@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/cli/main.js

@@ -0,0 +1,1199 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sameWorkspaceRealpath = sameWorkspaceRealpath;
+exports.resolveCurrentFleetCoordinates = resolveCurrentFleetCoordinates;
+exports.resolveRecoveryFleetCoordinates = resolveRecoveryFleetCoordinates;
+exports.runAgentCommandCore = runAgentCommandCore;
+exports.runDevCommandCore = runDevCommandCore;
+exports.runEbkCli = runEbkCli;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const dev_doctor_js_1 = require("../executors/dev-doctor/dev-doctor.js");
+const git_inspection_js_1 = require("../developer-agent/git-inspection.js");
+const dev_setup_js_1 = require("../executors/dev-setup/dev-setup.js");
+const contract_validation_js_1 = require("../local-dev/contract-validation.js");
+const control_contract_js_1 = require("../local-dev/control-contract.js");
+const context_discovery_js_1 = require("../local-dev/context-discovery.js");
+const dev_command_core_js_1 = require("../local-dev/dev-command-core.js");
+const environment_inspector_js_1 = require("../local-dev/environment-inspector.js");
+const errors_js_1 = require("../local-dev/errors.js");
+const fleet_client_js_1 = require("../local-dev/fleet-client.js");
+const fleet_inventory_js_1 = require("../local-dev/fleet-inventory.js");
+const fleet_launcher_js_1 = require("../local-dev/fleet-launcher.js");
+const fleet_logs_js_1 = require("../local-dev/fleet-logs.js");
+const identity_js_1 = require("../local-dev/identity.js");
+const local_context_js_1 = require("../local-dev/local-context.js");
+const personal_secret_ledger_js_1 = require("../local-dev/personal-secret-ledger.js");
+const nx_workspace_js_1 = require("../local-dev/nx-workspace.js");
+const personal_stage_js_1 = require("../local-dev/personal-stage.js");
+const runtime_paths_js_1 = require("../local-dev/runtime-paths.js");
+const secret_slice_claim_js_1 = require("../local-dev/secret-slice-claim.js");
+const tls_js_1 = require("../local-dev/tls.js");
+const personal_command_js_1 = require("../secrets/personal-command.js");
+const dev_command_js_1 = require("./dev-command.js");
+const agent_runtime_js_1 = require("./agent-runtime.js");
+const output_js_1 = require("./output.js");
+const personal_secret_runtime_js_1 = require("./personal-secret-runtime.js");
+const secret_terminal_js_1 = require("./secret-terminal.js");
+const ROOT_HELP = `Empire Builder Kit
+
+Usage:
+  ebk agent <command> [options]
+  ebk blueprint verification-review
+  ebk dev <command> [options]
+  ebk secret <command> <slice> <logical-name>
+
+Run "ebk agent --help", "ebk blueprint --help", "ebk dev --help", or
+"ebk secret --help" for namespace help.`;
+const AGENT_HELP = `Empire Builder Kit Developer-Agent contract
+
+Usage:
+  ebk agent context [selection options] [--json]
+  ebk agent plan <request.json> [selection options] [--json]
+  ebk agent upgrade-preview <request.json> .ebk/agent/previews/<name>.json [selection options] [--json]
+  ebk agent handoff <handoff.json> [--json]
+  ebk agent resume <handoff.json> [--json]
+
+These commands inspect, plan, validate, and assess resumption of bounded
+repository state. Upgrade preview records an ignored generator report; the
+framework-owned deferred Tree does not apply its intended changes to workspace
+source. Generator previews are local-source because they execute the owning
+generator. An admitted external Blueprint publisher runs in the framework's
+digest-pinned, no-network container without adopter-workspace, Git, credential,
+or Docker-socket mounts. Installed publishers use exact lock and registry
+authority; explicitly mapped local authoring uses protected local-source and
+trust authority. The built-in Standard planner remains trusted in-process
+framework code. Supported mutation remains with the owning Nx generator,
+target, reconciler, source-edit path, package manager, or protected workflow.`;
+const DEV_HELP = `Empire Builder Kit local development
+
+Usage:
+  ebk dev configure --show [--json]
+  ebk dev configure [<context options>] [--clear-development-router-url] [--json]
+  ebk dev setup [--trust] [--portless] [--upgrade] [--remove] [--json]
+  ebk dev up <slice...>|--all [--foreground] [--sst-mode=mono|multiplexer]
+             [--no-wait] [--timeout=<duration>] [<context options>] [--json]
+  ebk dev status [--json]
+  ebk dev restart <slice...>|--all [--no-wait] [--timeout=<duration>] [--json]
+  ebk dev down <slice...>|--all [--no-wait] [--timeout=<duration>] [--json]
+  ebk dev logs [slice...] [--all] [--attempt=<n>] [--contains=<text>]
+               [--correlation-id=<id>] [--level=<level>] [--limit=<n>]
+               [--since=<time>] [--stream=stdout|stderr] [--until=<time>]
+               [--json]
+  ebk dev tail [slice...] [--all] [--level=<level>] [--lines=<n>] [--json]
+  ebk dev doctor [--environment-only] [--refresh] [--json]
+  ebk dev ps [--json]
+  ebk dev prune <fleet-id>|--all-stale [--json]
+
+Context options:
+  --profile=<name> --region=<region> --development-router-url=<https-url>
+  --host-suffix=<suffix> --max-restart-attempts=<n>
+  --safe-method-fallback[=true|false]
+
+Configure mutation requires at least one context option or
+--clear-development-router-url. The clear option may accompany other
+non-router context changes.
+
+Use "ebk dev <command> --help" to return this bounded command reference.
