@cursor/bdk 0.2.1

package/dist/internal/cli-images.js

@@ -0,0 +1,604 @@
+/**
+ * `agent-sdk images push|list|rm`: a team's container images for
+ * `persistent: true` agents. `push` first checks the image locally for
+ * what the hosted install needs (linux/amd64, bash, git, node, npm) by
+ * inspecting it and running one probe container, then streams
+ * `docker save <image>` through gzip into a temp file (hashing as it
+ * goes), reserves a slot under the team cap, uploads the parts to the
+ * presigned URLs the backend handed back, and finalizes. Bytes never pass
+ * through the Cursor backend.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = Object.create((typeof AsyncIterator === "function" ? AsyncIterator : Object).prototype), verb("next"), verb("throw"), verb("return", awaitReturn), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function awaitReturn(f) { return function (v) { return Promise.resolve(v).then(f, reject); }; }
+    function verb(n, f) { if (g[n]) { i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; if (f) i[n] = f(i[n]); } }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import { mkdtemp, open, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGzip } from "node:zlib";
+import { prepare, renderApiError, renderTable } from "./cli-deploy.js";
+import { DeployApiError } from "./deploy-client.js";
+import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
+import { MAX_CONTAINER_IMAGE_BYTES, validateContainerImageName } from "./hosting.js";
+/** Persistent VMs are x86_64; an arm64 image (Apple Silicon default) will not start there. */
+const REQUIRED_PLATFORM = "linux/amd64";
+/** Same floor as `engines.node` in this package: the image runs `agent-sdk serve`. */
+const MIN_NODE_VERSION = [22, 13];
+/** glibc Debian-family bases are what the hosted install is exercised on. */
+const KNOWN_GOOD_OS_IDS = new Set(["debian", "ubuntu"]);
+const UPLOAD_CONCURRENCY = 4;
+const UPLOAD_ATTEMPTS = 3;
+/** Same anchor the backend's cap error points at. */
+const IMAGES_DASHBOARD_URL = "https://cursor.com/dashboard/deployed-agents#images";
+/**
+ * POSIX `sh` body run inside the image (host shell never sees it). Prints
+ * one `key=value` per line; a missing tool prints an empty value.
+ */
+const PROBE_SCRIPT = [
+    'echo "bash=$(command -v bash 2>/dev/null || true)"',
+    'echo "git=$(command -v git 2>/dev/null || true)"',
+    'echo "node=$(node --version 2>/dev/null || true)"',
+    'echo "npm=$(npm --version 2>/dev/null || true)"',
+    'echo "user=$(id -un 2>/dev/null || id -u 2>/dev/null || true)"',
+    'if [ -r /etc/os-release ]; then . /etc/os-release; echo "os=${ID:-}"; echo "osLike=${ID_LIKE:-}"; fi',
+].join("; ");
+function parseProbe(stdout) {
+    const probe = {};
+    for (const line of stdout.split("\n")) {
+        const eq = line.indexOf("=");
+        if (eq <= 0) {
+            continue;
+        }
+        const key = line.slice(0, eq);
+        if (key === "bash" ||
+            key === "git" ||
+            key === "node" ||
+            key === "npm" ||
+            key === "user" ||
+            key === "os" ||
+            key === "osLike") {
+            probe[key] = line.slice(eq + 1).trim();
+        }
+    }
+    return probe;
+}
+/** `v22.14.0` → `[22, 14]`; undefined for anything else. */
+function parseNodeVersion(raw) {
+    const match = /^v?(\d+)\.(\d+)(?:\.\d+)?/.exec(raw.trim());
+    if (match === null) {
+        return undefined;
+    }
+    return [Number(match[1]), Number(match[2])];
+}
+function nodeMeetsFloor(version) {
+    return (version[0] > MIN_NODE_VERSION[0] ||
+        (version[0] === MIN_NODE_VERSION[0] && version[1] >= MIN_NODE_VERSION[1]));
+}
+/**
+ * What the hosted install needs from the image, decided from `inspect` and
+ * `probe`. Failures stop the push; warnings print and continue.
