@eve-horizon/cli 0.2.27 → 0.2.29

package/dist/index.js

@@ -5182,8 +5182,8 @@ var require_promise = __commonJS({
     exports2.Deferred = void 0;
     var Deferred = class {
       constructor() {
-        this._promise = new Promise((resolve7, reject) => {
-          this._resolve = resolve7;
+        this._promise = new Promise((resolve8, reject) => {
+          this._resolve = resolve8;
           this._reject = reject;
         });
       }
@@ -5246,10 +5246,10 @@ var require_exporter = __commonJS({
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     var suppress_tracing_1 = require_suppress_tracing();
     function _export(exporter, arg) {
-      return new Promise((resolve7) => {
+      return new Promise((resolve8) => {
         api_1.context.with((0, suppress_tracing_1.suppressTracing)(api_1.context.active()), () => {
           exporter.export(arg, (result) => {
-            resolve7(result);
+            resolve8(result);
           });
         });
       });
@@ -8791,7 +8791,7 @@ var require_homedir = __commonJS({
   "../../node_modules/.pnpm/resolve@1.22.11/node_modules/resolve/lib/homedir.js"(exports2, module2) {
     "use strict";
     var os4 = require("os");
-    module2.exports = os4.homedir || function homedir5() {
+    module2.exports = os4.homedir || function homedir6() {
       var home = process.env.HOME;
       var user = process.env.LOGNAME || process.env.USER || process.env.LNAME || process.env.USERNAME;
       if (process.platform === "win32") {
@@ -9277,11 +9277,11 @@ var require_async = __commonJS({
     var relativePathRegex = /^(?:\.\.?(?:\/|$)|\/|([A-Za-z]:)?[/\\])/;
     var windowsDriveRegex = /^\w:[/\\]*$/;
     var nodeModulesRegex = /[/\\]node_modules[/\\]*$/;
-    var homedir5 = getHomedir();
+    var homedir6 = getHomedir();
     var defaultPaths = function() {
       return [
-        path6.join(homedir5, ".node_modules"),
-        path6.join(homedir5, ".node_libraries")
+        path6.join(homedir6, ".node_modules"),
+        path6.join(homedir6, ".node_libraries")
       ];
     };
     var defaultIsFile = function isFile(file, cb) {
@@ -9335,7 +9335,7 @@ var require_async = __commonJS({
       }
       return dirs;
     };
-    module2.exports = function resolve7(x, options, callback) {
+    module2.exports = function resolve8(x, options, callback) {
       var cb = callback;
       var opts = options;
       if (typeof options === "function") {
@@ -9770,11 +9770,11 @@ var require_sync = __commonJS({
     var relativePathRegex = /^(?:\.\.?(?:\/|$)|\/|([A-Za-z]:)?[/\\])/;
     var windowsDriveRegex = /^\w:[/\\]*$/;
     var nodeModulesRegex = /[/\\]node_modules[/\\]*$/;
-    var homedir5 = getHomedir();
+    var homedir6 = getHomedir();
     var defaultPaths = function() {
       return [
-        path6.join(homedir5, ".node_modules"),
-        path6.join(homedir5, ".node_libraries")
+        path6.join(homedir6, ".node_modules"),
+        path6.join(homedir6, ".node_libraries")
       ];
     };
     var defaultIsFile = function isFile(file) {
@@ -10068,16 +10068,16 @@ var require_require_in_the_middle = __commonJS({
       }
     }
     var _resolve;
-    function resolve7(moduleName, basedir) {
+    function resolve8(moduleName, basedir) {
       if (!_resolve) {
         if (require.resolve && require.resolve.paths) {
           _resolve = function(moduleName2, basedir2) {
             return require.resolve(moduleName2, { paths: [basedir2] });
           };
         } else {
-          const resolve8 = require_resolve();
+          const resolve9 = require_resolve();
           _resolve = function(moduleName2, basedir2) {
-            return resolve8.sync(moduleName2, { basedir: basedir2 });
+            return resolve9.sync(moduleName2, { basedir: basedir2 });
           };
         }
       }
@@ -10235,7 +10235,7 @@ var require_require_in_the_middle = __commonJS({
           if (!matchFound) {
             let res;
             try {
-              res = resolve7(moduleName, basedir);
+              res = resolve8(moduleName, basedir);
             } catch (e) {
               debug("could not resolve module: %s", moduleName);
               self2._cache.set(filename, exports3, core);
@@ -10537,8 +10537,8 @@ var require_import_in_the_middle = __commonJS({
       function waitForAllMessagesAcknowledged() {
         const timer2 = setInterval(() => {
         }, 1e3);
-        const promise = new Promise((resolve7) => {
-          resolveFn = resolve7;
+        const promise = new Promise((resolve8) => {
+          resolveFn = resolve8;
         }).then(() => {
           clearInterval(timer2);
         });
@@ -18249,10 +18249,10 @@ var require_instrumentation3 = __commonJS({
             if (typeof (maybePromise === null || maybePromise === void 0 ? void 0 : maybePromise.then) === "function") {
               return maybePromise.then((value) => {
                 plugin._applyResponseHook(span, null, value);
-                return new Promise((resolve7) => plugin._endSpan(span, void 0, () => resolve7(value)));
+                return new Promise((resolve8) => plugin._endSpan(span, void 0, () => resolve8(value)));
               }, (err) => {
                 plugin._applyResponseHook(span, err);
-                return new Promise((resolve7, reject) => plugin._endSpan(span, err, () => reject(err)));
+                return new Promise((resolve8, reject) => plugin._endSpan(span, err, () => reject(err)));
               });
             }
             return maybePromise;
@@ -19484,7 +19484,7 @@ var require_aws_sdk = __commonJS({
             const requestMetadata = self2.servicesExtensions.requestPreSpanHook(normalizedRequest, self2.getConfig(), self2._diag);
             const span = self2._startAwsV3Span(normalizedRequest, requestMetadata);
             const activeContextWithSpan = api_1.trace.setSpan(api_1.context.active(), span);
-            const handlerPromise = new Promise((resolve7, reject) => {
+            const handlerPromise = new Promise((resolve8, reject) => {
               Promise.resolve(regionPromise).then((resolvedRegion) => {
                 normalizedRequest.region = resolvedRegion;
                 span.setAttribute(enums_1.AttributeNames.AWS_REGION, resolvedRegion);
@@ -19542,7 +19542,7 @@ var require_aws_sdk = __commonJS({
                   span.end();
                 });
                 promiseWithResponseLogic.then((res) => {
-                  resolve7(res);
+                  resolve8(res);
                 }).catch((err) => reject(err));
