@domino-sdk/relay-cli 0.1.0

package/cli/git.mjs

@@ -0,0 +1,165 @@
+import { spawn } from "node:child_process";
+import { access, mkdir, rm, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { apiUrl, request, savedToken } from "./connection.mjs";
+
+export function runGit(args, { cwd, input, env = {} } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("git", args, {
+      cwd,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", ...env },
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    let stdout = "",
+      stderr = "";
+    child.stdout.on("data", (data) => {
+      stdout += data;
+    });
+    child.stderr.on("data", (data) => {
+      stderr += data;
+    });
+    child.on("error", reject);
+    child.on("close", (code) =>
+      code === 0
+        ? resolve(stdout.trim())
+        : reject(new Error(`Git failed (${code}): ${stderr.trim()}`)),
+    );
+    child.stdin.end(input);
+  });
+}
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const helper = () =>
+  `!${quote(process.execPath)} ${quote(fileURLToPath(new URL("../cli.mjs", import.meta.url)))} credential-helper`;
+
+export async function credentialHelper(operation, input, cwd = process.cwd()) {
+  if (operation !== "get") return "";
+  const values = Object.fromEntries(
+    input
+      .trim()
+      .split("\n")
+      .map((line) => {
+        const at = line.indexOf("=");
+        return [line.slice(0, at), line.slice(at + 1)];
+      }),
+  );
+  const remote = new URL(
+    await runGit(["config", "--get", "domino.remote"], { cwd }),
+  );
+  if (
+    values.protocol !== remote.protocol.slice(0, -1) ||
+    values.host !== remote.host ||
+    values.path !== remote.pathname.slice(1)
+  )
+    return "";
+  const base = apiUrl(
+    await runGit(["config", "--get", "domino.apiUrl"], { cwd }),
+  );
+  const token = process.env.RELAY_MANAGEMENT_TOKEN ?? (await savedToken(base));
+  if (!token) throw new Error("Sign in using domino login.");
+  // Verify revocation before supplying the credential to Git. Never print it through normal CLI output.
+  await request(
+    {
+      apiUrl: base,
+      token,
+      organization: await runGit(["config", "--get", "domino.organization"], {
+        cwd,
+      }),
+      project: await runGit(["config", "--get", "domino.project"], { cwd }),
+      environment: "test",
+    },
+    "/access",
+  );
+  return `username=domino\npassword=${token}\n\n`;
+}
+
+export async function requireNewDirectory(directory) {
+  try {
+    await access(directory);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+  throw new Error(`Directory already exists: ${directory}`);
+}
+
+export async function checkout(connection, repository, directory) {
+  if (repository.status !== "ready")
+    throw new Error(
+      "Repository provisioning is incomplete. Retry domino create.",
+    );
+  const remote = new URL(repository.remote);
+  if (
+    remote.protocol !== "https:" ||
+    remote.username ||
+    remote.password ||
+    remote.search ||
+    remote.hash
+  )
+    throw new Error("Repository remote must use HTTPS without credentials.");
+  const root = resolve(directory);
+  await requireNewDirectory(root);
+  await mkdir(dirname(root), { recursive: true });
+  await mkdir(root);
+  try {
+    await runGit(["init", "--initial-branch", repository.defaultBranch, "."], {
+      cwd: root,
+    });
+    for (const [name, value] of Object.entries({
+      apiUrl: connection.apiUrl,
+      organization: repository.organization,
+      project: repository.project,
+      remote: repository.remote,
+    }))
+      await runGit(["config", "--local", `domino.${name}`, value], {
+        cwd: root,
+      });
+    await runGit(["config", "--local", "credential.useHttpPath", "true"], {
+      cwd: root,
+    });
+    await runGit(
+      ["config", "--local", `credential.${repository.remote}.helper`, ""],
+      { cwd: root },
+    );
+    await runGit(
+      [
+        "config",
+        "--local",
+        "--add",
+        `credential.${repository.remote}.helper`,
+        helper(),
+      ],
+      { cwd: root },
+    );
+    await runGit(["remote", "add", "origin", repository.remote], { cwd: root });
+    await runGit(["fetch", "origin"], { cwd: root });
+    await runGit(
+      [
+        "checkout",
+        "-B",
+        repository.defaultBranch,
+        `origin/${repository.defaultBranch}`,
+      ],
+      { cwd: root },
+    );
+    // Local connection scope never dirties the tracked campaign definition.
+    await writeFile(
+      resolve(root, ".git/domino.json"),
+      JSON.stringify({
+        apiUrl: connection.apiUrl,
+        organization: repository.organization,
+        project: repository.project,
+        environment: "test",
+      }) + "\n",
+    );
+    return {
+      directory: root,
+      remote: repository.remote,
+      next: "Install dependencies with pnpm install, then run domino dev.",
+    };
+  } catch (error) {
+    // This directory was created exclusively by this operation and has no user edits.
+    await rm(root, { recursive: true, force: true });
+    throw error;
+  }
+}

