) {
+      body.workflow_spec = options.workflowSpec;
+    }
+    return this.#request("POST", "/developers/runtimes/hosted", body);
+  }
+  /**
+   * `POST /developers/runtimes/{id}/rollback` — atomically flip the runtime
+   * back to its previous active version.
+   */
+  async rollbackHostedRuntime(runtimeId) {
+    return this.#request(
+      "POST",
+      `/developers/runtimes/${encodeURIComponent(runtimeId)}/rollback`
+    );
+  }
+  /**
+   * `GET /developers/runtimes/{id}/logs` — recent runtime log lines.
+   * `since` is an ISO-8601 timestamp or relative shorthand (`"5m"`, `"1h"`)
+   * interpreted server-side; `limit` defaults to 100 (server caps ~1000).
+   * Accepts either a bare list or an `{entries: [...]}` envelope (mirror of
+   * the Python client) so the SDK survives the wire shape stabilising.
+   */
+  async getHostedRuntimeLogs(runtimeId, options = {}) {
+    const limit = Math.trunc(options.limit ?? 100);
+    let path = `/developers/runtimes/${encodeURIComponent(runtimeId)}/logs?limit=${limit}`;
+    if (options.since) {
+      path = `${path}&since=${encodeURIComponent(options.since)}`;
+    }
+    const result = await this.#request("GET", path);
+    if (Array.isArray(result)) {
+      return result;
+    }
+    if (typeof result === "object" && result !== null && Array.isArray(result.entries)) {
+      return result.entries;
+    }
+    return [];
+  }
+};
+
+// src/jsonrpc.ts
+var JSONRPC_VERSION = "2.0";
+var TOOLS_CALL = "tools/call";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asRpcRequest(parsed) {
+  if (!isRecord(parsed) || typeof parsed.method !== "string") {
+    return null;
+  }
+  const id = typeof parsed.id === "string" || typeof parsed.id === "number" ? parsed.id : null;
+  return {
+    jsonrpc: typeof parsed.jsonrpc === "string" ? parsed.jsonrpc : JSONRPC_VERSION,
+    method: parsed.method,
+    params: isRecord(parsed.params) ? parsed.params : {},
+    id
+  };
+}
+
+// src/http-runtime.ts
+var ENV_DEV_INSECURE = "CONVILYN_DEV_INSECURE";
+var DEV_INSECURE_TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+function devInsecureRequested(env = process.env) {
+  return DEV_INSECURE_TRUTHY.has((env[ENV_DEV_INSECURE] ?? "").trim().toLowerCase());
+}
+var JSON_HEADERS = { "content-type": "application/json" };
+function sendJson(res, statusCode, body) {
+  res.writeHead(statusCode, JSON_HEADERS);
+  res.end(JSON.stringify(body));
+}
+var MAX_BODY_BYTES = 10 * 1024 * 1024;
+var BodyTooLargeError = class extends Error {
+  constructor() {
+    super(`Request body exceeds ${MAX_BODY_BYTES} bytes`);
+    this.name = "BodyTooLargeError";
+  }
+};
+function readBody(req, maxBytes = MAX_BODY_BYTES) {
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    let total = 0;
+    req.on("data", (chunk) => {
+      total += chunk.length;
+      if (total > maxBytes) {
+        chunks.length = 0;
+        reject(new BodyTooLargeError());
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve4(Buffer.concat(chunks)));
+    req.on("error", reject);
+  });
+}
+async function handleMcp(server, req, res, secret, toleranceSeconds, allowInsecure) {
+  let body;
+  try {
+    body = await readBody(req);
+  } catch (err) {
+    if (err instanceof BodyTooLargeError) {
+      res.once("finish", () => req.destroy());
+      sendJson(res, 413, {
+        code: "PAYLOAD_TOO_LARGE",
+        message: "Request body too large"
+      });
+      return;
+    }
+    throw err;
+  }
+  if (secret === "" && allowInsecure) {
+    await dispatchParsed(server, res, body);
+    return;
+  }
+  try {
+    verifySignature(secret, body, req.headers, {
+      toleranceSeconds
+    });
+  } catch (err) {
+    if (err instanceof InvalidSignatureError) {
+      sendJson(res, 401, {
+        code: "INVALID_SIGNATURE",
+        message: "Request signature could not be verified"
+      });
+      return;
+    }
+    throw err;
+  }
+  await dispatchParsed(server, res, body);