               });
             });
@@ -20194,12 +20194,12 @@ var require_instrumentation5 = __commonJS({
     }
     function wrapPromise(span, promise, successCallback) {
       return promise.then((result) => {
-        return new Promise((resolve7) => {
+        return new Promise((resolve8) => {
           if (successCallback) {
             successCallback(span, result);
           }
           span.end();
-          resolve7(result);
+          resolve8(result);
         });
       }).catch((error) => {
         return new Promise((_, reject) => {
@@ -22394,7 +22394,7 @@ var require_instrumentation12 = __commonJS({
         };
         const functionWithOriginalProperties = patchedFunctionWithOriginalProperties(patchedFunction, original);
         const promisified = function(path6) {
-          return new Promise((resolve7) => functionWithOriginalProperties(path6, resolve7));
+          return new Promise((resolve8) => functionWithOriginalProperties(path6, resolve8));
         };
         Object.defineProperty(promisified, "name", { value: functionName });
         Object.defineProperty(functionWithOriginalProperties, util_1.promisify.custom, {
@@ -27944,8 +27944,8 @@ var require_promise2 = __commonJS({
     exports2.Deferred = void 0;
     var Deferred = class {
       constructor() {
-        this._promise = new Promise((resolve7, reject) => {
-          this._resolve = resolve7;
+        this._promise = new Promise((resolve8, reject) => {
+          this._resolve = resolve8;
           this._reject = reject;
         });
       }
@@ -28008,10 +28008,10 @@ var require_exporter2 = __commonJS({
     var api_1 = (init_esm(), __toCommonJS(esm_exports));
     var suppress_tracing_1 = require_suppress_tracing2();
     function _export(exporter, arg) {
-      return new Promise((resolve7) => {
+      return new Promise((resolve8) => {
         api_1.context.with((0, suppress_tracing_1.suppressTracing)(api_1.context.active()), () => {
           exporter.export(arg, (result) => {
-            resolve7(result);
+            resolve8(result);
           });
         });
       });
@@ -29941,7 +29941,7 @@ var require_instrumentation18 = __commonJS({
       _getConsumerRunPatch() {
         const instrumentation = this;
         return (original) => {
-          return function run(...args) {
+          return function run2(...args) {
             const config = args[0];
             if (config === null || config === void 0 ? void 0 : config.eachMessage) {
               if ((0, instrumentation_1.isWrapped)(config.eachMessage)) {
@@ -35758,11 +35758,11 @@ var require_instrumentation28 = __commonJS({
             }
             if (result instanceof Promise) {
               return result.then((result2) => {
-                return new Promise((resolve7) => {
+                return new Promise((resolve8) => {
                   utils.handleExecutionResult(plugin.getConfig(), span, result2);
                   recordDuration();
                   span.end();
-                  resolve7(result2);
+                  resolve8(result2);
                 });
               }).catch((error) => {
                 return new Promise((_, reject) => {
@@ -37077,10 +37077,10 @@ var require_utils27 = __commonJS({
     };
     exports2.renameHttpSpan = renameHttpSpan;
     var once = (fn) => {
-      let run = true;
+      let run2 = true;
       return () => {
-        if (run) {
-          run = false;
+        if (run2) {
+          run2 = false;
           fn();
         }
       };
@@ -38786,7 +38786,7 @@ var require_utils30 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.normalizeType = exports2.normalizeArch = void 0;
-    var normalizeArch = (nodeArchString) => {
+    var normalizeArch2 = (nodeArchString) => {
       switch (nodeArchString) {
         case "arm":
           return "arm32";
@@ -38798,7 +38798,7 @@ var require_utils30 = __commonJS({
           return nodeArchString;
       }
     };
-    exports2.normalizeArch = normalizeArch;
+    exports2.normalizeArch = normalizeArch2;
     var normalizeType = (nodePlatform) => {
       switch (nodePlatform) {
         case "sunos":
@@ -39672,7 +39672,7 @@ var require_AlibabaCloudEcsDetector = __commonJS({
         return await this._fetchString(options);
       }
       async _fetchString(options) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve8, reject) => {
           const timeoutId = setTimeout(() => {
             req.destroy(new Error("ECS metadata api request timed out."));
           }, this.MILLISECONDS_TIME_OUT);
@@ -39690,7 +39690,7 @@ var require_AlibabaCloudEcsDetector = __commonJS({
               reject(err);
             });
             res.on("end", () => {
-              resolve7(rawData);
+              resolve8(rawData);
             });
           });
           req.on("error", (err) => {
@@ -39947,7 +39947,7 @@ var require_AwsEc2DetectorSync = __commonJS({
        * the identity properties in a local map.
        */
       async _fetchString(options) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve8, reject) => {
           const timeoutId = setTimeout(() => {
             req.abort();
             reject(new Error("EC2 metadata api request timed out."));
@@ -39961,7 +39961,7 @@ var require_AwsEc2DetectorSync = __commonJS({
             res.on("end", () => {
               if (statusCode && statusCode >= 200 && statusCode < 300) {
                 try {
-                  resolve7(rawData);
+                  resolve8(rawData);
                 } catch (e) {
                   reject(e);
                 }
@@ -40127,14 +40127,14 @@ var require_AwsEcsDetectorSync = __commonJS({
         return match[1];
       }
       static _getUrlAsJson(url) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve8, reject) => {
           const request = http.get(url, (response) => {
             if (response.statusCode && response.statusCode >= 400) {
               reject(new Error(`Request to '${url}' failed with status ${response.statusCode}`));
             }
             let responseBody = "";
             response.on("data", (chunk) => responseBody += chunk.toString());
-            response.on("end", () => resolve7(responseBody));
+            response.on("end", () => resolve8(responseBody));
             request.on("error", reject);
           });
           request.setTimeout(HTTP_TIMEOUT_IN_MS, () => {
@@ -40319,7 +40319,7 @@ var require_AwsEksDetectorSync = __commonJS({
        * the identity properties in a local map.