package/cli/project.mjs

@@ -0,0 +1,206 @@
+import { readFile, writeFile, mkdir, access } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { z } from "zod";
+import { buildQuest } from "@domino-sdk/relay/build";
+import { runGit } from "./git.mjs";
+
+export const projectSchema = z
+  .object({
+    $schema: z.string().optional(),
+    apiUrl: z.string().url(),
+    organization: z.string().min(1),
+    project: z.string().min(1),
+    environment: z.enum(["test", "live"]).default("test"),
+    app: z
+      .object({
+        kind: z.literal("static"),
+        directory: z.string().min(1),
+        devScript: z.string().min(1),
+        checkScript: z.string().min(1),
+        buildScript: z.string().min(1),
+      })
+      .strict()
+      .optional(),
+    questTypes: z
+      .array(
+        z
+          .object({
+            entry: z.string().min(1),
+            exportName: z.string().optional(),
+            provider: z
+              .enum([
+                "workers-ai",
+                "fixture-pass",
+                "fixture-fail",
+                "fixture-unclear",
+                "fixture-error",
+              ])
+              .default("workers-ai"),
+          })
+          .strict(),
+      )
+      .default([]),
+    collections: z
+      .array(
+        z
+          .object({
+            id: z.string().regex(/^[\w-]+$/),
+            title: z.string().min(1).max(120),
+          })
+          .strict(),
+      )
+      .default([]),
+    supportedInteractions: z
+      .array(z.enum(["photo", "quiz", "claim", "staff", "automatic"]))
+      .min(1)
+      .optional(),
+    quests: z
+      .array(
+        z
+          .object({
+            entry: z.string().min(1),
+            exportName: z.string().optional(),
+            settings: z.record(z.string(), z.unknown()).default({}),
+            settingRenames: z.record(z.string(), z.string()).optional(),
+            provider: z
+              .enum([
+                "fixture-pass",
+                "fixture-fail",
+                "fixture-unclear",
+                "fixture-error",
+                "workers-ai",
+              ])
+              .default("workers-ai"),
+          })
+          .strict(),
+      )
+      .max(50)
+      .default([]),
+  })
+  .strict();
+
+export async function readJson(path) {
+  return JSON.parse(await readFile(path, "utf8"));
+}
+
+async function loadProject(path) {
+  const config = projectSchema.parse(await readJson(path));
+  const dir = dirname(path);
+  // Worktrees keep shared connection metadata in the common Git directory.
+  const gitDir = await runGit(["rev-parse", "--git-common-dir"], {
+    cwd: dir,
+  }).catch(() => null);
+  if (gitDir) {
+    try {
+      const local = z
+        .object({
+          apiUrl: z.string().url(),
+          organization: z.string(),
+          project: z.string(),
+          environment: z.enum(["test", "live"]),
+        })
+        .strict()
+        .parse(await readJson(resolve(dir, gitDir, "domino.json")));
+      Object.assign(config, local);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  return { path, config };
+}
+
+export async function findProject(path) {
+  if (path) return loadProject(resolve(path));
+  let dir = process.cwd();
+  while (true) {
+    const path = join(dir, "relay.json");
+    try {
+      return await loadProject(path);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    if (dirname(dir) === dir) return null;
+    dir = dirname(dir);
+  }
+}
+
+export async function bundleProject(project) {
+  const releases = [];
+  for (const quest of project.config.quests) {
+    const artifact = await buildQuest(
+      resolve(dirname(project.path), quest.entry),
+      { exportName: quest.exportName },
+    );
+    releases.push({
+      ...artifact,
+      settings: quest.settings,
+      ...(quest.settingRenames ? { settingRenames: quest.settingRenames } : {}),
+      provider: quest.provider,
+    });
+  }
+  const catalog = await bundleCatalog(project);
+  if (
+    !releases.length &&
+    !catalog.types.length &&
+    !catalog.collections.length &&