+ */
+export function checkImage(inspected, probe) {
+    var _a, _b, _c, _d, _e, _f;
+    const checks = [];
+    if (inspected.platform === REQUIRED_PLATFORM) {
+        checks.push({ label: "platform", value: inspected.platform, status: "ok" });
+    }
+    else {
+        checks.push({
+            label: "platform",
+            value: inspected.platform,
+            status: "failed",
+            detail: `Hosted agents run on ${REQUIRED_PLATFORM}. Rebuild with \`docker buildx build --platform ${REQUIRED_PLATFORM} …\`.`,
+        });
+    }
+    if (probe === undefined) {
+        checks.push({
+            label: "shell",
+            value: "no sh",
+            status: "failed",
+            detail: "The image could not run `sh`. Start from a standard Debian or Ubuntu base such as node:22-bookworm-slim.",
+        });
+        return checks;
+    }
+    for (const tool of ["bash", "git"]) {
+        const path = (_a = probe[tool]) !== null && _a !== void 0 ? _a : "";
+        checks.push(path === ""
+            ? {
+                label: tool,
+                value: "missing",
+                status: "failed",
+                detail: `Install ${tool} in the image (\`apt-get install -y ${tool}\`).`,
+            }
+            : { label: tool, value: path, status: "ok" });
+    }
+    const nodeRaw = (_b = probe.node) !== null && _b !== void 0 ? _b : "";
+    const nodeVersion = parseNodeVersion(nodeRaw);
+    const floor = `${MIN_NODE_VERSION[0]}.${MIN_NODE_VERSION[1]}`;
+    if (nodeVersion === undefined) {
+        checks.push({
+            label: "node",
+            value: nodeRaw === "" ? "missing" : nodeRaw,
+            status: "failed",
+            detail: `Node.js ${floor} or newer must be on PATH; the image runs \`${CLI} serve\`.`,
+        });
+    }
+    else if (!nodeMeetsFloor(nodeVersion)) {
+        checks.push({
+            label: "node",
+            value: nodeRaw,
+            status: "failed",
+            detail: `Node.js ${floor} or newer is required.`,
+        });
+    }
+    else {
+        checks.push({ label: "node", value: nodeRaw, status: "ok" });
+    }
+    const npm = (_c = probe.npm) !== null && _c !== void 0 ? _c : "";
+    checks.push(npm === ""
+        ? {
+            label: "npm",
+            value: "missing",
+            status: "failed",
+            detail: "npm must be on PATH; the hosted install runs it.",
+        }
+        : { label: "npm", value: npm, status: "ok" });
+    const user = (_d = probe.user) !== null && _d !== void 0 ? _d : "";
+    checks.push(user === "" || user === "root" || user === "0"
+        ? { label: "user", value: user === "" ? "root" : user, status: "ok" }
+        : {
+            label: "user",
+            value: user,
+            status: "warning",
+            detail: "The image runs as a non-root user. The hosted state directory is mounted root-owned, so installs may fail to write it; prefer no USER instruction or USER root.",
+        });
+    const osIds = [(_e = probe.os) !== null && _e !== void 0 ? _e : "", ...((_f = probe.osLike) !== null && _f !== void 0 ? _f : "").split(/\s+/)]
+        .map(id => id.trim().toLowerCase())
+        .filter(id => id !== "");
+    const osValue = probe.os === undefined || probe.os === "" ? "unknown" : probe.os;
+    if (osIds.some(id => KNOWN_GOOD_OS_IDS.has(id))) {
+        checks.push({ label: "base", value: osValue, status: "ok" });
+    }
+    else if (osIds.includes("alpine")) {
+        checks.push({
+            label: "base",
+            value: osValue,
+            status: "warning",
+            detail: "Alpine is musl-based; native Node modules without musl builds fail at install. Debian or Ubuntu bases are known to work.",
+        });
+    }
+    else {
+        checks.push({
+            label: "base",
+            value: osValue,
+            status: "warning",
+            detail: "Could not identify a Debian or Ubuntu base. Other distributions may fail when the VM starts; node:22-bookworm-slim is a known-good starting point.",
+        });
+    }
+    return checks;
+}
+function renderChecks(image, checks) {
+    const width = Math.max(...checks.map(check => check.label.length));
+    const valueWidth = Math.max(...checks.map(check => check.value.length));
+    const lines = [`Checking ${image}…`];
+    for (const check of checks) {
+        lines.push(`  ${check.label.padEnd(width)}  ${check.value.padEnd(valueWidth)}  ${check.status}`);
+        if (check.detail !== undefined && check.status !== "ok") {
+            lines.push(`    ${check.detail}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+function runDocker(args) {
+    return new Promise(resolvePromise => {
+        const child = spawn("docker", args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", chunk => {
+            stdout += String(chunk);
+        });
+        child.stderr.on("data", chunk => {
+            stderr += String(chunk);
+        });
+        child.on("error", error => resolvePromise({ code: 1, stdout: "", stderr: error.message }));
+        child.on("close", code => resolvePromise({ code, stdout, stderr }));
+    });
+}
+/**
+ * Real Docker. A multi-platform image (an arm64 laptop pulling
+ * `--platform linux/amd64`) reports no os/arch at the top level, so inspect
+ * and save ask for the target platform explicitly where the daemon supports
+ * it (Docker 28+); older daemons fall back to the single-platform fields.