        */
       async _fetchString(options) {
-        return await new Promise((resolve7, reject) => {
+        return await new Promise((resolve8, reject) => {
           const timeoutId = setTimeout(() => {
             req.abort();
             reject(new Error("EKS metadata api request timed out."));
@@ -40333,7 +40333,7 @@ var require_AwsEksDetectorSync = __commonJS({
             res.on("end", () => {
               if (statusCode && statusCode >= 200 && statusCode < 300) {
                 try {
-                  resolve7(rawData);
+                  resolve8(rawData);
                 } catch (e) {
                   reject(e);
                 }
@@ -42880,7 +42880,7 @@ var require_lib2 = __commonJS({
       let accum = [];
       let accumBytes = 0;
       let abort = false;
-      return new Body.Promise(function(resolve7, reject) {
+      return new Body.Promise(function(resolve8, reject) {
         let resTimeout;
         if (_this4.timeout) {
           resTimeout = setTimeout(function() {
@@ -42914,7 +42914,7 @@ var require_lib2 = __commonJS({
           }
           clearTimeout(resTimeout);
           try {
-            resolve7(Buffer.concat(accum, accumBytes));
+            resolve8(Buffer.concat(accum, accumBytes));
           } catch (err) {
             reject(new FetchError(`Could not create Buffer from response body for ${_this4.url}: ${err.message}`, "system", err));
           }
@@ -43589,7 +43589,7 @@ var require_lib2 = __commonJS({
         throw new Error("native promise missing, set fetch.Promise to your favorite alternative");
       }
       Body.Promise = fetch2.Promise;
-      return new fetch2.Promise(function(resolve7, reject) {
+      return new fetch2.Promise(function(resolve8, reject) {
         const request = new Request(url, opts);
         const options = getNodeRequestOptions(request);
         const send = (options.protocol === "https:" ? https : http).request;
@@ -43722,7 +43722,7 @@ var require_lib2 = __commonJS({
                   requestOpts.body = void 0;
                   requestOpts.headers.delete("content-length");
                 }
-                resolve7(fetch2(new Request(locationURL, requestOpts)));
+                resolve8(fetch2(new Request(locationURL, requestOpts)));
                 finalize();
                 return;
             }
@@ -43743,7 +43743,7 @@ var require_lib2 = __commonJS({
           const codings = headers.get("Content-Encoding");
           if (!request.compress || request.method === "HEAD" || codings === null || res.statusCode === 204 || res.statusCode === 304) {
             response = new Response(body, response_options);
-            resolve7(response);
+            resolve8(response);
             return;
           }
           const zlibOptions = {
@@ -43753,7 +43753,7 @@ var require_lib2 = __commonJS({
           if (codings == "gzip" || codings == "x-gzip") {
             body = body.pipe(zlib.createGunzip(zlibOptions));
             response = new Response(body, response_options);
-            resolve7(response);
+            resolve8(response);
             return;
           }
           if (codings == "deflate" || codings == "x-deflate") {
@@ -43765,12 +43765,12 @@ var require_lib2 = __commonJS({
                 body = body.pipe(zlib.createInflateRaw());
               }
               response = new Response(body, response_options);
-              resolve7(response);
+              resolve8(response);
             });
             raw.on("end", function() {
               if (!response) {
                 response = new Response(body, response_options);
-                resolve7(response);
+                resolve8(response);
               }
             });
             return;
@@ -43778,11 +43778,11 @@ var require_lib2 = __commonJS({
           if (codings == "br" && typeof zlib.createBrotliDecompress === "function") {
             body = body.pipe(zlib.createBrotliDecompress());
             response = new Response(body, response_options);
-            resolve7(response);
+            resolve8(response);
             return;
           }
           response = new Response(body, response_options);
-          resolve7(response);
+          resolve8(response);
         });
         writeToStream(req, request);
       });
@@ -44141,8 +44141,8 @@ var require_retry = __commonJS({
       }
       const delay = getNextRetryDelay(config);
       err.config.retryConfig.currentRetryAttempt += 1;
-      const backoff2 = config.retryBackoff ? config.retryBackoff(err, delay) : new Promise((resolve7) => {
-        setTimeout(resolve7, delay);
+      const backoff2 = config.retryBackoff ? config.retryBackoff(err, delay) : new Promise((resolve8) => {
+        setTimeout(resolve8, delay);
       });
       if (config.onRetryAttempt) {
         config.onRetryAttempt(err);
@@ -44624,8 +44624,8 @@ var require_helpers = __commonJS({
     function req(url, opts = {}) {
       const href = typeof url === "string" ? url : url.href;
       const req2 = (href.startsWith("https:") ? https : http).request(url, opts);
-      const promise = new Promise((resolve7, reject) => {
-        req2.once("response", resolve7).once("error", reject).end();
+      const promise = new Promise((resolve8, reject) => {
+        req2.once("response", resolve8).once("error", reject).end();
       });
       req2.then = promise.then.bind(promise);
       return req2;
@@ -44802,7 +44802,7 @@ var require_parse_proxy_response = __commonJS({
     var debug_1 = __importDefault(require_src3());
     var debug = (0, debug_1.default)("https-proxy-agent:parse-proxy-response");
     function parseProxyResponse(socket) {
-      return new Promise((resolve7, reject) => {
+      return new Promise((resolve8, reject) => {
         let buffersLength = 0;
         const buffers = [];
         function read() {
@@ -44868,7 +44868,7 @@ var require_parse_proxy_response = __commonJS({
           }
           debug("got proxy server response: %o %o", firstLine, headers);
           cleanup();
-          resolve7({
+          resolve8({
             connect: {
               statusCode,
               statusText,
@@ -45169,11 +45169,11 @@ var require_gaxios = __commonJS({
           if (!opts.validateStatus(translatedResponse.status)) {
             if (opts.responseType === "stream") {
               let response = "";
-              await new Promise((resolve7) => {
+              await new Promise((resolve8) => {
                 (translatedResponse === null || translatedResponse === void 0 ? void 0 : translatedResponse.data).on("data", (chunk) => {
                   response += chunk;
                 });
-                (translatedResponse === null || translatedResponse === void 0 ? void 0 : translatedResponse.data).on("end", resolve7);
+                (translatedResponse === null || translatedResponse === void 0 ? void 0 : translatedResponse.data).on("end", resolve8);
               });
               translatedResponse.data = response;
             }
@@ -48246,7 +48246,7 @@ var require_AzureVmDetector = __commonJS({
             Metadata: "True"
           }
         };
-        const metadata = await new Promise((resolve7, reject) => {
+        const metadata = await new Promise((resolve8, reject) => {
           const timeoutId = setTimeout(() => {
             req.destroy();
             reject(new Error("Azure metadata service request timed out."));
@@ -48260,7 +48260,7 @@ var require_AzureVmDetector = __commonJS({
             res.on("end", () => {
               if (statusCode && statusCode >= 200 && statusCode < 300) {
                 try {
-                  resolve7(JSON.parse(rawData));
+                  resolve8(JSON.parse(rawData));
                 } catch (error) {
                   reject(error);
                 }
@@ -50288,7 +50288,7 @@ for cloud deployments. Credentials are stored globally per API URL.`,
     ]
   },
   admin: {
-    description: "Administrative commands for user and identity management.",
+    description: "Administrative commands for user, identity, and platform operations.",
     usage: "eve admin <subcommand> [options]",
     subcommands: {
       invite: {
@@ -50304,11 +50304,24 @@ for cloud deployments. Credentials are stored globally per API URL.`,
           "eve admin invite --email user@example.com --github octocat",
           "eve admin invite --email user@example.com --github octocat --role admin --org org_xxx"
         ]
+      },
+      "ingress-aliases": {
+        description: "Inspect and reclaim ingress alias claims (system admin)",
+        usage: "eve admin ingress-aliases <list|reclaim> [options]",
+        options: [
+          "list options: --alias <name> --project <id> --environment <id|null> --limit <n> --offset <n>",
+          'reclaim usage: eve admin ingress-aliases reclaim <alias> --reason "<text>"'
+        ],
+        examples: [
+          "eve admin ingress-aliases list --project proj_xxx",
+          'eve admin ingress-aliases reclaim eve-pm --reason "Reserved org rename"'
+        ]
       }
     },
     examples: [
       "eve admin invite --email user@example.com --github octocat",
-      "eve admin invite --email user@example.com --github octocat --org org_xxx"
+      "eve admin invite --email user@example.com --github octocat --org org_xxx",
+      "eve admin ingress-aliases list"
     ]
   },
   release: {
@@ -50468,6 +50481,95 @@ eve-new-project-setup skill to complete configuration.`,
       "eve init my-app --template https://github.com/myorg/custom-starter"
     ]
   },
+  local: {
+    description: `Local development environment management.