+Fleet stage is always derived from the current operating-system account.`;
+const SECRET_HELP = `Empire Builder Kit personal secrets
+
+Usage:
+  ebk secret set <slice> <logical-name>
+  ebk secret remove <slice> <logical-name>
+
+These human-only commands derive the personal stage and read the saved
+development profile and Region. Secret values are accepted only through a
+hidden local TTY and are never accepted through argv, environment, or files.`;
+function inspectWorkspaceFilesystemIdentity(path) {
+    const status = (0, node_fs_1.statSync)(path, { bigint: true });
+    return {
+        device: status.dev,
+        directory: status.isDirectory(),
+        inode: status.ino,
+    };
+}
+function sameWorkspaceRealpath(left, right, currentPlatform = process.platform, inspectIdentity = inspectWorkspaceFilesystemIdentity) {
+    if (currentPlatform === 'win32') {
+        const windowsIdentity = (value) => node_path_1.win32.toNamespacedPath(node_path_1.win32.normalize(value)).toLowerCase();
+        if (windowsIdentity(left) === windowsIdentity(right))
+            return true;
+        try {
+            const leftIdentity = inspectIdentity(left);
+            const rightIdentity = inspectIdentity(right);
+            return (leftIdentity.directory &&
+                rightIdentity.directory &&
+                leftIdentity.inode !== 0n &&
+                leftIdentity.device === rightIdentity.device &&
+                leftIdentity.inode === rightIdentity.inode);
+        }
+        catch {
+            return false;
+        }
+    }
+    return left === right;
+}
+function packageVersion() {
+    const manifest = require('../../package.json');
+    return typeof manifest.version === 'string' ? manifest.version : '0.0.0';
+}
+function workspaceRoot(cwd) {
+    try {
+        const root = (0, node_child_process_1.execFileSync)('git', [
+            '--no-optional-locks',
+            '-c',
+            'core.fsmonitor=false',
+            'rev-parse',
+            '--path-format=absolute',
+            '--show-toplevel',
+        ], {
+            cwd,
+            encoding: 'utf8',
+            env: (0, git_inspection_js_1.createDeveloperAgentGitEnvironment)(),
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 5_000,
+            windowsHide: true,
+        }).trim();
+        if (!(0, node_path_1.isAbsolute)(root))
+            throw new Error('Git returned a relative path.');
+        return (0, node_fs_1.realpathSync)(root);
+    }
+    catch {
+        throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', 'Run ebk from a Git workspace with a readable repository root.');
+    }
+}
+function defaultDependencies(overrides) {
+    return {
+        acquireSecretLedgerLock: personal_secret_ledger_js_1.acquirePersonalSecretLedgerLock,
+        appData: tls_js_1.defaultLocalDevAppData,
+        assertSecretSliceClaim: secret_slice_claim_js_1.assertSecretSliceClaimAuthority,
+        changeDirectory: (root) => process.chdir(root),
+        client: (paths) => new fleet_client_js_1.FleetClient(paths),
+        discoverContext: context_discovery_js_1.discoverLocalDevContext,
+        executeAgent: agent_runtime_js_1.executeDeveloperAgentCommand,
+        followLogs: fleet_logs_js_1.followFleetLogs,
+        frameworkVersion: packageVersion,
+        gitCommonDirectory: fleet_launcher_js_1.resolveGitCommonDirectory,
+        idempotencyKey: node_crypto_1.randomUUID,
+        inspectEnvironment: environment_inspector_js_1.inspectDevelopmentEnvironment,
+        inspectLocal: dev_doctor_js_1.inspectLocalDevelopment,
+        inventory: fleet_inventory_js_1.inventoryFleets,
+        inventoryClaims: fleet_inventory_js_1.inventorySliceClaims,
+        launchFleet: fleet_launcher_js_1.launchOrAttachFleet,
+        loadPlan: nx_workspace_js_1.loadWorkspaceFleetPlan,
+        listSecretLedgers: personal_secret_ledger_js_1.listPersonalSecretLedgersForStage,
+        loadSecret: personal_secret_runtime_js_1.loadPersonalOperatorSecret,
+        pathExists: node_fs_1.existsSync,
+        personalStageResolver: (0, personal_stage_js_1.createPersonalStageResolver)(),
+        prune: fleet_inventory_js_1.pruneStaleFleets,
+        readContext: local_context_js_1.readSavedLocalDevContext,
+        recordSecretLogicalName: personal_secret_ledger_js_1.recordPersonalSecretLogicalName,
+        releaseSecretLedgerLock: personal_secret_ledger_js_1.releasePersonalSecretLedgerLock,
+        resolveCurrentAccount: personal_secret_runtime_js_1.resolveCurrentAwsAccountId,
+        resolveDevelopmentFoundationAccount: personal_secret_runtime_js_1.resolveDevelopmentFoundationAccountId,
+        resolveWorkspaceRoot: workspaceRoot,
+        runSetup: dev_setup_js_1.applyDevSetup,
+        searchLogs: fleet_logs_js_1.searchFleetLogs,
+        secretCeremony: (environment) => (0, personal_secret_runtime_js_1.createHumanSecretCeremony)(environment, Boolean(process.stdin.isTTY), Boolean(process.stderr.isTTY)),
+        secretConfirmation: (0, secret_terminal_js_1.createTtySecretConfirmation)(),
+        secretHiddenInput: (0, secret_terminal_js_1.createTtyHiddenSecretInputReader)(),
+        secretStore: ({ aws, environment, projectRoot, signal, workspaceRoot }) => (0, personal_secret_runtime_js_1.createWorkspacePinnedSstSecretStore)({
+            aws,
+            environment,
+            projectRoot,
+            runtime: (0, personal_secret_runtime_js_1.resolveWorkspaceSstRuntime)(workspaceRoot),
+            signal,
+        }),
+        secretValidator: personal_secret_runtime_js_1.createPersonalSecretValueValidator,
+        forgetSecretLogicalName: personal_secret_ledger_js_1.forgetPersonalSecretLogicalName,
+        writeContext: local_context_js_1.writeSavedLocalDevContext,
+        ...overrides,
+    };
+}
+function planWorkspaceName(plan) {
+    const names = Object.entries(plan.projects)
+        .filter(([, project]) => project.tags?.includes('scope:workspace'))
+        .map(([name]) => name);
+    if (names.length !== 1) {
+        throw new errors_js_1.LocalDevContractError('invalid-state', `Expected exactly one scope:workspace project; found ${names.length}.`);
+    }
+    return names[0];
+}
+async function resolveCurrentFleetCoordinates(workspaceRoot, appData, dependencies) {
+    const plan = await dependencies.loadPlan();
+    const identity = dependencies.personalStageResolver.resolve();
+    const workspaceName = planWorkspaceName(plan);
+    const fleetId = (0, identity_js_1.createFleetId)({
+        checkoutPath: workspaceRoot,
+        stage: identity.stage,
+        workspaceName,
+    });
+    return {
+        fleetId,
+        identity,
+        paths: (0, runtime_paths_js_1.fleetRuntimePaths)(fleetId, appData),
+        plan,
+        workspaceName,
+    };
+}
+async function resolveRecoveryFleetCoordinates(workspaceRoot, appData, dependencies, currentPlatform = process.platform) {
+    const identity = dependencies.personalStageResolver.resolve();