+ */
+function shellDocker() {
+    let savePlatform = false;
+    const format = "{{.Id}} {{.Os}}/{{.Architecture}} {{.Size}}";
+    const parse = (stdout) => {
+        const [id, platform, size] = stdout.trim().split(" ");
+        if (id === undefined || platform === undefined || size === undefined) {
+            return undefined;
+        }
+        return { id, platform, sizeBytes: Number(size) };
+    };
+    return {
+        inspect(image) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const scoped = yield runDocker([
+                    "image",
+                    "inspect",
+                    "--platform",
+                    REQUIRED_PLATFORM,
+                    image,
+                    "--format",
+                    format,
+                ]);
+                const variant = scoped.code === 0 ? parse(scoped.stdout) : undefined;
+                // An image with no linux/amd64 variant answers the scoped inspect
+                // with the manifest list itself: no os/arch. Fall through so the
+                // plain inspect names the platform it does have.
+                if (variant !== undefined && variant.platform !== "/") {
+                    savePlatform = true;
+                    return variant;
+                }
+                // Older daemon, a missing image, or one with no linux/amd64 variant:
+                // the plain inspect tells those apart (absent vs. the wrong platform).
+                const plain = yield runDocker(["image", "inspect", image, "--format", format]);
+                return plain.code === 0 ? parse(plain.stdout) : undefined;
+            });
+        },
+        probe(image) {
+            return __awaiter(this, void 0, void 0, function* () {
+                // Same platform selection as save: on an arm64 host Docker runs the
+                // amd64 variant under emulation, which is enough for `command -v`.
+                const run = yield runDocker([
+                    "run",
+                    "--rm",
+                    "--pull=never",
+                    ...(savePlatform ? ["--platform", REQUIRED_PLATFORM] : []),
+                    "--entrypoint",
+                    "sh",
+                    image,
+                    "-c",
+                    PROBE_SCRIPT,
+                ]);
+                return run.code === 0 ? parseProbe(run.stdout) : undefined;
+            });
+        },
+        save(image) {
+            const child = spawn("docker", savePlatform ? ["save", "--platform", REQUIRED_PLATFORM, image] : ["save", image], { stdio: ["ignore", "pipe", "inherit"] });
+            const stream = child.stdout;
+            child.on("close", code => {
+                if (code !== 0) {
+                    stream.destroy(new Error(`docker save exited with ${code}`));
+                }
+            });
+            return stream;
+        },
+    };
+}
+function formatBytes(bytes) {
+    if (bytes >= Math.pow(1024, 3)) {
+        return `${(bytes / Math.pow(1024, 3)).toFixed(2)} GiB`;
+    }
+    if (bytes >= Math.pow(1024, 2)) {
+        return `${(bytes / Math.pow(1024, 2)).toFixed(1)} MiB`;
+    }
+    return `${Math.ceil(bytes / 1024)} KiB`;
+}
+function saveCompressed(docker, image, path) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const hash = createHash("sha256");
+        yield pipeline(docker.save(image), createGzip(), function (source) {
+            return __asyncGenerator(this, arguments, function* () {
+                var _a, e_1, _b, _c;
+                try {
+                    for (var _d = true, source_1 = __asyncValues(source), source_1_1; source_1_1 = yield __await(source_1.next()), _a = source_1_1.done, !_a; _d = true) {
+                        _c = source_1_1.value;
+                        _d = false;
+                        const chunk = _c;
+                        hash.update(chunk);
+                        yield yield __await(chunk);
+                    }
+                }
+                catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                finally {
+                    try {
+                        if (!_d && !_a && (_b = source_1.return)) yield __await(_b.call(source_1));
+                    }
+                    finally { if (e_1) throw e_1.error; }
+                }
+            });
+        }, createWriteStream(path));
+        return {
+            sha256: hash.digest("hex"),
+            sizeBytes: (yield stat(path)).size,
+        };
+    });
+}
+function uploadPart(fetchImpl, path, part, range) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const handle = yield open(path, "r");
+        try {