+
+Manages a local k3d Kubernetes cluster running the Eve platform.
+Requires Docker Desktop; k3d and kubectl are auto-managed by the CLI.`,
+    usage: "eve local <up|down|status|reset|logs|health> [options]",
+    subcommands: {
+      up: {
+        description: "Create/prepare local cluster and deploy Eve services",
+        usage: "eve local up [--skip-deploy] [--skip-health] [--timeout <seconds>] [--version <tag>] [--verbose]",
+        options: [
+          "--skip-deploy       Create cluster only, skip deploy step",
+          "--skip-health       Skip waiting for API health",
+          "--timeout <sec>     Health wait timeout in seconds (default: 300)",
+          "--version <tag>     Platform image version (default: latest)",
+          "--verbose           Print detailed command output"
+        ],
+        examples: [
+          "eve local up",
+          "eve local up --version 0.1.70",
+          "eve local up --skip-deploy",
+          "eve local up --timeout 600"
+        ]
+      },
+      down: {
+        description: "Stop local stack resources, or destroy cluster entirely",
+        usage: "eve local down [--destroy] [--force]",
+        options: [
+          "--destroy           Delete k3d cluster and persistent data",
+          "--force             Skip confirmation prompts"
+        ],
+        examples: [
+          "eve local down",
+          "eve local down --destroy --force"
+        ]
+      },
+      status: {
+        description: "Show cluster state, service readiness, and URLs",
+        usage: "eve local status [--watch] [--json]",
+        options: [
+          "--watch             Refresh every 5 seconds",
+          "--json              Machine-readable JSON output"
+        ],
+        examples: [
+          "eve local status",
+          "eve local status --watch",
+          "eve local status --json"
+        ]
+      },
+      reset: {
+        description: "Destroy and recreate local stack",
+        usage: "eve local reset [--force]",
+        options: [
+          "--force             Skip confirmation prompts"
+        ],
+        examples: [
+          "eve local reset --force"
+        ]
+      },
+      logs: {
+        description: "Stream or dump logs from local stack services",
+        usage: "eve local logs [service] [--follow] [--tail <n>] [--since <duration>]",
+        options: [
+          "[service]           api|orchestrator|worker|gateway|agent-runtime|auth|postgres|mailpit|sso",
+          "--follow            Follow logs in real time",
+          "--tail <n>          Show last n lines (default: 50)",
+          "--since <duration>  Show logs since duration (for example: 5m, 1h)"
+        ],
+        examples: [
+          "eve local logs",
+          "eve local logs api --follow",
+          "eve local logs worker --tail 200"
+        ]
+      },
+      health: {
+        description: "Quick health check (exit code 0 when healthy)",
+        usage: "eve local health [--json]",
+        examples: [
+          "eve local health",
+          "eve local health --json"
+        ]
+      }
+    },
+    examples: [
+      "eve local up",
+      "eve local status --json",
+      "eve local down --destroy --force"
+    ]
+  },
   system: {
     description: "System administration and health checks (admin scope required for most commands).",
     usage: "eve system <subcommand> [options]",
@@ -51205,6 +51307,7 @@ function showMainHelp() {
   console.log("  org        Manage organizations");
   console.log("  project    Manage projects");
   console.log("  manifest   Validate manifests (schema, secrets)");
+  console.log("  local      Manage local k3d stack lifecycle and diagnostics");
   console.log("  job        Manage jobs (create, list, show, update, claim, etc.)");
   console.log("  env        Manage environments (list, show, deploy)");
   console.log("  build      Manage builds (create, run, logs, artifacts)");
@@ -51231,7 +51334,7 @@ function showMainHelp() {
   console.log("  analytics  Org analytics (jobs, pipelines, env health)");
   console.log("  ollama     Manage inference targets, aliases, and model routes");
   console.log("  access     Access control: permissions, roles, bindings, policy-as-code sync");
-  console.log("  admin      User and identity management (invite)");
+  console.log("  admin      User and platform admin operations");
   console.log("  skills     Install skills from skills.txt (skills CLI)");
   console.log("  migrate    Migration helpers for upgrading config formats");
   console.log("  system     System health and status checks");
@@ -52026,7 +52129,12 @@ async function fetchProfileStatus(ctx, envFilter) {
     let services = [];
     try {
       const diagnose = await requestJson(ctx, `/projects/${ctx.projectId}/envs/${env.name}/diagnose`);
-      services = buildStatusServices(diagnose.pods, diagnose.namespace ?? env.namespace, domain);
+      services = buildStatusServices(
+        diagnose.pods,
+        diagnose.namespace ?? env.namespace,
+        domain,
+        env.ingress_aliases ?? []
+      );
     } catch {
     }
     environments.push({
@@ -52045,7 +52153,7 @@ async function fetchProfileStatus(ctx, envFilter) {
     environments
   };
 }
-function buildStatusServices(pods, namespace, domain) {
+function buildStatusServices(pods, namespace, domain, ingressAliases) {
   const services = /* @__PURE__ */ new Map();
   for (const pod of pods) {
     const component = pod.labels["eve.component"] || pod.labels["app.kubernetes.io/name"] || pod.labels["app"] || pod.labels["component"] || "unknown";
@@ -52059,12 +52167,14 @@ function buildStatusServices(pods, namespace, domain) {
     const allDone = info.phases.size > 0 && [...info.phases].every((p) => p === "Succeeded" || p === "Failed");
     const status = allDone ? "completed" : info.ready === info.total ? "ready" : "not-ready";
     const url = !allDone && namespace && domain ? buildServiceUrl(name, namespace, domain) : null;
+    const aliasUrls = !allDone && domain ? ingressAliases.filter((entry) => entry.service_name === name).map((entry) => buildAliasUrl(entry.alias, domain)).sort((a, b2) => a.localeCompare(b2)) : [];
     return {
       name,