+}
+async function dispatchParsed(server, res, body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body.toString("utf8"));
+  } catch {
+    sendJson(res, 400, { error: "Invalid JSON" });
+    return;
+  }
+  const request = asRpcRequest(parsed);
+  if (request === null) {
+    sendJson(res, 400, { error: "Invalid JSON" });
+    return;
+  }
+  const response = await server.dispatch(request);
+  sendJson(res, 200, response);
+}
+function serve(toolServer, options = {}) {
+  const config = options.config ?? SDKConfig.fromEnv();
+  const host = options.host ?? config.serverHost;
+  const port = options.port ?? config.serverPort;
+  const secret = options.hmacSecret ?? config.hmacSecret;
+  const toleranceSeconds = options.toleranceSeconds ?? config.hmacToleranceSeconds;
+  const allowInsecure = options.allowInsecure ?? devInsecureRequested();
+  if (secret === "" && !allowInsecure) {
+    throw new ConvilynStartupError(
+      `CONVILYN_HMAC_SECRET is required to serve inbound /mcp traffic. Refusing to start without signature verification. For local development use \`convilyn-author dev\` or set ${ENV_DEV_INSECURE}=1 (INSECURE \u2014 local only).`
+    );
+  }
+  if (secret === "") {
+    console.warn(
+      "convilyn-author: CONVILYN_HMAC_SECRET not set; serving /mcp WITHOUT signature verification (insecure local dev only \u2014 do NOT deploy this configuration)"
+    );
+  }
+  const httpServer = http.createServer((req, res) => {
+    void route(toolServer, req, res, secret, toleranceSeconds, allowInsecure).catch(() => {
+      if (!res.headersSent) {
+        sendJson(res, 500, { error: "Internal server error" });
+      }
+    });
+  });
+  httpServer.listen(port, host);
+  return httpServer;
+}
+async function route(toolServer, req, res, secret, toleranceSeconds, allowInsecure) {
+  const path = (req.url ?? "").split("?")[0];
+  const method = req.method ?? "GET";
+  if (method === "GET" && path === "/health") {
+    sendJson(res, 200, {
+      status: "healthy",
+      server: toolServer.server.name,
+      version: VERSION,
+      tool_count: toolServer.toolCount
+    });
+    return;
+  }
+  if (method === "GET" && path === "/manifest") {
+    sendJson(res, 200, toolServer.manifest().toWire());
+    return;
+  }
+  if (method === "POST" && path === "/mcp") {
+    await handleMcp(toolServer, req, res, secret, toleranceSeconds, allowInsecure);
+    return;
+  }
+  sendJson(res, 404, { error: "Not found" });
+}
+
+// src/tool-server.ts
+var GET_TOOL_DATA = "get_tool_data";
+
+// src/compliance.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function pass(checkName, message) {
+  return { passed: true, checkName, message };
+}
+function fail(checkName, message) {
+  return { passed: false, checkName, message };
+}
+function checkServerMetadata(server) {
+  const { name, version, description } = server.server;
+  if (!name || !version || !description) {
+    return fail("server_metadata", "server name, version, and description must all be non-empty");
+  }
+  return pass("server_metadata", "server metadata is complete");
+}
+function checkToolsExist(server) {
+  return server.toolCount > 0 ? pass("tools_exist", `server has ${server.toolCount} tool(s)`) : fail("tools_exist", "server has no registered tools");
+}
+function checkToolSchemas(server) {
+  for (const tool of server.manifest().tools) {
+    if (!tool.name || !tool.description) {
+      return fail("tool_schemas", `tool "${tool.name}" is missing a name or description`);
+    }
+    if (!isRecord2(tool.inputSchema) || tool.inputSchema.type !== "object") {
+      return fail("tool_schemas", `tool "${tool.name}" input_schema is not a JSON-Schema object`);
+    }
+  }
+  return pass("tool_schemas", "all tool schemas are valid");
+}
+function checkManifestSynth(server) {
+  try {
+    const wire = server.manifest().toWire();