+    !catalog.supportedInteractions
+  )
+    throw new Error(
+      "No resources configured. Add quests, questTypes, collections, or supportedInteractions to relay.json.",
+    );
+  return { releases, ...catalog };
+}
+
+export async function initialize(directory, config) {
+  const root = resolve(directory);
+  const files = {
+    "relay.json": JSON.stringify(projectSchema.parse(config), null, 2) + "\n",
+    "RELAY.md": `# Relay project
+
+Use Codex or Claude to author your quests with @domino-sdk/relay/authoring. Project scope and quest entries are in relay.json. Relay imposes no framework, source directory, package manager, or application build configuration. Keep your existing project setup. Add @domino-sdk/relay with your package manager, or link the local SDK while it is unpublished. The CLI is supplied by @domino-sdk/relay-cli, separately from the runtime SDK. Commit relay.json and RELAY.md; credentials live in your user config directory.
+
+Run domino build or domino deploy --dry-run to bundle the complete manifest locally. Run domino deploy --preview to inspect effective remote settings without publishing, and domino deploy to atomically publish quests, questTypes, collections, and supportedInteractions to test. For live, export domino deploy --dry-run --out deployment.json and review the project bundle in Console. Run domino quests or domino releases to inspect the server. Live publication requires Console.
+
+Author quests with @domino-sdk/relay/authoring. Each entry points to any authored module relative to relay.json and default-exports defineQuest, or specifies exportName. No dedicated quests directory is required. Example entry: {"entry":"src/community/welcome.ts","settings":{},"provider":"fixture-pass"}. Fixture providers simulate verification; use workers-ai only on an API with the AI binding configured. Settings are deployment defaults validated by the server at publication. Console custom values persist in Relay and take precedence on every deployment; no source edits are needed to retain them. Deploy output reports defaults, custom values, and effective values. Use Console to reset a setting to its deployment default. Removing or invalidating a custom setting blocks the whole batch. For a rename, add settingRenames: {"oldName":"newName"} to the quest entry to carry custom values forward. A dry run builds locally and does not preview remote custom values. Multiple quests deploy as one batch so prerequisites can refer to other quests in the batch.
+
+References: @domino-sdk/relay/authoring provides declarations; @domino-sdk/relay/build bundles without executing author code on the host; domino --help lists commands. Set RELAY_MANAGEMENT_TOKEN for CI. Use --json for machine-readable output. Never put tokens in relay.json or source files.
+`,
+  };
+  // Preflight every generated path before writing anything. Existing projects are never overwritten.
+  for (const name of Object.keys(files)) {
+    try {
+      await access(join(root, name));
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    throw new Error(`Refusing to overwrite ${join(root, name)}`);
+  }
+  for (const [name, content] of Object.entries(files)) {
+    await mkdir(dirname(join(root, name)), { recursive: true });
+    await writeFile(join(root, name), content, { flag: "wx" });
+  }
+  return {
+    directory: root,
+    files: Object.keys(files),
+    next: "Add @domino-sdk/relay to your existing package with your package manager, then configure quest entries in relay.json and run domino build.",
+  };
+}
+
+export async function bundleCatalog(project) {
+  const types = [];
+  for (const type of project.config.questTypes) {
+    const artifact = await buildQuest(
+      resolve(dirname(project.path), type.entry),
+      { exportName: type.exportName },
+    );
+    types.push({ ...artifact, provider: type.provider });
+  }
+  return {
+    types,
+    collections: project.config.collections,
+    ...(project.config.supportedInteractions
+      ? { supportedInteractions: project.config.supportedInteractions }
+      : {}),
+  };
+}