       pods_ready: info.ready,
       pods_total: info.total,
       status,
-      url
+      url,
+      alias_urls: aliasUrls
     };
   });
 }
@@ -52083,6 +52193,10 @@ function buildServiceUrl(component, namespace, domain) {
   const secure = !domain.includes("lvh.me") && !domain.includes("localhost");
   return `${secure ? "https" : "http"}://${component}.${slug}.${domain}`;
 }
+function buildAliasUrl(alias, domain) {
+  const secure = !domain.includes("lvh.me") && !domain.includes("localhost");
+  return `${secure ? "https" : "http"}://${alias}.${domain}`;
+}
 function formatStatusOutput(results) {
   for (let i = 0; i < results.length; i++) {
     const r = results[i];
@@ -52121,10 +52235,25 @@ function formatStatusOutput(results) {
       const podsW = Math.max(...env.services.map((s) => `${s.pods_ready}/${s.pods_total}`.length));
       for (const svc of env.services) {
         const pods = `${svc.pods_ready}/${svc.pods_total}`;
-        const urlPart = svc.url ? `  ${svc.url}` : "";
+        const urls = [];
+        if (svc.url) {
+          urls.push(svc.url);
+        }
+        for (const aliasUrl of svc.alias_urls ?? []) {
+          if (!urls.includes(aliasUrl)) {
+            urls.push(aliasUrl);
+          }
+        }
+        const urlPart = urls.length > 0 ? `  ${urls[0]}` : "";
         console.log(
           `    ${padRight(svc.name, nameW)}  ${padRight(pods, podsW)}  ${padRight(svc.status, 9)}${urlPart}`
         );
+        if (urls.length > 1) {
+          const prefix = `    ${padRight("", nameW)}  ${padRight("", podsW)}  ${padRight("", 9)}`;
+          for (const aliasUrl of urls.slice(1)) {
+            console.log(`${prefix}  ${aliasUrl}`);
+          }
+        }
       }
     }
   }
@@ -56641,6 +56770,10 @@ var EnvironmentResponseSchema = external_exports.object({
   labels: EnvironmentLabelsSchema.nullable(),
   current_release_id: external_exports.string().nullable(),
   last_failed_release_id: external_exports.string().nullable(),
+  ingress_aliases: external_exports.array(external_exports.object({
+    alias: external_exports.string(),
+    service_name: external_exports.string()
+  })).optional(),
   status: EnvironmentStatusSchema,
   suspended_at: external_exports.string().nullable(),
   suspension_reason: external_exports.string().nullable(),
@@ -58019,9 +58152,15 @@ var ManagedDbConfigSchema = external_exports.object({
   engine_version: external_exports.string().optional()
   // e.g., '16'
 });
+var IngressAliasPattern = /^[a-z][a-z0-9-]*[a-z0-9]$/;
+var IngressConfigSchema = external_exports.object({
+  public: external_exports.boolean().optional(),
+  port: external_exports.number().optional(),
+  alias: external_exports.string().min(3).max(63).regex(IngressAliasPattern).optional()
+}).passthrough();
 var ServiceXeveSchema = external_exports.object({
   role: external_exports.string().optional(),
-  ingress: external_exports.record(external_exports.unknown()).optional(),
+  ingress: IngressConfigSchema.optional(),
   api_spec: ApiSpecSchema.optional(),
   api_specs: external_exports.array(ApiSpecSchema).optional(),
   external: external_exports.boolean().optional(),
@@ -63767,7 +63906,7 @@ async function handleWatch(positionals, flags, context2) {
   let jobCompleted = false;
   const statusPollingPromise = (async () => {
     while (!jobCompleted && !streamEnded) {
-      await new Promise((resolve7) => setTimeout(resolve7, 3e3));
+      await new Promise((resolve8) => setTimeout(resolve8, 3e3));
       if (jobCompleted || streamEnded) break;
       const elapsed = Math.round((Date.now() - startTime) / 1e3);
       if (elapsed >= maxTimeout) {
@@ -64242,15 +64381,15 @@ async function handleRunnerLogs(positionals, flags, context2) {
   const kubectl = (0, import_child_process.spawn)("kubectl", kubectlArgs, {
     stdio: "inherit"
   });
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     kubectl.on("error", (error) => {
       reject(new Error(`Failed to execute kubectl: ${error.message}`));
     });
     kubectl.on("exit", (code) => {
       if (code === 0) {
-        resolve7();
+        resolve8();
       } else {
-        resolve7();
+        resolve8();
       }
     });
   });
@@ -65309,7 +65448,7 @@ Poll with: eve auth request-access --status ${requestData.id}`);
       const POLL_INTERVAL_MS = 5e3;
       let current = requestData;
       while (current.status === "pending") {
-        await new Promise((resolve7) => setTimeout(resolve7, POLL_INTERVAL_MS));
+        await new Promise((resolve8) => setTimeout(resolve8, POLL_INTERVAL_MS));
         const pollResponse = await requestRaw(context2, `/auth/request-access/${current.id}`, {
           allowError: true,
           tokenOverride: ""
@@ -65547,8 +65686,8 @@ async function offerGitHubKeyRegistration(context2, email) {
     }
     console.log(`
 Found ${keys.length} SSH key(s) for github.com/${username.trim()}`);
-    const confirm = await rl.question("Register them? [Y/n]: ");
-    if (confirm.toLowerCase() === "n" || confirm.toLowerCase() === "no") {
+    const confirm2 = await rl.question("Register them? [Y/n]: ");
+    if (confirm2.toLowerCase() === "n" || confirm2.toLowerCase() === "no") {
       return false;
     }
     let registered = 0;
@@ -67389,6 +67528,12 @@ function formatEnvironmentDetails(env, health) {
   console.log(`  Database Ref:    ${env.db_ref || "(none)"}`);
   console.log(`  Current Release: ${env.current_release_id || "(none)"}`);
   console.log(`  Last Failed:     ${env.last_failed_release_id || "(none)"}`);
+  if (env.ingress_aliases && env.ingress_aliases.length > 0) {
+    console.log("  Ingress Aliases:");
+    for (const entry of env.ingress_aliases) {
+      console.log(`    ${entry.alias} -> ${entry.service_name}`);
+    }
+  }
   if (health) {
     console.log("");
     console.log(`  Deployment Status: ${health.status}`);
@@ -67628,7 +67773,7 @@ async function watchPipelineRun(context2, projectId, pipelineName, runId, timeou
       }
       return detail.run.status;
     }
-    await new Promise((resolve7) => setTimeout(resolve7, pollIntervalMs));
+    await new Promise((resolve8) => setTimeout(resolve8, pollIntervalMs));
   }