+    return isRecord2(wire) ? pass("manifest_synth", "manifest compiles to a wire object") : fail("manifest_synth", "manifest did not compile to an object");
+  } catch (err) {
+    return fail("manifest_synth", `manifest synth threw: ${err.message}`);
+  }
+}
+async function checkRefIdPattern(server) {
+  const refId = await server.dataStore.store({ __compliance_probe__: true });
+  return /^td_[0-9a-f]{12}$/.test(refId) ? pass("ref_id_pattern", "data store returns a td_<12-hex> ref_id") : fail("ref_id_pattern", `ref_id "${refId}" does not match td_<12-hex>`);
+}
+async function checkGetToolData(server) {
+  const refId = await server.dataStore.store({ probe: 1 });
+  const response = await server.dispatch({
+    jsonrpc: "2.0",
+    method: TOOLS_CALL,
+    params: { name: GET_TOOL_DATA, arguments: { ref_id: refId } },
+    id: "compliance"
+  });
+  const result = response.result;
+  if (isRecord2(result) && result.status === "ok") {
+    return pass("get_tool_data", "built-in get_tool_data resolves a stored ref_id");
+  }
+  return fail("get_tool_data", "built-in get_tool_data did not resolve a stored ref_id");
+}
+async function runComplianceChecks(server) {
+  const results = [
+    checkServerMetadata(server),
+    checkToolsExist(server),
+    checkToolSchemas(server),
+    checkManifestSynth(server),
+    await checkRefIdPattern(server),
+    await checkGetToolData(server)
+  ];
+  return { results };
+}
+
+// src/cli/commands.ts
+var DEFAULT_SERVER_FILE = "server.js";
+var DEFAULT_WORKFLOW_FILE = "workflow.spec.json";
+var DEFAULT_MANIFEST_OUTPUT = "convilyn.manifest.json";
+async function runSynth(options) {
+  const server = await loadToolServer(options.file ?? DEFAULT_SERVER_FILE);
+  const manifest = server.manifest();
+  const path = await manifest.save(options.output ?? DEFAULT_MANIFEST_OUTPUT);
+  return { path, toolCount: manifest.tools.length, toolNames: manifest.tools.map((t) => t.name) };
+}
+async function runDev(options) {
+  const server = await loadToolServer(options.file ?? DEFAULT_SERVER_FILE);
+  return serve(server, {
+    host: options.host,
+    port: options.port,
+    hmacSecret: options.hmacSecret,
+    // `dev` IS the explicit insecure-local opt-in (mirror of the Python
+    // CLI's run(dev=True)). A configured secret still wins — the opt-in
+    // never bypasses verification.
+    allowInsecure: true
+  });
+}
+async function runTest(options) {
+  const server = await loadToolServer(options.file ?? DEFAULT_SERVER_FILE);
+  return runComplianceChecks(server);
+}
+async function runPush(options) {
+  if (!options.endpointUrl) {
+    throw new Error(
+      "push requires --endpoint-url <https://...> \u2014 the HTTPS URL where your tool server is deployed. Use `deploy --hosted` for a Convilyn-hosted server."
+    );
+  }
+  const server = await loadToolServer(options.file ?? DEFAULT_SERVER_FILE);
+  const workflow = await loadWorkflowSpec(options.workflowFile ?? DEFAULT_WORKFLOW_FILE);
+  const client = options.client ?? new ConvilynClient();
+  const manifest = server.manifest().toWire();
+  const serverResult = await client.submitServer({
+    manifest,
+    endpoint_url: options.endpointUrl
+  });
+  const workflowResult = await client.submitWorkflow({
+    // CompilableWorkflow.compile() is typed `unknown` (the file loader duck-types
+    // both a built WorkflowSpec and a pre-compiled JSON blueprint).
+    workflow_spec: workflow.compile(),
+    server_ids: [serverResult.server_id]
+  });
+  return {
+    serverId: serverResult.server_id,
+    serverName: serverResult.server_name,
+    serverStatus: serverResult.status,
+    workflowId: workflowResult.workflow_id,
+    workflowSpecId: workflowResult.spec_id,
+    workflowStatus: workflowResult.status
+  };
+}
+async function runDeploy(options) {
+  if (!options.hosted) {
+    throw new Error(
+      "deploy currently requires --hosted. Use `convilyn-author push --endpoint-url <https://...>` for caller-deployed (BYO) servers."