+    const inventory = await dependencies.inventory({ appData });
+    const matches = inventory.filter(({ checkout, stage }) => checkout !== undefined &&
+        sameWorkspaceRealpath(checkout, workspaceRoot, currentPlatform) &&
+        stage === identity.stage);
+    if (matches.length > 1) {
+        throw new errors_js_1.LocalDevContractError('fleet-ownership-ambiguous', 'More than one private Fleet record matches this checkout and personal stage.');
+    }
+    const match = matches[0];
+    if (match) {
+        return {
+            fleet: match,
+            fleetId: match.fleetId,
+            identity,
+            paths: (0, runtime_paths_js_1.fleetRuntimePaths)(match.fleetId, appData),
+        };
+    }
+    try {
+        const current = await resolveCurrentFleetCoordinates(workspaceRoot, appData, dependencies);
+        return current;
+    }
+    catch {
+        return { identity };
+    }
+}
+function diagnosticContext(discovery) {
+    return (0, local_context_js_1.resolveInitialLocalDevContext)({
+        profile: discovery.profile ?? 'unconfigured',
+        region: discovery.region ?? 'us-east-1',
+    }, {}).context;
+}
+function contextPayload(saved) {
+    if (saved.kind === 'ready') {
+        return {
+            digest: saved.resolution.digest,
+            path: saved.path,
+            state: 'ready',
+            values: saved.resolution.context,
+        };
+    }
+    if (saved.kind === 'invalid') {
+        return {
+            diagnostic: saved.reason,
+            path: saved.path,
+            state: 'invalid',
+        };
+    }
+    return { path: saved.path, state: 'missing' };
+}
+function requireMutableSavedContext(saved) {
+    if (saved.kind === 'invalid') {
+        throw new errors_js_1.LocalDevContractError('local-context-invalid', saved.reason);
+    }
+}
+function success(command, payload, operationId) {
+    return (0, output_js_1.createCliResult)({
+        command,
+        namespace: 'dev',
+        ...(operationId ? { operationId } : {}),
+        outcome: 'succeeded',
+        payload,
+    });
+}
+function secretSuccess(command, payload) {
+    return (0, output_js_1.createCliResult)({
+        command,
+        namespace: 'secret',
+        outcome: 'succeeded',
+        payload,
+    });
+}
+function failure(namespace, command, classification, message, environmentAssessment) {
+    return (0, output_js_1.createCliResult)({
+        command,
+        failureClassification: classification,
+        namespace,
+        outcome: 'failed',
+        payload: {
+            ...(environmentAssessment ? { environmentAssessment } : {}),
+            message,
+        },
+    });
+}
+function failureFromError(namespace, command, error) {
+    if (namespace === 'agent') {
+        const classified = error instanceof errors_js_1.LocalDevContractError &&
+            error.classification === 'invalid-input'
+            ? { classification: 'invalid-input', message: error.message }
+            : (0, agent_runtime_js_1.classifyDeveloperAgentCliError)(error);
+        return failure(namespace, command, classified.classification, classified.message);
+    }
+    const classification = error instanceof errors_js_1.LocalDevContractError
+        ? error.classification
+        : 'internal-error';
+    return failure(namespace, command, classification, error instanceof Error ? error.message : String(error), error instanceof environment_inspector_js_1.EnvironmentDeficientError
+        ? error.environmentAssessment
+        : undefined);
+}
+function writeResult(result, json, io) {
+    if (json) {
+        io.stdout(`${(0, contract_validation_js_1.canonicalJson)(result)}\n`);
+        return;
+    }
+    if (result.outcome !== 'succeeded') {
+        const message = result.payload &&
+            typeof result.payload === 'object' &&
+            'message' in result.payload
+            ? String(result.payload.message)
+            : 'Command failed.';
+        io.stderr(`[${result.failureClassification ?? 'internal-error'}] ${message}\n`);
+        return;
+    }
+    if (result.payload !== undefined) {
+        io.stdout(`${JSON.stringify(result.payload, null, 2)}\n`);
+    }
+}
+function selectorsForQuery(command, plan) {
+    if (!command.selector || command.selector.all)
+        return undefined;
+    return plan
+        ? (0, nx_workspace_js_1.selectWorkspaceSlices)(plan, command.selector)
+        : [...command.selector.slices];
+}
+async function inspectForCommand(command, context, identity, dispatch, options = {}) {
+    return dispatch.dependencies.inspectEnvironment({
+        ...(options.adapters ? { adapters: options.adapters } : {}),
+        appData: dispatch.appData,
+        command,
+        context,
+        force: options.force,
+        frameworkVersion: dispatch.dependencies.frameworkVersion(),
+        identity,
+        workspaceRoot: dispatch.workspaceRoot,
+    });
+}
+function secretCommandFailure(error) {
+    if (error instanceof errors_js_1.LocalDevContractError)
+        throw error;
+    if (error instanceof secret_terminal_js_1.SecretTerminalError) {
+        throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', error.message);
+    }
+    if (error instanceof personal_command_js_1.PersonalSecretCommandError) {
+        const classification = error.code === 'personal-secret-account-invalid'
+            ? 'foundation-unavailable'
+            : error.code === 'personal-secret-human-required' ||
+                error.code === 'personal-secret-hidden-input-failed'
+                ? 'prerequisite-unavailable'
+                : error.code === 'personal-secret-store-failed'
+                    ? 'internal-error'
+                    : 'invalid-input';
+        throw new errors_js_1.LocalDevContractError(classification, error.message);
+    }
+    if (error instanceof personal_secret_runtime_js_1.PersonalSecretRuntimeError) {
+        const classification = error.code === 'personal-secret-foundation-account-invalid'
+            ? 'foundation-unavailable'
+            : error.code === 'personal-secret-declaration-invalid'
+                ? 'invalid-input'
+                : error.code === 'personal-secret-sst-command-failed'
+                    ? 'internal-error'
+                    : 'prerequisite-unavailable';
+        throw new errors_js_1.LocalDevContractError(classification, error.message);
+    }
+    throw new errors_js_1.LocalDevContractError('internal-error', 'Personal secret command failed without exposing a value.');
+}
+async function executeSecretCommand(command, dispatch) {
+    try {
+        const ceremony = dispatch.dependencies.secretCeremony(dispatch.environment);
+        (0, personal_command_js_1.assertHumanSecretCeremony)(ceremony);
+        const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
+        const saved = dispatch.dependencies.readContext(common);
+        if (saved.kind !== 'ready') {