   console.log(`  Pipeline run did not complete within ${timeoutSeconds}s.`);
   console.log(`  Run "eve pipeline show-run ${pipelineName} ${runId}" to check status.`);
@@ -67651,7 +67796,7 @@ async function watchDeploymentStatus(context2, projectId, envName, timeoutSecond
       console.log("  Deployment is ready.");
       return;
     }
-    await new Promise((resolve7) => setTimeout(resolve7, pollIntervalMs));
+    await new Promise((resolve8) => setTimeout(resolve8, pollIntervalMs));
   }
   console.log(`  Timeout after ${timeoutSeconds}s. Run "eve env diagnose ${projectId} ${envName}" for details.`);
 }
@@ -67747,41 +67892,41 @@ function formatPipelineRunList(runs) {
   console.log("");
   console.log("Run ID".padEnd(30) + "Pipeline".padEnd(20) + "Status".padEnd(20) + "Created");
   console.log("-".repeat(100));
-  for (const run of runs) {
-    const runId = run.id.padEnd(30);
-    const pipeline = run.pipeline_name.padEnd(20);
-    const status = run.status.padEnd(20);
-    const created = new Date(run.created_at).toLocaleString();
+  for (const run2 of runs) {
+    const runId = run2.id.padEnd(30);
+    const pipeline = run2.pipeline_name.padEnd(20);
+    const status = run2.status.padEnd(20);
+    const created = new Date(run2.created_at).toLocaleString();
     console.log(`${runId}${pipeline}${status}${created}`);
   }
   console.log("");
   console.log(`Total: ${runs.length} runs`);
 }
 function formatPipelineRunDetail(detail) {
-  const { run, steps } = detail;
-  console.log(`Run ID: ${run.id}`);
-  console.log(`Pipeline: ${run.pipeline_name}`);
-  console.log(`Status: ${run.status}`);
-  if (run.env_name) {
-    console.log(`Environment: ${run.env_name}`);
-  }
-  if (run.git_sha) {
-    console.log(`Git SHA: ${run.git_sha}`);
-  }
-  if ("step_outputs" in run && run.step_outputs) {
-    const deployOutput = run.step_outputs.deploy;
+  const { run: run2, steps } = detail;
+  console.log(`Run ID: ${run2.id}`);
+  console.log(`Pipeline: ${run2.pipeline_name}`);
+  console.log(`Status: ${run2.status}`);
+  if (run2.env_name) {
+    console.log(`Environment: ${run2.env_name}`);
+  }
+  if (run2.git_sha) {
+    console.log(`Git SHA: ${run2.git_sha}`);
+  }
+  if ("step_outputs" in run2 && run2.step_outputs) {
+    const deployOutput = run2.step_outputs.deploy;
     if (deployOutput?.preview_url) {
       console.log(`Preview: ${deployOutput.preview_url}`);
     }
   }
-  if (run.started_at) {
-    console.log(`Started: ${run.started_at}`);
+  if (run2.started_at) {
+    console.log(`Started: ${run2.started_at}`);
   }
-  if (run.completed_at) {
-    console.log(`Completed: ${run.completed_at}`);
+  if (run2.completed_at) {
+    console.log(`Completed: ${run2.completed_at}`);
   }
-  if (run.error_message) {
-    console.log(`Error: ${run.error_message}`);
+  if (run2.error_message) {
+    console.log(`Error: ${run2.error_message}`);
   }
   console.log("");
   console.log("Steps:");
@@ -69108,9 +69253,9 @@ var originError = /* @__PURE__ */ Symbol("OriginError");
 var CLOSE = {};
 var Query = class extends Promise {
   constructor(strings, args, handler, canceller, options = {}) {
-    let resolve7, reject;
+    let resolve8, reject;
     super((a, b2) => {
-      resolve7 = a;
+      resolve8 = a;
       reject = b2;
     });
     this.tagged = Array.isArray(strings.raw);
@@ -69121,7 +69266,7 @@ var Query = class extends Promise {
     this.options = options;
     this.state = null;
     this.statement = null;
-    this.resolve = (x) => (this.active = false, resolve7(x));
+    this.resolve = (x) => (this.active = false, resolve8(x));
     this.reject = (x) => (this.active = false, reject(x));
     this.active = false;
     this.cancelled = null;
@@ -69169,12 +69314,12 @@ var Query = class extends Promise {
           if (this.executed && !this.active)
             return { done: true };
           prev && prev();
-          const promise = new Promise((resolve7, reject) => {
+          const promise = new Promise((resolve8, reject) => {
             this.cursorFn = (value) => {
-              resolve7({ value, done: false });
+              resolve8({ value, done: false });
               return new Promise((r) => prev = r);
             };
-            this.resolve = () => (this.active = false, resolve7({ done: true }));
+            this.resolve = () => (this.active = false, resolve8({ done: true }));
             this.reject = (x) => (this.active = false, reject(x));
           });
           this.execute();
@@ -69801,12 +69946,12 @@ function Connection(options, queues = {}, { onopen = noop, onend = noop, onclose
     x.on("drain", drain);
     return x;
   }
-  async function cancel({ pid, secret }, resolve7, reject) {
+  async function cancel({ pid, secret }, resolve8, reject) {
     try {
       cancelMessage = bytes_default().i32(16).i32(80877102).i32(pid).i32(secret).end(16);
       await connect();
       socket.once("error", reject);
-      socket.once("close", resolve7);
+      socket.once("close", resolve8);
     } catch (error2) {
       reject(error2);
     }
@@ -70753,7 +70898,7 @@ function parseEvent(x) {
 // ../../node_modules/.pnpm/postgres@3.4.8/node_modules/postgres/src/large.js
 var import_stream2 = __toESM(require("stream"), 1);
 function largeObject(sql, oid, mode = 131072 | 262144) {
-  return new Promise(async (resolve7, reject) => {
+  return new Promise(async (resolve8, reject) => {
     await sql.begin(async (sql2) => {
       let finish;
       !oid && ([{ oid }] = await sql2`select lo_creat(-1) as oid`);
@@ -70779,7 +70924,7 @@ function largeObject(sql, oid, mode = 131072 | 262144) {
           ) seek
         `
       };
-      resolve7(lo);
+      resolve8(lo);
       return new Promise(async (r) => finish = r);
       async function readable({
         highWaterMark = 2048 * 8,
@@ -70953,8 +71098,8 @@ function Postgres(a, b2) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c = open.length ? open.shift() : await new Promise((resolve7, reject) => {
-      const query = { reserve: resolve7, reject };
+    const c = open.length ? open.shift() : await new Promise((resolve8, reject) => {
+      const query = { reserve: resolve8, reject };
       queries.push(query);
       closed.length && connect(closed.shift(), query);