+    );
+  }
+  const server = await loadToolServer(options.file ?? DEFAULT_SERVER_FILE);
+  const manifest = server.manifest().toWire();
+  const workflowFile = options.workflowFile ?? DEFAULT_WORKFLOW_FILE;
+  let workflowSpec;
+  if (await promises.stat(workflowFile).then(
+    () => true,
+    () => false
+  )) {
+    const workflow = await loadWorkflowSpec(workflowFile);
+    workflowSpec = workflow.compile();
+  }
+  const client = options.client ?? new ConvilynClient();
+  const result = await client.deployHostedRuntime(manifest, {
+    region: options.region ?? "us-east-1",
+    ...workflowSpec !== void 0 ? { workflowSpec } : {}
+  });
+  return {
+    runtimeId: result.runtime_id,
+    endpointUrl: result.endpoint_url ?? null,
+    status: result.status,
+    region: result.region,
+    version: result.version,
+    ...result.workflow_id != null ? { workflowId: result.workflow_id } : {},
+    workflowIncluded: workflowSpec !== void 0
+  };
+}
+async function runRollback(options) {
+  const client = options.client ?? new ConvilynClient();
+  return client.rollbackHostedRuntime(options.runtimeId);
+}
+async function runLogs(options) {
+  const client = options.client ?? new ConvilynClient();
+  return client.getHostedRuntimeLogs(options.runtimeId, {
+    ...options.since !== void 0 ? { since: options.since } : {},
+    ...options.limit !== void 0 ? { limit: options.limit } : {}
+  });
+}
+
+// src/cli/program.ts
+function fail2(printer, err) {
+  printer.err(`error: ${err.message}`);
+  process.exitCode = 1;
+}
+function failHosted(printer, err) {
+  if (err instanceof ConvilynApiError && (err.status === 501 || err.status === 503)) {
+    printer.err(
+      `error: hosted runtime not yet available on this platform (${err.message}). Use \`convilyn-author push --endpoint-url ...\` as a BYO fallback.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  fail2(printer, err);
+}
+function buildProgram(printer = consolePrinter) {
+  const program = new commander.Command();
+  program.name("convilyn-author").description("Author and run Convilyn tool servers.").version(VERSION);
+  program.command("init").description("Scaffold a new tool-server project.").argument("<name>", "project name (letters, digits, hyphens, underscores)").option("--dir <dir>", "target directory (default ./<name>)").action(async (name, opts) => {
+    try {
+      const result = await scaffoldProject({ name, dir: opts.dir });
+      printer.out(`Project created: ${result.path}`);
+      printer.out(`  ${result.files.join(", ")}`);
+      printer.out(`  cd ${name} && npm install && npm run build && npx convilyn-author dev`);
+    } catch (err) {
+      fail2(printer, err);
+    }
+  });
+  program.command("synth").description("Compile the server manifest to JSON.").option("--file <file>", "built server module (default server.js)").option("--output <output>", "manifest output path (default convilyn.manifest.json)").action(async (opts) => {
+    try {
+      const result = await runSynth(opts);
+      printer.out(`Found ${result.toolCount} tool(s): ${result.toolNames.join(", ")}`);
+      printer.out(`Manifest written: ${result.path}`);
+    } catch (err) {
+      fail2(printer, err);
+    }
+  });
+  program.command("dev").description("Run the JSON-RPC /mcp server locally.").option("--file <file>", "built server module (default server.js)").option("--host <host>", "bind host (default from CONVILYN_HOST)").option("--port <port>", "bind port (default from CONVILYN_PORT)", (v) => parseInt(v, 10)).action(async (opts) => {
+    try {
+      await runDev(opts);
+      printer.out("convilyn-author dev: serving /mcp (Ctrl+C to stop)");
+    } catch (err) {
+      fail2(printer, err);
+    }
+  });
+  program.command("test").description("Run local compliance checks (no platform calls).").option("--file <file>", "built server module (default server.js)").action(async (opts) => {
+    try {
+      const report = await runTest(opts);