package/cli/runtime.mjs

@@ -0,0 +1,39 @@
+import { findProject } from "./project.mjs";
+import { apiUrl } from "./connection.mjs";
+
+// Share scope resolution and output across commands; build and HTTP modules stay independent.
+export function action(handler) {
+  return async (...args) => {
+    const command = args.at(-1);
+    const options = command.optsWithGlobals();
+    const project = await findProject(options.config);
+    const connection = {};
+    for (const key of ["apiUrl", "organization", "project", "environment"]) {
+      const env =
+        key === "apiUrl" ? "RELAY_API_URL" : `RELAY_${key.toUpperCase()}`;
+      connection[key] =
+        options[key] ?? process.env[env] ?? project?.config[key];
+    }
+    connection.apiUrl = apiUrl(connection.apiUrl ?? "https://relay.domino.run");
+    if (
+      connection.environment !== undefined &&
+      !["test", "live"].includes(connection.environment)
+    )
+      throw new Error("Environment must be test or live.");
+    const result = await handler(
+      { options, project, connection },
+      ...command.processedArgs,
+    );
+    console.log(JSON.stringify(result, null, options.json ? undefined : 2));
+  };
+}
+
+export async function readStdin() {
+  if (process.stdin.isTTY)
+    throw new Error(
+      "Pipe input to stdin; interactive prompts are not supported.",
+    );
+  let input = "";
+  for await (const chunk of process.stdin) input += chunk;
+  return input;
+}

package/cli/skills/domino/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: domino
+description: Set up a Domino project, integrate Domino into an existing app, author quests, or verify and stage a participant experience with the Domino CLI and SDK.
+---
+
+# Build with Domino
+
+Deliver the requested participant experience and evidence that its main action works. Domino owns verification, completion, points, and reward execution. The app owns its presentation and integration with participant identity.
+
+## Establish the project
+
+Read the project's agent instructions and owner brief, such as CAMPAIGN.md, when present. Inspect package scripts and relay.json before selecting commands. Use the installed CLI through the project's package manager, such as `pnpm exec domino`; the examples below abbreviate this to `domino`.
+
+Run `domino doctor --json` to inspect setup without running application code or contacting the service. Missing setup produces exit 1 with diagnostic JSON on stdout. Invalid configuration uses the CLI's standard error JSON on stderr. Fix the reported prerequisite, then rerun the check.
+
+Use `domino login` for browser authorization when remote work is needed. The user approves the displayed code in Console. Credentials stay in the CLI credential store. Run `domino doctor --remote --json` to verify access and inspect the effective organization, project, API, and environment before remote operations. Flags and RELAY_* environment variables override relay.json.
+
+Choose the reference that matches the task:
+
+- For a new Domino-hosted app, checkout, or hosted preview, read [hosted projects](references/hosted.md).
+- For integration into an existing codebase, read [existing apps](references/existing-app.md).
+- For quest definitions, reusable types, collections, or publication, read [authoring](references/authoring.md).
+
+If no CLI is installed, use the project's documented package installation path. The current SDK and CLI are private packages distributed with standalone starter archives. Do not invent a public npm install command. Report the missing distribution if no package source is available.
+
+## Verify the result
+
+Run the app's checks and exercise the requested participant action through the running app. Verify the resulting progress or completion state. Keep fixture-provider results distinct from real external verification.
+
+Return the working preview or local URL, what participant action you verified, and any remaining launch dependency. A successful build, installed skill, or healthy doctor result is not proof of participant behavior. Live publication requires human review in Console; hosted staging is a simulation.

package/cli/skills/domino/references/authoring.md

@@ -0,0 +1,15 @@
+# Authoring and publication
+
+Read the installed `@domino-sdk/relay/authoring` declarations and the project's existing quest modules. Define the requested behavior with the supported SDK helpers rather than inventing capabilities. Authored entries in relay.json resolve relative to that manifest and can select a named export with `exportName`.
+
+Source owns reusable quest definitions, collection slots, and deployment defaults. Console owns operator-created quest instances, their placement, and custom setting values. Keep identifiers stable. Registering a new reusable type version does not upgrade existing instances.
+
+Entry `settings` supplies deployment defaults. Remote custom values take precedence on subsequent deployments. A removed or incompatible setting can block the batch. Use `settingRenames` for a deliberate rename, or have the operator reset a custom value in Console. Changing source defaults does not clear overrides.
+
+Use `domino build --json` or `domino deploy --dry-run --json` for offline bundling. These do not validate effective remote settings. Use `domino deploy --preview --json` to resolve and validate the remote batch without publishing. Check the selected scope before publication.
+
+Use `domino deploy --environment test --json` when test publication is part of the task. It publishes configured quests, types, collections, and supported interactions together. After a lost publication response, use the returned `domino deploy --resume <id>` recovery command. Starting another deployment may create another immutable release.
+
+For human live review, export `domino deploy --dry-run --out deployment.json` and present that bundle for Console approval. This publishes community behavior, not the participant application. Existing attempts retain their pinned releases and promised rewards.
+
+Fixture providers simulate verification. `workers-ai` requires a configured service binding. A fixture success demonstrates the flow but does not establish that a real external activity was verified.