     });
@@ -70991,9 +71136,9 @@ function Postgres(a, b2) {
       let uncaughtError, result;
       name && await sql2`savepoint ${sql2(name)}`;
       try {
-        result = await new Promise((resolve7, reject) => {
+        result = await new Promise((resolve8, reject) => {
           const x = fn2(sql2);
-          Promise.resolve(Array.isArray(x) ? Promise.all(x) : x).then(resolve7, reject);
+          Promise.resolve(Array.isArray(x) ? Promise.all(x) : x).then(resolve8, reject);
         });
         if (uncaughtError)
           throw uncaughtError;
@@ -71050,8 +71195,8 @@ function Postgres(a, b2) {
     return c.execute(query) ? move(c, busy) : move(c, full);
   }
   function cancel(query) {
-    return new Promise((resolve7, reject) => {
-      query.state ? query.active ? connection_default(options).cancel(query.state, resolve7, reject) : query.cancelled = { resolve: resolve7, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve7());
+    return new Promise((resolve8, reject) => {
+      query.state ? query.active ? connection_default(options).cancel(query.state, resolve8, reject) : query.cancelled = { resolve: resolve8, reject } : (queries.remove(query), query.cancelled = true, query.reject(Errors.generic("57014", "canceling statement due to user request")), resolve8());
     });
   }
   async function end({ timeout = null } = {}) {
@@ -71070,11 +71215,11 @@ function Postgres(a, b2) {
   async function close() {
     await Promise.all(connections.map((c) => c.end()));
   }
-  async function destroy(resolve7) {
+  async function destroy(resolve8) {
     await Promise.all(connections.map((c) => c.terminate()));
     while (queries.length)
       queries.shift().reject(Errors.connection("CONNECTION_DESTROYED", options));
-    resolve7();
+    resolve8();
   }
   function connect(c, query) {
     move(c, connecting);
@@ -72945,6 +73090,61 @@ ${response.length} record(s)`);
           throw new Error("Usage: eve admin usage <list|summary> --org <orgId> [--since] [--until] [--limit] [--json]");
       }
     }
+    case "ingress-aliases": {
+      const action = positionals[0] ?? "list";
+      switch (action) {
+        case "list": {
+          const params = new URLSearchParams();
+          const alias = getStringFlag(flags, ["alias"]);
+          const projectId = getStringFlag(flags, ["project", "project_id"]);
+          const environmentId = getStringFlag(flags, ["environment", "env", "environment_id"]);
+          const limit = getStringFlag(flags, ["limit"]);
+          const offset = getStringFlag(flags, ["offset"]);
+          if (alias) params.set("alias", alias);
+          if (projectId) params.set("project_id", projectId);
+          if (environmentId) params.set("environment_id", environmentId);
+          if (limit) params.set("limit", limit);
+          if (offset) params.set("offset", offset);
+          const query = params.toString();
+          const path6 = `/admin/ingress-aliases${query ? `?${query}` : ""}`;
+          const response = await requestJson(context2, path6);
+          if (json) {
+            outputJson(response, true);
+            return;
+          }
+          const rows = Array.isArray(response.data) ? response.data : [];
+          if (rows.length === 0) {
+            console.log("No ingress aliases found.");
+            return;
+          }
+          for (const row of rows) {
+            console.log(`${row.alias}  project=${row.project_id}  env=${row.environment_id ?? "(reserved)"}  service=${row.service_name}`);
+          }
+          console.log(`
+${rows.length} alias(es)`);
+          return;
+        }
+        case "reclaim": {
+          const alias = positionals[1] ?? getStringFlag(flags, ["alias"]);
+          const reason = getStringFlag(flags, ["reason"]);
+          if (!alias || !reason) {
+            throw new Error('Usage: eve admin ingress-aliases reclaim <alias> --reason "<text>"');
+          }
+          const response = await requestJson(context2, `/admin/ingress-aliases/${encodeURIComponent(alias)}/reclaim`, {
+            method: "POST",
+            body: { reason }
+          });
+          outputJson(
+            response,
+            json,
+            `+ Reclaimed ${response.alias} (project=${response.project_id}, env=${response.environment_id ?? "(reserved)"})`
+          );
+          return;
+        }
+        default:
+          throw new Error("Usage: eve admin ingress-aliases <list|reclaim> [options]");
+      }
+    }
     case "access-requests": {
       const action = positionals[0];
       switch (action) {
@@ -73007,7 +73207,7 @@ ${response.length} record(s)`);
       }
     }
     default:
-      throw new Error("Usage: eve admin <invite|pricing|receipts|balance|usage|access-requests>");
+      throw new Error("Usage: eve admin <invite|pricing|receipts|balance|usage|ingress-aliases|access-requests>");
   }
 }
 function formatBalanceSummary(data) {
@@ -74147,20 +74347,20 @@ async function handleRun3(positionals, flags, context2, json) {
   if (!buildId) {
     throw new Error("Usage: eve build run <build_id>");
   }
-  const run = await requestJson(
+  const run2 = await requestJson(
     context2,
     `/builds/${buildId}/runs`,
     { method: "POST" }
   );
   if (json) {
-    outputJson(run, json);
+    outputJson(run2, json);
     return;
   }
-  console.log(`Build run started: ${run.id}`);
-  console.log(`  Build:   ${run.build_id}`);
-  console.log(`  Status:  ${run.status}`);
-  if (run.backend) {
-    console.log(`  Backend: ${run.backend}`);
+  console.log(`Build run started: ${run2.id}`);
+  console.log(`  Build:   ${run2.build_id}`);
+  console.log(`  Status:  ${run2.status}`);
+  if (run2.backend) {
+    console.log(`  Backend: ${run2.backend}`);
   }
 }
 async function handleRuns2(positionals, flags, context2, json) {
@@ -74373,17 +74573,17 @@ function formatBuildDetail(build) {
 function formatRunList(runs) {
   console.log("Run ID".padEnd(30) + "Status".padEnd(15) + "Backend".padEnd(15) + "Started");
   console.log("-".repeat(80));
-  for (const run of runs) {
-    const id = run.id.padEnd(30);
-    const status = run.status.padEnd(15);
-    const backend = (run.backend ?? "-").padEnd(15);