+      for (const r of report.results) {
+        printer.out(`  [${r.passed ? "PASS" : "FAIL"}] ${r.checkName}: ${r.message}`);
+      }
+      if (allChecksPassed(report)) {
+        printer.out(`All ${report.results.length} checks passed`);
+      } else {
+        const failed = report.results.filter((r) => !r.passed).length;
+        printer.err(`${failed} of ${report.results.length} checks failed`);
+        process.exitCode = 1;
+      }
+    } catch (err) {
+      fail2(printer, err);
+    }
+  });
+  program.command("push").description("Submit a server + workflow to the Developer Portal.").option("--file <file>", "built server module (default server.js)").option(
+    "--workflow-file <file>",
+    "compiled workflow spec or built module (default workflow.spec.json)"
+  ).option("--endpoint-url <url>", "HTTPS URL of your deployed server (required)").action(async (opts) => {
+    try {
+      const result = await runPush(opts);
+      printer.out(`Server submitted: ${result.serverId} (${result.serverStatus})`);
+      printer.out(`Workflow submitted: ${result.workflowId} (${result.workflowStatus})`);
+      printer.out("Check verification with the ConvilynClient serverStatus() / workflowStatus().");
+    } catch (err) {
+      fail2(printer, err);
+    }
+  });
+  program.command("deploy").description("Deploy a tool server to the Convilyn-Hosted Author Runtime.").option("--file <file>", "built server module (default server.js)").option(
+    "--workflow-file <file>",
+    "compiled workflow spec (default workflow.spec.json; optional \u2014 skipped when absent)"
+  ).option("--hosted", "use the managed runtime (required \u2014 BYO uses push)").option("--region <region>", "AWS region the hosted Lambda is provisioned in", "us-east-1").action(
+    async (opts) => {
+      try {
+        printer.out(`Deploying to Convilyn-Hosted Runtime in ${opts.region ?? "us-east-1"}...`);
+        const result = await runDeploy(opts);
+        printer.out(`Runtime provisioned: ${result.runtimeId} (${result.status})`);
+        printer.out(`Endpoint URL: ${result.endpointUrl ?? "pending (provisioning)"}`);
+        if (result.workflowId != null) {
+          printer.out(`Workflow registered: ${result.workflowId}`);
+        }
+        printer.out(
+          `Use 'convilyn-author logs ${result.runtimeId}' to follow runtime logs, 'convilyn-author rollback ${result.runtimeId}' to revert.`
+        );
+      } catch (err) {
+        failHosted(printer, err);
+      }
+    }
+  );
+  program.command("rollback").description("Roll a hosted runtime back to its previous active version.").argument("<runtimeId>", "runtime id returned by deploy --hosted").action(async (runtimeId) => {
+    try {
+      printer.out(`Rolling back ${runtimeId}...`);
+      const result = await runRollback({ runtimeId });
+      printer.out(`Rollback complete: now-active version ${result.version} (${result.status})`);
+    } catch (err) {
+      fail2(printer, err);
+    }
+  });
+  program.command("logs").description("Fetch recent logs for a hosted runtime.").argument("<runtimeId>", "runtime id returned by deploy --hosted").option("--since <since>", "relative window (e.g. '5m', '1h') or ISO-8601 timestamp").option("--limit <limit>", "maximum log entries to fetch", (v) => parseInt(v, 10)).action(async (runtimeId, opts) => {
+    try {
+      const entries = await runLogs({ runtimeId, ...opts });
+      if (entries.length === 0) {
+        printer.out(`No log entries for ${runtimeId} in the requested window.`);
+        return;
+      }
+      for (const entry of entries) {
+        printer.out(`[${entry.timestamp}] ${entry.level} ${entry.message}`);
+      }
+    } catch (err) {
+      fail2(printer, err);
+    }
+  });
+  return program;
+}
+
+// src/cli.ts
+buildProgram().parseAsync(process.argv).catch((err) => {
+  process.stderr.write(`error: ${err.message}
+`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=cli.cjs.map
+//# sourceMappingURL=cli.cjs.map