+            const length = range.end - range.start;
+            const buffer = Buffer.alloc(length);
+            yield handle.read(buffer, 0, length, range.start);
+            let lastError;
+            for (let attempt = 1; attempt <= UPLOAD_ATTEMPTS; attempt++) {
+                try {
+                    const response = yield fetchImpl(part.url, {
+                        method: "PUT",
+                        body: buffer,
+                        headers: { "content-length": String(length) },
+                    });
+                    if (!response.ok) {
+                        throw new Error(`part ${part.partNumber}: HTTP ${response.status} ${yield response.text()}`);
+                    }
+                    const etag = response.headers.get("etag");
+                    if (etag === null || etag === "") {
+                        throw new Error(`part ${part.partNumber}: S3 returned no ETag`);
+                    }
+                    return etag;
+                }
+                catch (error) {
+                    lastError = error;
+                }
+            }
+            throw lastError;
+        }
+        finally {
+            yield handle.close();
+        }
+    });
+}
+function uploadParts(fetchImpl, path, sizeBytes, upload, onPart) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const queue = [...upload.parts];
+        const results = [];
+        let done = 0;
+        const worker = () => __awaiter(this, void 0, void 0, function* () {
+            for (;;) {
+                const part = queue.shift();
+                if (part === undefined) {
+                    return;
+                }
+                const start = (part.partNumber - 1) * upload.partSizeBytes;
+                const end = Math.min(start + upload.partSizeBytes, sizeBytes);
+                const etag = yield uploadPart(fetchImpl, path, part, { start, end });
+                results.push({ partNumber: part.partNumber, etag });
+                done++;
+                onPart(done, upload.parts.length);
+            }
+        });
+        yield Promise.all(Array.from({ length: Math.min(UPLOAD_CONCURRENCY, queue.length) }, worker));
+        return results.sort((a, b) => a.partNumber - b.partNumber);
+    });
+}
+export function cmdImagesPush(args, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const err = (_a = options.err) !== null && _a !== void 0 ? _a : ((text) => void process.stderr.write(text));
+        if (args.image === undefined || args.image === "") {
+            err(`Usage: ${CLI} images push <local-image> --name <name> [--team <id>]\n`);
+            return 1;
+        }
+        if (args.name === undefined || args.name === "") {
+            err(`--name is required: ${CLI} images push ${args.image} --name <name>\n`);
+            return 1;
+        }
+        const nameError = validateContainerImageName(args.name);
+        if (nameError !== undefined) {
+            err(`${nameError}\n`);
+            return 1;
+        }
+        const out = (_b = options.out) !== null && _b !== void 0 ? _b : ((text) => void process.stdout.write(text));
+        const docker = (_c = options.docker) !== null && _c !== void 0 ? _c : shellDocker();
+        const inspected = yield docker.inspect(args.image);
+        if (inspected === undefined) {
+            err(`No local image named ${args.image}. Build or pull it first (\`docker image ls\` shows what is available).\n`);
+            return 1;
+        }
+        // Everything the hosted install needs is knowable locally; decide it
+        // before signing in or moving any bytes. The platform check gates the
+        // probe: a wrong-arch container cannot run here to be probed.
+        const checks = checkImage(inspected, inspected.platform === REQUIRED_PLATFORM ? yield docker.probe(args.image) : undefined).filter(check => inspected.platform === REQUIRED_PLATFORM || check.label === "platform");
+        if (options.json !== true) {
+            out(renderChecks(args.image, checks));
+        }
+        const failed = checks.filter(check => check.status === "failed");
+        if (failed.length > 0) {
+            err(`${args.image} cannot run as a hosted agent image:\n${failed
+                .map(check => { var _a; return `  ${check.label}: ${check.value}. ${(_a = check.detail) !== null && _a !== void 0 ? _a : ""}`; })
+                .join("\n")}\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        const fetchImpl = (_d = options.fetchImpl) !== null && _d !== void 0 ? _d : fetch;
+        // `docker save` of a real image takes minutes; learn about a full team
+        // before paying for it. The backend re-checks at begin.