+            throw new errors_js_1.LocalDevContractError(saved.kind === 'invalid'
+                ? 'local-context-invalid'
+                : 'local-context-missing', saved.kind === 'invalid'
+                ? saved.reason
+                : 'Personal secret commands require saved local-development profile and Region context. Run ebk dev configure first.');
+        }
+        const context = saved.resolution.context;
+        const identity = dispatch.dependencies.personalStageResolver.resolve();
+        const environmentAssessment = await dispatch.dependencies.inspectEnvironment({
+            appData: dispatch.appData,
+            command: 'secret',
+            context,
+            frameworkVersion: dispatch.dependencies.frameworkVersion(),
+            identity,
+            workspaceRoot: dispatch.workspaceRoot,
+        });
+        (0, environment_inspector_js_1.assertEnvironmentReady)(environmentAssessment);
+        const plan = await dispatch.dependencies.loadPlan();
+        const project = plan.projects[command.slice];
+        if (!project?.tags?.includes('type:slice')) {
+            throw new errors_js_1.LocalDevContractError('unknown-slice', 'The requested secret command project is not a Product Slice.');
+        }
+        dispatch.dependencies.assertSecretSliceClaim({
+            appData: dispatch.appData,
+            slice: command.slice,
+            stage: identity.stage,
+            workspaceName: planWorkspaceName(plan),
+            workspaceRoot: dispatch.workspaceRoot,
+        });
+        const loaded = await dispatch.dependencies.loadSecret({
+            logicalName: command.logicalName,
+            plan,
+            slice: command.slice,
+            workspaceRoot: dispatch.workspaceRoot,
+        });
+        const aws = Object.freeze({
+            profile: context.profile,
+            region: context.region,
+        });
+        const [accountId, developmentAccountId] = await Promise.all([
+            dispatch.dependencies.resolveCurrentAccount(aws, dispatch.environment),
+            dispatch.dependencies.resolveDevelopmentFoundationAccount(aws),
+        ]);
+        if (!/^\d{12}$/.test(accountId) ||
+            !/^\d{12}$/.test(developmentAccountId) ||
+            accountId !== developmentAccountId) {
+            throw new personal_command_js_1.PersonalSecretCommandError('personal-secret-account-invalid');
+        }
+        const store = dispatch.dependencies.secretStore({
+            aws,
+            environment: dispatch.environment,
+            projectRoot: loaded.projectRoot,
+            signal: dispatch.signal,
+            workspaceRoot: dispatch.workspaceRoot,
+        });
+        const commonInput = {
+            accountId,
+            ceremony,
+            declaration: loaded.declaration,
+            developmentAccountId,
+            mode: 'sst-dev',
+            stage: identity.stage,
+            store,
+        };
+        const ledgerInput = {
+            appData: dispatch.appData,
+            identity: {
+                accountId,
+                region: context.region,
+                slice: command.slice,
+                sstApp: command.slice,
+                stage: identity.stage,
+            },
+            logicalName: loaded.declaration.logicalName,
+        };
+        const ledgerLock = dispatch.dependencies.acquireSecretLedgerLock({
+            appData: dispatch.appData,
+            slice: command.slice,
+            stage: identity.stage,
+        });
+        let result;
+        try {
+            if (command.command === 'set') {
+                dispatch.dependencies.recordSecretLogicalName({
+                    ...ledgerInput,
+                    lock: ledgerLock,
+                });
+                result = await (0, personal_command_js_1.setPersonalSstSecret)({
+                    ...commonInput,
+                    hiddenInput: dispatch.dependencies.secretHiddenInput,
+                    validator: dispatch.dependencies.secretValidator({
+                        environment: dispatch.environment,
+                        logicalName: loaded.declaration.logicalName,
+                        projectRoot: loaded.projectRoot,
+                        valueKind: loaded.declaration.valueKind,
+                    }),
+                });
+            }
+            else {
+                result = await (0, personal_command_js_1.removePersonalSstSecret)({
+                    ...commonInput,
+                    confirmation: dispatch.dependencies.secretConfirmation,
+                });
+                dispatch.dependencies.forgetSecretLogicalName({
+                    ...ledgerInput,
+                    lock: ledgerLock,
+                });
+            }
+        }
+        finally {
+            dispatch.dependencies.releaseSecretLedgerLock(ledgerLock);
+        }
+        return {
+            result: secretSuccess(command.command, {
+                ...result,
+                slice: command.slice,
+            }),
+        };
+    }
+    catch (error) {
+        return secretCommandFailure(error);
+    }
+}
+async function associatedFleetGuard(gitCommonDirectory, dispatch) {
+    const inventory = await dispatch.dependencies.inventory({
+        appData: dispatch.appData,
+    });
+    const blockers = inventory.filter((record) => record.gitCommonDirectory === gitCommonDirectory &&
+        record.classification !== 'stale');
+    if (blockers.length > 0) {
+        throw new errors_js_1.LocalDevContractError(blockers.some(({ classification }) => classification === 'live')
+            ? 'fleet-in-use'
+            : 'fleet-ownership-ambiguous', `Shared local context is not mutable while associated Fleet state is ${blockers
+            .map(({ fleetId, classification }) => `${fleetId}:${classification}`)
+            .join(', ')}.`);
+    }
+}
+async function recordDiagnosticAssessment(command, dispatch) {
+    const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
+    const saved = dispatch.dependencies.readContext(common);
+    if (saved.kind === 'invalid') {
+        dispatch.io.stderr(`[local-context-invalid] ${saved.reason} Continuing with live Fleet and private runtime state; configure/up/restart remain blocked until the saved context is repaired.\n`);
+    }
+    const discovery = await dispatch.dependencies.discoverContext({}, dispatch.environment);
+    const context = saved.kind === 'ready'
+        ? saved.resolution.context
+        : diagnosticContext(discovery);
+    return dispatch.dependencies.inspectEnvironment({
+        appData: dispatch.appData,
+        command,
+        context,
+        frameworkVersion: dispatch.dependencies.frameworkVersion(),
+        identity: dispatch.dependencies.personalStageResolver.resolve(),
+        workspaceRoot: dispatch.workspaceRoot,
+    });
+}
+async function assertPersonalSecretLedgersReachable(context, identity, dispatch) {