package/cli/skills/domino/references/existing-app.md

@@ -0,0 +1,19 @@
+# Existing apps
+
+Inspect the app's framework, package manager, workspace boundaries, authentication, and deployment scripts. Identify where the requested participant experience belongs. Keep its repository, UI conventions, login, and hosting.
+
+Use the Domino project selected by the user. If no remote project exists, create it in Console. `domino create` provisions a hosted repository and is not the existing-app integration path.
+
+From the intended package or project root, run `domino init --project <id>` to create relay.json and RELAY.md. Init verifies access and does not install packages or generate sample quests. If these files already exist, inspect the existing connection and continue from it. Init deliberately refuses to overwrite them.
+
+Run `domino agents install` to install this guidance for both Codex and Claude, or select one with `--agent codex` or `--agent claude`. The installer leaves existing AGENTS.md and CLAUDE.md files intact. It can resume missing files, but stops before replacing customized Domino guidance.
+
+Add the SDK to the package that owns the authored modules using the app's package manager and an available Domino package distribution. Resolve SDK imports there before adding quest entries to relay.json. Quest files can follow the existing source layout.
+
+For participant UI, inspect the installed `@domino-sdk/relay` and `@domino-sdk/relay/browser` exports. Use the supplied quest controllers for submissions, recovery, and changed rules. Keep stable quest IDs and collection slots. Participants explicitly review changed rules before resubmitting.
+
+Keep the application's existing login. Map its authenticated user through a supported trusted backend identity integration. Determine the server credential and allowed project scope before implementing that exchange. Browser-provided user IDs are not verified identities. Management tokens belong only on trusted servers or in CLI credentials, never browser bundles.
+
+For same-origin participant routing, inspect `@domino-sdk/relay/portal-proxy` and the app's server route conventions. Its proxy allowlist excludes management routes. Verify session transport, sign-in callbacks where relevant, and a participant action through that boundary. If production identity provisioning is unavailable, report that dependency explicitly and keep the demonstration scoped to test.
+
+Read [authoring](authoring.md) when adding quests or collection slots. Run the app's normal checks and development server. Use its existing preview deployment process when available. `domino deploy` publishes Domino behavior; it does not deploy the app. `domino stage` requires a supported Domino-hosted static repository, so it is not a general deployment command for existing apps.

package/cli/skills/domino/references/hosted.md

@@ -0,0 +1,17 @@
+# Hosted projects
+
+If Console already created the project and repository, run `domino checkout <project>`. Use `domino create <name>` only when the requested hosted project does not exist. Both require authentication. Use `domino whoami --json` to inspect accessible projects when the target is unclear.
+
+For a failure after remote project creation, inspect the existing project's state before repeating creation. Keep partially created local directories intact while recovering. Checkout accepts `--directory` for a fresh destination.
+
+Install dependencies from the lockfile. The starter includes pinned SDK, CLI, and local-runtime archives in `.domino`; upgrade them through a platform package release rather than modifying their contents. Read CAMPAIGN.md for the owner's brief.
+
+Run `domino dev` for the isolated local runtime and participant app. Local preview identities and fixture providers simulate participation. Keep demonstration content separate from the owner's live catalog.
+
+Use `domino check` and the app's build script to verify source. Exercise the requested participant flow in the running app before staging.
+
+When the task includes sharing a preview, commit the intended changes and push using the repository's configured remote. Run `domino stage --json` after the push. The command builds the exact pushed commit and returns its staging URL. Git pushes alone save source; they do not activate a preview or publish live.
+
+If stage submission loses its response, repeat the printed commit and request ID. Use `domino builds --json` and `domino logs <build-id> --json` to recover progress after disconnecting. A failed build leaves the previous preview active. Report the URL returned for the successful build rather than constructing one.
+
+Cloud staging supports the starter's static app contract. It does not host arbitrary SSR or customer Worker code. Staging uses separate simulated participant data and does not prove live provider readiness. Hosted app live activation remains a separate platform milestone.