+        let listed;
+        try {
+            listed = yield ctx.client.listContainerImages({ teamId: ctx.teamId });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (listed.images.length >= listed.limit &&
+            !listed.images.some(image => image.name === args.name)) {
+            ctx.err(`${listed.images.length} of ${listed.limit} images used; delete some at ${IMAGES_DASHBOARD_URL} or with \`${CLI} images rm <name>\`.\n`);
+            return 1;
+        }
+        const dir = yield mkdtemp(join(tmpdir(), "agent-sdk-image-"));
+        const tarball = join(dir, "image.tar.gz");
+        try {
+            if (!ctx.json) {
+                ctx.out(`Saving ${args.image} (${formatBytes(inspected.sizeBytes)} uncompressed)…\n`);
+            }
+            const saved = yield saveCompressed(docker, args.image, tarball);
+            if (saved.sizeBytes > MAX_CONTAINER_IMAGE_BYTES) {
+                err(`Compressed image is ${formatBytes(saved.sizeBytes)}; the limit is ${formatBytes(MAX_CONTAINER_IMAGE_BYTES)}.\n`);
+                return 1;
+            }
+            const upload = yield ctx.client.beginContainerImageUpload({
+                teamId: ctx.teamId,
+                name: args.name,
+                sizeBytes: saved.sizeBytes,
+                sha256: saved.sha256,
+                dockerImageId: inspected.id,
+                platform: inspected.platform,
+            });
+            if (!ctx.json) {
+                ctx.out(`Uploading ${formatBytes(saved.sizeBytes)} in ${upload.parts.length} part${upload.parts.length === 1 ? "" : "s"}…\n`);
+            }
+            const parts = yield uploadParts(fetchImpl, tarball, saved.sizeBytes, upload, (done, total) => {
+                if (!ctx.json && total > 1) {
+                    ctx.out(`  ${done}/${total}\n`);
+                }
+            });
+            const image = yield ctx.client.finalizeContainerImage({
+                teamId: ctx.teamId,
+                name: args.name,
+                uploadId: upload.uploadId,
+                parts,
+            });
+            if (ctx.json) {
+                ctx.out(`${JSON.stringify({ image }, null, 2)}\n`);
+            }
+            else {
+                ctx.out(`Pushed ${image.name} (${formatBytes(image.sizeBytes)}, sha256 ${saved.sha256.slice(0, 12)}).\n` +
+                    `Use it from a persistent agent: defineAgent({ persistent: true, hosting: { image: "${image.name}" } }).\n`);
+            }
+            return 0;
+        }
+        catch (error) {
+            if (error instanceof DeployApiError) {
+                return renderApiError(error, ctx.err);
+            }
+            ctx.err(`Push failed: ${error instanceof Error ? error.message : String(error)}\nRun the same command again to retry.\n`);
+            return 1;
+        }
+        finally {
+            yield rm(dir, { recursive: true, force: true });
+        }
+    });
+}
+export function cmdImagesList(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        let listed;
+        try {
+            listed = yield ctx.client.listContainerImages({ teamId: ctx.teamId });
+        }
+        catch (error) {
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify(listed, null, 2)}\n`);
+            return 0;
+        }
+        if (listed.images.length === 0) {
+            ctx.out(`No images pushed yet. Push one with \`${CLI} images push <local-image> --name <name>\`.\n`);
+            return 0;
+        }
+        ctx.out(`${renderTable(["NAME", "SIZE", "PLATFORM", "SHA256", "PUSHED"], listed.images.map(image => { var _a; var _b, _c; return [
+            image.name,
+            formatBytes(image.sizeBytes),
+            (_b = image.platform) !== null && _b !== void 0 ? _b : "",
+            (_c = (_a = image.sha256) === null || _a === void 0 ? void 0 : _a.slice(0, 12)) !== null && _c !== void 0 ? _c : "",
+            image.pushedAt,
+        ]; }))}\n${listed.images.length} of ${listed.limit} images.\n`);
+        return 0;
+    });
+}
+export function cmdImagesRm(name, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        if (name === undefined || name === "") {
+            ((_a = options.err) !== null && _a !== void 0 ? _a : ((t) => void process.stderr.write(t)))(`Usage: ${CLI} images rm <name> [--team <id>]\n`);
+            return 1;
+        }
+        const ctx = yield prepare(options);
+        if (typeof ctx === "number") {
+            return ctx;
+        }
+        try {
+            yield ctx.client.deleteContainerImage({ teamId: ctx.teamId, name });
+        }
+        catch (error) {