+    const ledgers = dispatch.dependencies
+        .listSecretLedgers({
+        appData: dispatch.appData,
+        stage: identity.stage,
+    })
+        .filter(({ logicalNames }) => logicalNames.length > 0);
+    if (ledgers.length === 0)
+        return;
+    let accountId;
+    try {
+        accountId = await dispatch.dependencies.resolveCurrentAccount({ profile: context.profile, region: context.region }, dispatch.environment);
+    }
+    catch {
+        throw new errors_js_1.LocalDevContractError('local-context-conflict', 'The proposed local context cannot prove access to nonempty personal-secret ledgers. Restore the prior profile and Region, run each affected Slice cleanup, then reconfigure.');
+    }
+    const unreachable = ledgers.filter((ledger) => ledger.accountId !== accountId || ledger.region !== context.region);
+    if (unreachable.length > 0) {
+        throw new errors_js_1.LocalDevContractError('local-context-conflict', `The proposed local context would strand personal-secret cleanup for Slice${unreachable.length === 1 ? '' : 's'} ${unreachable
+            .map(({ slice }) => slice)
+            .join(', ')}. Restore the recorded account and Region, run the affected Slice cleanup, then reconfigure.`);
+    }
+}
+async function executeConfigure(command, identity, dispatch) {
+    const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
+    const saved = dispatch.dependencies.readContext(common);
+    if (command.show) {
+        const discovery = await dispatch.dependencies.discoverContext({}, dispatch.environment);
+        const context = saved.kind === 'ready'
+            ? saved.resolution.context
+            : diagnosticContext(discovery);
+        const assessment = await inspectForCommand('configure', context, identity, dispatch);
+        return {
+            result: success(command.command, {
+                ...contextPayload(saved),
+                environmentAssessment: assessment,
+                ...(saved.kind === 'ready'
+                    ? { sources: saved.resolution.sources }
+                    : {}),
+            }),
+        };
+    }
+    requireMutableSavedContext(saved);
+    await associatedFleetGuard(common, dispatch);
+    const discovery = await dispatch.dependencies.discoverContext(command.input, dispatch.environment);
+    const resolution = (0, local_context_js_1.configureLocalDevContext)(saved.kind === 'ready' ? saved.resolution.context : undefined, command.input, {
+        clearDevelopmentRouterOrigin: command.clearDevelopmentRouterOrigin,
+        discovery,
+    });
+    await assertPersonalSecretLedgersReachable(resolution.context, identity, dispatch);
+    const assessment = await inspectForCommand('configure', resolution.context, identity, dispatch);
+    (0, environment_inspector_js_1.assertEnvironmentReady)(assessment);
+    const written = dispatch.dependencies.writeContext(common, resolution.context);
+    return {
+        result: success(command.command, {
+            context: written.context,
+            digest: written.digest,
+            path: saved.path,
+            sources: resolution.sources,
+        }),
+    };
+}
+async function resolveUpContext(command, dispatch) {
+    const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
+    const saved = dispatch.dependencies.readContext(common);
+    requireMutableSavedContext(saved);
+    if (saved.kind === 'ready') {
+        return {
+            gitCommonDirectory: common,
+            resolution: (0, local_context_js_1.reconcileSavedLocalDevContext)(saved.resolution.context, command.initialContext),
+        };
+    }
+    const discovery = await dispatch.dependencies.discoverContext(command.initialContext, dispatch.environment);
+    const resolution = (0, local_context_js_1.resolveInitialLocalDevContext)(command.initialContext, discovery);
+    dispatch.dependencies.writeContext(common, resolution.context);
+    return { gitCommonDirectory: common, resolution };
+}
+function operationWaitOptions(command) {
+    return command.timeoutMs === undefined
+        ? {}
+        : { timeoutMs: command.timeoutMs };
+}
+async function executeUp(command, coordinates, dispatch) {
+    const { resolution } = await resolveUpContext(command, dispatch);
+    const executed = await (0, dev_command_core_js_1.executeFleetUpCore)(command, {
+        appData: dispatch.appData,
+        context: resolution.context,
+        frameworkVersion: dispatch.dependencies.frameworkVersion(),
+        identity: coordinates.identity,
+        plan: coordinates.plan,
+        signal: dispatch.signal,
+        workspaceRoot: dispatch.workspaceRoot,
+    }, {
+        idempotencyKey: dispatch.dependencies.idempotencyKey,
+        inspectEnvironment: dispatch.dependencies.inspectEnvironment,
+        launchFleet: dispatch.dependencies.launchFleet,
+        reportCleanupFailure: (message) => dispatch.io.stderr(`[cleanup-incomplete] ${message}\n`),
+    });
+    return {
+        ...(executed.afterWrite ? { afterWrite: executed.afterWrite } : {}),
+        result: success(command.command, {
+            attached: executed.attached,
+            fleetId: executed.fleetId,
+            operation: executed.operation,
+            ...(executed.slices ? { slices: executed.slices } : {}),
+        }, executed.operationId),
+    };
+}
+async function exactClient(coordinates, dispatch) {
+    if (!dispatch.dependencies.pathExists(coordinates.paths.capability)) {
+        throw new errors_js_1.LocalDevContractError('not-running', `Fleet ${coordinates.fleetId} is not running.`);
+    }
+    return dispatch.dependencies.client(coordinates.paths);
+}
+function requireRecoveryFleet(coordinates) {
+    if (!coordinates.fleetId || !coordinates.paths) {
+        throw new errors_js_1.LocalDevContractError('not-running', 'No private Fleet record matches this checkout and personal stage.');
+    }
+}
+async function executeRestart(command, coordinates, dispatch) {
+    if (command.command !== 'restart') {
+        throw new errors_js_1.LocalDevContractError('invalid-input', 'Restart core received another lifecycle command.');
+    }
+    const selected = command.selector.all
+        ? undefined
+        : (0, nx_workspace_js_1.selectWorkspaceSlices)(coordinates.plan, command.selector);
+    const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
+    const saved = dispatch.dependencies.readContext(common);
+    if (saved.kind !== 'ready') {
+        throw new errors_js_1.LocalDevContractError(saved.kind === 'invalid'
+            ? 'local-context-invalid'
+            : 'local-context-missing', saved.kind === 'invalid'
+            ? saved.reason
+            : 'Restart requires saved local-development context.');
+    }
+    const adapters = (selected ?? [...coordinates.plan.adapters.keys()]).map((name) => coordinates.plan.adapters.get(name));
+    const assessment = await inspectForCommand('restart', saved.resolution.context, coordinates.identity, dispatch, { adapters });