package/cli.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+import { Command, Option, CommanderError } from "commander";
+import { readFile } from "node:fs/promises";
+import { getCACertificates, setDefaultCACertificates } from "node:tls";
+
+// Honor OS-trusted authorities, including managed enterprise and development CAs.
+setDefaultCACertificates([
+  ...getCACertificates("default"),
+  ...getCACertificates("system"),
+]);
+import { registerAuthCommands } from "./cli/commands/auth.mjs";
+import { registerProjectCommands } from "./cli/commands/project.mjs";
+import { registerInspectCommands } from "./cli/commands/inspect.mjs";
+import { registerApiCommand } from "./cli/commands/api.mjs";
+import { registerStagingCommands } from "./cli/commands/staging.mjs";
+import { registerHostingCommands } from "./cli/commands/hosting.mjs";
+import { registerAgentCommands } from "./cli/commands/agents.mjs";
+import { credentialHelper } from "./cli/git.mjs";
+
+const { version } = JSON.parse(
+  await readFile(new URL("./package.json", import.meta.url), "utf8"),
+);
+const argv = process.argv.slice(2);
+if (argv[0] === "credential-helper") {
+  try {
+    let input = "";
+    for await (const chunk of process.stdin) input += chunk;
+    process.stdout.write(await credentialHelper(argv[1], input));
+    process.exit(0);
+  } catch {
+    process.stderr.write("Domino Git authentication failed. Run domino login.\n");
+    process.exit(1);
+  }
+}
+// Preserve the original HTTP wrapper spelling for existing automation.
+if (["GET", "POST", "PUT", "DELETE", "PATCH"].includes(argv[0]))
+  argv.unshift("api");
+// Also covers parse errors before Commander has reached the --json option.
+const json = argv
+  .slice(0, argv.includes("--") ? argv.indexOf("--") : undefined)
+  .includes("--json");
+const program = new Command()
+  .name("domino")
+  .description("Author and deploy Relay quests from any existing project")
+  .version(version)
+  .option("--api-url <url>", "API base URL (RELAY_API_URL or relay.json)")
+  .option(
+    "--organization <id>",
+    "Organization scope (RELAY_ORGANIZATION or relay.json)",
+  )
+  .option("--project <id>", "Project scope (RELAY_PROJECT or relay.json)")
+  .addOption(
+    new Option(
+      "--environment <name>",
+      "Environment scope (RELAY_ENVIRONMENT or relay.json)",
+    ).choices(["test", "live"]),
+  )
+  .option(
+    "--config <file>",
+    "Use this manifest instead of the nearest relay.json",
+  )
+  .option("--json", "Emit machine-readable JSON results and errors")
+  .addHelpCommand("help [command]", "Display help for a command")
+  .configureHelp({ showGlobalOptions: true })
+  .configureOutput({
+    writeOut: (text) => {
+      if (json)
+        console.log(
+          JSON.stringify(
+            text.trim() === version ? { version } : { help: text },
+          ),
+        );
+      else process.stdout.write(text);
+    },
+    // The catch below emits one consistent error, including Commander parse errors.
+    writeErr: () => {},
+  })
+  .exitOverride()
+  .addHelpText(
+    "after",
+    `
+Scope: flags > RELAY_* environment variables > nearest relay.json.
+API default: https://relay.domino.run. Init defaults to test.
+Credentials: RELAY_MANAGEMENT_TOKEN > saved token for the API origin.
+Run domino login for browser sign-in. Live publication requires Console.
+Commands never prompt. Results go to stdout; errors go to stderr. Exit 1 on failure.`,
+  )
+  .action(() => program.outputHelp());
+
+registerAuthCommands(program);
+registerProjectCommands(program);
+registerInspectCommands(program);
+registerApiCommand(program);
+registerHostingCommands(program);
+registerStagingCommands(program);
+registerAgentCommands(program);
+
+try {
+  await program.parseAsync(argv, { from: "user" });
+} catch (error) {
+  if (!(error instanceof CommanderError && error.exitCode === 0)) {
+    console.error(
+      json
+        ? JSON.stringify({
+            error: error.message,
+            ...(error.status ? { status: error.status } : {}),
+          })
+        : `Error: ${error.message}`,
+    );
+    process.exitCode = 1;
+  }
+}