+            if (error instanceof DeployApiError && error.status === 404) {
+                ctx.err(`No image named ${name} — check \`${CLI} images list\`.\n`);
+                return 1;
+            }
+            return renderApiError(error, ctx.err);
+        }
+        if (ctx.json) {
+            ctx.out(`${JSON.stringify({ removed: name }, null, 2)}\n`);
+        }
+        else {
+            ctx.out(`Removed image ${name}.\n`);
+        }
+        return 0;
+    });
+}
+/** Test seam: a `DockerImageSource` over in-memory bytes. */
+export function memoryDockerImageSource(images) {
+    return {
+        inspect(image) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const found = images[image];
+                return found === undefined
+                    ? undefined
+                    : {
+                        id: found.id,
+                        platform: found.platform,
+                        sizeBytes: found.tar.length,
+                    };
+            });
+        },
+        probe(image) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                return (_a = images[image]) === null || _a === void 0 ? void 0 : _a.probe;
+            });
+        },
+        save(image) {
+            const found = images[image];
+            return Readable.from(found === undefined ? [] : [found.tar]);
+        },
+    };
+}

package/dist/internal/cli-manifest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `july manifest` — print the offline deploy manifest (Wd-1 of
+ * `docs/agent-serve/agent-sdk-event-ingress-plan.md`).
+ *
+ * Loads the agent project from disk and emits the statically-derived
+ * metadata the control plane stores at deploy time: declared GitHub webhook
+ * events, egress domains, public routes, and the full `/v1/info` payload.
+ * Runs entirely offline — no VM, no engine, no network.
+ */
+export interface CmdManifestOptions {
+    dir: string;
+    /** Compact single-line JSON (machine consumption); default pretty. */
+    json?: boolean;
+    /** Test seams. */
+    out?: (line: string) => void;
+    err?: (line: string) => void;
+}
+export declare function cmdManifest(options: CmdManifestOptions): Promise<number>;
+//# sourceMappingURL=cli-manifest.d.ts.map

package/dist/internal/cli-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-manifest.d.ts","sourceRoot":"","sources":["../../src/internal/cli-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kBAAkB;IAClB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC9E"}

package/dist/internal/cli-manifest.js

@@ -0,0 +1,49 @@
+/**
+ * `july manifest` — print the offline deploy manifest (Wd-1 of
+ * `docs/agent-serve/agent-sdk-event-ingress-plan.md`).
+ *
+ * Loads the agent project from disk and emits the statically-derived
+ * metadata the control plane stores at deploy time: declared GitHub webhook
+ * events, egress domains, public routes, and the full `/v1/info` payload.
+ * Runs entirely offline — no VM, no engine, no network.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { buildAgentDeployManifest, parseAgentDeployManifest } from "./deploy-manifest.js";
+import { isAgentProjectDir, loadAgentProject } from "./discovery.js";
+export function cmdManifest(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const out = (_a = options.out) !== null && _a !== void 0 ? _a : ((line) => process.stdout.write(line));
+        const err = (_b = options.err) !== null && _b !== void 0 ? _b : ((line) => process.stderr.write(line));
+        if (!(yield isAgentProjectDir(options.dir))) {
+            err(`No agent project found at ${options.dir} (expected an agent.ts default-exporting defineAgent({ ... })).\n`);
+            return 1;
+        }
+        const project = yield loadAgentProject(options.dir);
+        for (const diagnostic of project.diagnostics) {
+            err(`${diagnostic.severity}: ${diagnostic.message}\n`);
+        }
+        if (project.diagnostics.some(d => d.severity === "error")) {
+            return 1;
+        }
+        const manifest = buildAgentDeployManifest(project);
+        // Round-trip through the wire schema so `july manifest` can never emit
+        // something the control plane contract would reject.
+        if (parseAgentDeployManifest(JSON.parse(JSON.stringify(manifest))) === undefined) {
+            err("internal error: generated manifest failed schema validation\n");
+            return 1;
+        }
+        out(options.json === true
+            ? `${JSON.stringify(manifest)}\n`
+            : `${JSON.stringify(manifest, null, 2)}\n`);
+        return 0;
+    });
+}