+    (0, environment_inspector_js_1.assertEnvironmentReady)(assessment);
+    await exactClient(coordinates, dispatch);
+    const launch = await dispatch.dependencies.launchFleet({
+        appData: dispatch.appData,
+        context: saved.resolution.context,
+        foreground: false,
+        frameworkVersion: dispatch.dependencies.frameworkVersion(),
+        sstMode: 'mono',
+        workspaceRoot: dispatch.workspaceRoot,
+    });
+    if (!launch.attached) {
+        await launch.client
+            .shutdown(dispatch.dependencies.idempotencyKey())
+            .catch(() => undefined);
+        throw new errors_js_1.LocalDevContractError('not-running', 'Restart requires an existing compatible Fleet supervisor.');
+    }
+    const client = launch.client;
+    const submission = await client.submit('restart', command.selector, dispatch.dependencies.idempotencyKey());
+    if (command.noWait) {
+        return {
+            result: success(command.command, { fleetId: coordinates.fleetId, operation: submission }, submission.operationId),
+        };
+    }
+    const operation = await client.waitForOperation(submission.operationId, operationWaitOptions(command));
+    const failed = lifecycleOperationFailure(command.command, coordinates.fleetId, operation);
+    if (failed)
+        return { result: failed };
+    return {
+        result: success(command.command, { fleetId: coordinates.fleetId, operation }, submission.operationId),
+    };
+}
+async function executeDown(command, coordinates, dispatch) {
+    if (command.command !== 'down') {
+        throw new errors_js_1.LocalDevContractError('invalid-input', 'Down core received another lifecycle command.');
+    }
+    requireRecoveryFleet(coordinates);
+    const client = await exactClient(coordinates, dispatch);
+    if (!command.selector.all) {
+        const state = await client.status();
+        const available = new Set(state.slices.map(({ name }) => name));
+        const unknown = command.selector.slices.find((slice) => !available.has(slice));
+        if (unknown) {
+            throw new errors_js_1.LocalDevContractError('unknown-slice', `Product Slice ${unknown} is absent from the live Fleet state.`);
+        }
+    }
+    const submission = await client.submit('down', command.selector, dispatch.dependencies.idempotencyKey());
+    if (command.noWait) {
+        return {
+            result: success(command.command, { fleetId: coordinates.fleetId, operation: submission }, submission.operationId),
+        };
+    }
+    const operation = await client.waitForOperation(submission.operationId, operationWaitOptions(command));
+    const failed = lifecycleOperationFailure(command.command, coordinates.fleetId, operation);
+    if (failed)
+        return { result: failed };
+    if (command.selector.all) {
+        await client.shutdown(dispatch.dependencies.idempotencyKey());
+    }
+    return {
+        result: success(command.command, { fleetId: coordinates.fleetId, operation }, submission.operationId),
+    };
+}
+function lifecycleOperationFailure(command, fleetId, operation) {
+    if (operation.state !== 'failed')
+        return undefined;
+    const classification = operation.failureClassification ?? 'internal-error';
+    const retained = command === 'down' && classification === 'cleanup-incomplete'
+        ? ' The affected Slice remains selected and its claim remains retained for a safe retry.'
+        : '';
+    return (0, output_js_1.createCliResult)({
+        command,
+        failureClassification: classification,
+        namespace: 'dev',
+        operationId: operation.id,
+        outcome: 'failed',
+        payload: {
+            fleetId,
+            message: `Fleet ${command} failed (${classification}).${retained}`,
+            operation,
+        },
+    });
+}
+async function executeStatus(coordinates, dispatch) {
+    const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
+    const saved = dispatch.dependencies.readContext(common);
+    const discovery = await dispatch.dependencies.discoverContext({}, dispatch.environment);
+    const context = saved.kind === 'ready'
+        ? saved.resolution.context
+        : diagnosticContext(discovery);
+    const environment = await inspectForCommand('status', context, coordinates.identity, dispatch);
+    if (!coordinates.paths ||
+        !coordinates.fleetId ||
+        !dispatch.dependencies.pathExists(coordinates.paths.capability)) {
+        return {
+            result: success('status', {
+                context: contextPayload(saved),
+                environmentAssessment: environment,
+                ...(coordinates.fleetId ? { fleetId: coordinates.fleetId } : {}),
+                ...(coordinates.fleet ? { inventory: coordinates.fleet } : {}),
+                running: false,
+            }),
+        };
+    }
+    try {
+        const state = await dispatch.dependencies
+            .client(coordinates.paths)
+            .status();
+        return {
+            result: success('status', {
+                context: contextPayload(saved),
+                environmentAssessment: environment,
+                running: true,
+                state,
+            }),
+        };
+    }
+    catch (error) {
+        if (error instanceof control_contract_js_1.FleetControlUnauthorizedError) {
+            throw new errors_js_1.LocalDevContractError('stale-state-ambiguous', 'Fleet control capability was rejected; inspect the current-user private session before retrying.');
+        }
+        const inventory = await dispatch.dependencies.inventory({
+            appData: dispatch.appData,
+        });
+        return {
+            result: success('status', {
+                context: contextPayload(saved),
+                environmentAssessment: environment,
+                fleetId: coordinates.fleetId,
+                inventory: inventory.find(({ fleetId }) => fleetId === coordinates.fleetId),
+                running: false,
+            }),
+        };
+    }
+}
+function doctorOutcome(environment, local) {
+    if (environment.state === 'deficient') {
+        return { classification: 'environment-deficient', outcome: 'failed' };
+    }
+    if (local &&
+        (local.tls !== 'ready' ||
+            local.trust !== 'ready' ||
+            local.connectivity !== 'ready')) {
+        return {
+            classification: 'prerequisite-unavailable',
+            outcome: 'failed',
+        };
+    }
+    return { outcome: 'succeeded' };
+}
+async function executeDoctor(command, identity, dispatch) {
+    const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
+    const saved = dispatch.dependencies.readContext(common);
+    const discovery = await dispatch.dependencies.discoverContext({}, dispatch.environment);
+    const context = saved.kind === 'ready'
+        ? saved.resolution.context
+        : diagnosticContext(discovery);
+    const environment = await inspectForCommand('doctor', context, identity, dispatch, { force: command.refresh });
+    const local = command.environmentOnly
+        ? undefined
+        : await dispatch.dependencies.inspectLocal({
+            appData: dispatch.appData,
+        }, {
+            projectName: 'workspace',
+            root: dispatch.workspaceRoot,
+        });
+    const [fleetInventory, sliceClaims] = await Promise.all([
+        dispatch.dependencies.inventory({ appData: dispatch.appData }),
+        dispatch.dependencies.inventoryClaims({ appData: dispatch.appData }),
+    ]);
+    const outcome = doctorOutcome(environment, local);
+    const payload = {
+        context: contextPayload(saved),
+        environmentAssessment: environment,
+        fleetInventory,
+        ...(local ? { localDevelopment: local } : {}),
+        sliceClaims,
+    };
+    return {
+        result: outcome.outcome === 'succeeded'
+            ? success(command.command, payload)
+            : (0, output_js_1.createCliResult)({
+                command: command.command,
+                failureClassification: outcome.classification,
+                namespace: 'dev',
+                outcome: 'failed',
+                payload,
+            }),
+    };
+}
+async function executeLogs(command, coordinates, dispatch) {
+    requireRecoveryFleet(coordinates);
+    const slices = selectorsForQuery(command, coordinates.plan);
+    const query = {
+        limit: command.limit,
+        ...(command.attempt === undefined ? {} : { attempt: command.attempt }),
+        ...(command.contains === undefined ? {} : { contains: command.contains }),
+        ...(command.correlationId === undefined
+            ? {}
+            : { correlationId: command.correlationId }),
+        ...(command.level === undefined ? {} : { level: command.level }),
+        ...(command.since === undefined ? {} : { since: command.since }),
+        ...(slices === undefined ? {} : { slices }),
+        ...(command.stream === undefined ? {} : { stream: command.stream }),
+        ...(command.until === undefined ? {} : { until: command.until }),
+    };
+    let result = dispatch.dependencies.searchLogs(coordinates.paths.logDirectory, query);
+    while (true) {
+        try {
+            return {
+                result: success(command.command, {
+                    fleetId: coordinates.fleetId,
+                    ...result,
+                }),
+            };
+        }
+        catch (error) {
+            if (result.records.length === 0)
+                throw error;
+            result = {
+                ...result,
+                records: result.records.slice(1),
+                truncated: true,
+            };
+        }
+    }
+}
+function writeTailRecord(record, json, io) {
+    io.stdout(json
+        ? `${(0, contract_validation_js_1.canonicalJson)(record)}\n`
+        : `${record.timestamp} ${record.slice} ${record.stream} ${record.message}\n`);
+}
+async function executeTail(command, coordinates, dispatch) {
+    requireRecoveryFleet(coordinates);
+    const slices = selectorsForQuery(command, coordinates.plan);
+    for await (const record of dispatch.dependencies.followLogs(coordinates.paths.logDirectory, {
+        ...(command.level === undefined ? {} : { level: command.level }),
+        lines: command.lines,
+        ...(slices === undefined ? {} : { slices }),
+    }, dispatch.signal)) {
+        writeTailRecord(record, command.json, dispatch.io);
+    }
+    return { streamed: true };
+}
+async function executeSetup(command, identity, dispatch) {
+    const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
+    const saved = dispatch.dependencies.readContext(common);
+    if (command.remove) {
+        const inventory = await dispatch.dependencies.inventory({
+            appData: dispatch.appData,
+        });
+        const blockers = inventory.filter(({ classification }) => classification !== 'stale');
+        if (blockers.length > 0) {
+            throw new errors_js_1.LocalDevContractError(blockers.some(({ classification }) => classification === 'live')
+                ? 'fleet-in-use'
+                : 'fleet-ownership-ambiguous', 'Setup removal is refused until every Fleet is proved absent or stale.');
+        }
+    }
+    const discovery = await dispatch.dependencies.discoverContext({}, dispatch.environment);
+    const context = saved.kind === 'ready'
+        ? saved.resolution.context
+        : diagnosticContext(discovery);
+    const assessment = await inspectForCommand('setup', context, identity, dispatch);
+    if (!command.remove)
+        (0, environment_inspector_js_1.assertEnvironmentReady)(assessment);
+    await dispatch.dependencies.runSetup({
+        appData: dispatch.appData,
+        hostSuffix: context.hostSuffix,
+        portless: command.portless,
+        remove: command.remove,
+        trust: command.trust,
+        upgrade: command.upgrade,
+    });
+    return {
+        result: success(command.command, {
+            appData: dispatch.appData,
+            environmentAssessment: assessment,
+            success: true,
+        }),
+    };
+}
+async function dispatchDevCommand(command, dispatch) {
+    if (command.command === 'ps') {
+        await recordDiagnosticAssessment('ps', dispatch);
+        const [fleets, sliceClaims] = await Promise.all([
+            dispatch.dependencies.inventory({ appData: dispatch.appData }),
+            dispatch.dependencies.inventoryClaims({ appData: dispatch.appData }),
+        ]);
+        return { result: success(command.command, { fleets, sliceClaims }) };
+    }
+    if (command.command === 'prune') {
+        await recordDiagnosticAssessment('prune', dispatch);
+        const pruned = await dispatch.dependencies.prune({
+            allStale: command.allStale,
+            appData: dispatch.appData,
+            ...(command.fleetId ? { fleetId: command.fleetId } : {}),
+        });
+        return { result: success(command.command, { pruned }) };
+    }
+    if (command.command === 'down' ||
+        command.command === 'logs' ||
+        command.command === 'tail') {
+        await recordDiagnosticAssessment(command.command, dispatch);
+    }
+    if (command.command === 'configure') {
+        return executeConfigure(command, dispatch.dependencies.personalStageResolver.resolve(), dispatch);
+    }
+    if (command.command === 'setup') {
+        return executeSetup(command, dispatch.dependencies.personalStageResolver.resolve(), dispatch);
+    }
+    if (command.command === 'doctor') {
+        return executeDoctor(command, dispatch.dependencies.personalStageResolver.resolve(), dispatch);
+    }
+    if (command.command === 'up' || command.command === 'restart') {
+        const coordinates = await resolveCurrentFleetCoordinates(dispatch.workspaceRoot, dispatch.appData, dispatch.dependencies);
+        return command.command === 'up'
+            ? executeUp(command, coordinates, dispatch)
+            : executeRestart(command, coordinates, dispatch);
+    }
+    const coordinates = await resolveRecoveryFleetCoordinates(dispatch.workspaceRoot, dispatch.appData, dispatch.dependencies);
+    switch (command.command) {
+        case 'status':
+            return executeStatus(coordinates, dispatch);
+        case 'down':
+            return executeDown(command, coordinates, dispatch);
+        case 'logs':
+            return executeLogs(command, coordinates, dispatch);
+        case 'tail':
+            return executeTail(command, coordinates, dispatch);
+    }
+}
+function processAbortSignal() {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    process.once('SIGINT', abort);
+    process.once('SIGTERM', abort);
+    return {
+        cleanup: () => {
+            process.removeListener('SIGINT', abort);
+            process.removeListener('SIGTERM', abort);
+        },
+        signal: controller.signal,
+    };
+}
+function commandJson(command) {
+    return (command?.kind === 'agent' || command?.kind === 'dev') && command.json;
+}
+function commandName(command) {
+    return command?.kind === 'agent' ||
+        command?.kind === 'dev' ||
+        command?.kind === 'secret'
+        ? command.command
+        : 'parse';
+}
+function commandNamespace(command, arguments_) {
+    if (command?.kind === 'agent' || arguments_[0] === 'agent')
+        return 'agent';
+    return command?.kind === 'secret' || arguments_[0] === 'secret'
+        ? 'secret'
+        : 'dev';
+}
+async function runAgentCommandCore(command, io = {}, overrides = {}) {
+    const output = {
+        stderr: io.stderr ?? ((value) => process.stderr.write(value)),
+        stdout: io.stdout ?? ((value) => process.stdout.write(value)),
+    };
+    try {
+        const dependencies = defaultDependencies(overrides);
+        const root = dependencies.resolveWorkspaceRoot(io.cwd ?? process.cwd());
+        const execution = await dependencies.executeAgent(command, root);
+        if (command.json) {
+            writeResult(execution.result, true, output);
+        }
+        else if (execution.result.outcome === 'succeeded') {
+            output.stdout(`${execution.human}\n`);
+        }
+        else {
+            output.stderr(`[${execution.result.failureClassification ?? 'tool-internal-error'}] ${execution.human}\n`);
+        }
+        return (0, output_js_1.cliExitCode)(execution.result);
+    }
+    catch (error) {
+        const classified = (0, agent_runtime_js_1.classifyDeveloperAgentCliError)(error);
+        const result = failure('agent', command.command, classified.classification, classified.message);
+        writeResult(result, command.json, output);
+        return (0, output_js_1.cliExitCode)(result);
+    }
+}
+/**
+ * Shared command core consumed by both the `ebk` parser shell and the Nx
+ * compatibility executor. It accepts an already validated command object, so
+ * Nx never calls back through argv parsing or the CLI entry point.
+ */
+async function runDevCommandCore(command, io = {}, overrides = {}) {
+    const output = {
+        stderr: io.stderr ?? ((value) => process.stderr.write(value)),
+        stdout: io.stdout ?? ((value) => process.stdout.write(value)),
+    };
+    let ownedSignal;
+    try {
+        const dependencies = defaultDependencies(overrides);
+        const root = dependencies.resolveWorkspaceRoot(io.cwd ?? process.cwd());
+        dependencies.changeDirectory(root);
+        if (!io.abortSignal)
+            ownedSignal = processAbortSignal();
+        const execution = await dispatchDevCommand(command, {
+            appData: dependencies.appData(),
+            dependencies,
+            environment: io.environment ?? process.env,
+            io: output,
+            signal: io.abortSignal ?? ownedSignal.signal,
+            workspaceRoot: root,
+        });
+        if (execution.result) {
+            writeResult(execution.result, command.json, output);
+            await execution.afterWrite;
+            return (0, output_js_1.cliExitCode)(execution.result);
+        }
+        return execution.streamed ? 0 : 1;
+    }
+    catch (error) {
+        const result = failureFromError('dev', command.command, error);
+        writeResult(result, command.json, output);
+        return (0, output_js_1.cliExitCode)(result);
+    }
+    finally {
+        ownedSignal?.cleanup();
+    }
+}
+async function runEbkCli(arguments_, io = {}, overrides = {}) {
+    const output = {
+        stderr: io.stderr ?? ((value) => process.stderr.write(value)),
+        stdout: io.stdout ?? ((value) => process.stdout.write(value)),
+    };
+    let parsed;
+    let ownedSignal;
+    try {
+        parsed = (0, dev_command_js_1.parseEbkArguments)(arguments_);
+        if (parsed.kind === 'help') {
+            output.stdout(`${parsed.namespace === 'agent'
+                ? AGENT_HELP
+                : parsed.namespace === 'dev'
+                    ? DEV_HELP
+                    : parsed.namespace === 'secret'
+                        ? SECRET_HELP
+                        : ROOT_HELP}\n`);
+            return 0;
+        }
+        if (parsed.kind === 'version') {
+            output.stdout(`${(overrides.frameworkVersion ?? packageVersion)()}\n`);
+            return 0;
+        }
+        if (parsed.kind === 'dev') {
+            return runDevCommandCore(parsed, io, overrides);
+        }
+        if (parsed.kind === 'agent') {
+            return runAgentCommandCore(parsed, io, overrides);
+        }
+        const dependencies = defaultDependencies(overrides);
+        const root = dependencies.resolveWorkspaceRoot(io.cwd ?? process.cwd());
+        dependencies.changeDirectory(root);
+        if (!io.abortSignal)
+            ownedSignal = processAbortSignal();
+        const dispatch = {
+            appData: dependencies.appData(),
+            dependencies,
+            environment: io.environment ?? process.env,
+            io: output,
+            signal: io.abortSignal ?? ownedSignal.signal,
+            workspaceRoot: root,
+        };
+        const execution = await executeSecretCommand(parsed, dispatch);
+        if (execution.result) {
+            writeResult(execution.result, false, output);
+            await execution.afterWrite;
+            return (0, output_js_1.cliExitCode)(execution.result);
+        }
+        return execution.streamed ? 0 : 1;
+    }
+    catch (error) {
+        const result = failureFromError(commandNamespace(parsed, arguments_), commandName(parsed), error);
+        writeResult(result, commandJson(parsed) || arguments_.includes('--json'), output);
+        return (0, output_js_1.cliExitCode)(result);
+    }
+    finally {
+        ownedSignal?.cleanup();
+    }
+}
+if (require.main === module) {
+    void runEbkCli(process.argv.slice(2)).then((code) => {
+        process.exitCode = code;
+    });
+}
+//# sourceMappingURL=main.js.map