-    const started = run.started_at ? new Date(run.started_at).toLocaleString() : "-";
+  for (const run2 of runs) {
+    const id = run2.id.padEnd(30);
+    const status = run2.status.padEnd(15);
+    const backend = (run2.backend ?? "-").padEnd(15);
+    const started = run2.started_at ? new Date(run2.started_at).toLocaleString() : "-";
     console.log(`${id}${status}${backend}${started}`);
-    if (run.error_message) {
-      console.log(`  Error: ${run.error_message}`);
+    if (run2.error_message) {
+      console.log(`  Error: ${run2.error_message}`);
     }
-    if (run.error_code) {
-      const info = getErrorCodeInfo2(run.error_code);
+    if (run2.error_code) {
+      const info = getErrorCodeInfo2(run2.error_code);
       console.log(`  Error Type: ${info.label}`);
       console.log(`  Hint:       ${info.hint}`);
     }
@@ -74779,7 +74979,7 @@ async function handleThread(subcommand, positionals, flags, context2) {
           const message = err instanceof Error ? err.message : String(err);
           console.error(`Poll error: ${message}`);
         }
-        await new Promise((resolve7) => setTimeout(resolve7, pollInterval));
+        await new Promise((resolve8) => setTimeout(resolve8, pollInterval));
       }
     }
     case "distill": {
@@ -78445,6 +78645,1079 @@ async function handleFs(subcommand, positionals, flags, context2) {
   }
 }
 
+// src/commands/local.ts
+var import_node_fs19 = require("node:fs");
+var import_node_crypto = require("node:crypto");
+var import_node_child_process10 = require("node:child_process");
+var import_node_os6 = require("node:os");
+var import_node_path18 = require("node:path");
+var import_promises2 = require("node:readline/promises");
+var DEFAULT_CLUSTER_NAME = "eve-local";
+var DEFAULT_KUBE_CONTEXT = "k3d-eve-local";
+var MANAGED_BIN_DIR = (0, import_node_path18.join)((0, import_node_os6.homedir)(), ".eve", "bin");
+var LOCAL_API_URL = "http://api.eve.lvh.me";
+var WATCH_INTERVAL_MS = 5e3;
+var K3D_VERSION = "v5.7.5";
+var KUBECTL_STABLE_URL = "https://dl.k8s.io/release/stable.txt";
+var LOCAL_STACK_ROOT = (0, import_node_path18.resolve)(__dirname, "..", "assets", "local-k8s");
+var LOCAL_STACK_OVERLAY = (0, import_node_path18.join)(LOCAL_STACK_ROOT, "overlays", "local");
+var LOCAL_STACK_BASE = (0, import_node_path18.join)(LOCAL_STACK_ROOT, "base");
+var SERVICE_DEFINITIONS = [
+  { id: "api", workload: "eve-api", kind: "deployment" },
+  { id: "orchestrator", workload: "eve-orchestrator", kind: "deployment" },
+  { id: "worker", workload: "eve-worker", kind: "deployment" },
+  { id: "gateway", workload: "eve-gateway", kind: "deployment" },
+  { id: "agent-runtime", workload: "eve-agent-runtime", kind: "statefulset" },
+  { id: "auth", workload: "supabase-auth", kind: "deployment" },
+  { id: "mailpit", workload: "mailpit", kind: "deployment" },
+  { id: "sso", workload: "eve-sso", kind: "deployment" }
+];
+var PLATFORM_IMAGES = [
+  { component: "api", remote: "ghcr.io/eve-horizon/api", local: "eve-horizon/api:local" },
+  { component: "orchestrator", remote: "ghcr.io/eve-horizon/orchestrator", local: "eve-horizon/orchestrator:local" },
+  { component: "worker", remote: "ghcr.io/eve-horizon/worker", local: "eve-horizon/worker:local" },
+  { component: "gateway", remote: "ghcr.io/eve-horizon/gateway", local: "eve-horizon/gateway:local" },
+  { component: "agent-runtime", remote: "ghcr.io/eve-horizon/agent-runtime", local: "eve-horizon/agent-runtime:local" },
+  { component: "sso", remote: "ghcr.io/eve-horizon/sso", local: "eve-horizon/sso:local" }
+];
+var LOG_TARGETS = {
+  api: { resource: "eve-api", kind: "deployment" },
+  orchestrator: { resource: "eve-orchestrator", kind: "deployment" },
+  worker: { resource: "eve-worker", kind: "deployment" },
+  gateway: { resource: "eve-gateway", kind: "deployment" },
+  "agent-runtime": { resource: "eve-agent-runtime", kind: "statefulset" },
+  auth: { resource: "supabase-auth", kind: "deployment" },
+  postgres: { resource: "postgres", kind: "statefulset" },
+  mailpit: { resource: "mailpit", kind: "deployment" },
+  sso: { resource: "eve-sso", kind: "deployment" }
+};
+async function handleLocal(subcommand, positionals, flags, _context) {
+  const json = Boolean(flags.json);
+  switch (subcommand) {
+    case "up":
+      await handleUp(flags, json);
+      return;
+    case "down":
+      await handleDown(flags, json);
+      return;
+    case "status":
+      await handleStatus4(flags, json);
+      return;
+    case "reset":
+      await handleReset3(flags, json);
+      return;
+    case "logs":
+      handleLogs7(positionals, flags);
+      return;
+    case "health":
+      await handleHealth2(flags, json);
+      return;
+    default:
+      throw new Error("Usage: eve local <up|down|status|reset|logs|health> [options]");
+  }
+}
+async function handleUp(flags, json) {
+  const skipDeploy = getBooleanFlag(flags, ["skip-deploy"]) ?? false;
+  const skipHealth = getBooleanFlag(flags, ["skip-health"]) ?? false;
+  const verbose = getBooleanFlag(flags, ["verbose"]) ?? false;
+  const timeoutSeconds = parseTimeoutSeconds(flags, 300);
+  const requestedVersion = getStringFlag(flags, ["version"]) ?? "latest";
+  const runtimeOptions = {
+    quiet: json,
+    verbose
+  };
+  ensureTool("docker", "Install Docker Desktop.");
+  assertDockerRunning();
+  await ensureManagedTool("k3d", runtimeOptions);
+  await ensureManagedTool("kubectl", runtimeOptions);
+  assertLocalAssetsPresent();
+  await ensureClusterReady(runtimeOptions);
+  let deployedVersion = null;
+  if (!skipDeploy) {
+    deployedVersion = await resolveRequestedVersion(requestedVersion, runtimeOptions);
+    await importPlatformImages(deployedVersion, runtimeOptions);
+    applyLocalManifests(runtimeOptions);
+    waitForStatefulSetRollout("postgres", Math.max(timeoutSeconds, 180), runtimeOptions);
+    runDbMigration(Math.max(timeoutSeconds, 180), runtimeOptions);
+    generateAuthSecrets(runtimeOptions);
+    runAuthBootstrap(Math.max(timeoutSeconds, 120), runtimeOptions);
+    restartAndWaitRollouts(Math.max(timeoutSeconds, 180), runtimeOptions);
+  }
+  let api = await probeApiHealth(LOCAL_API_URL);
+  if (!skipHealth) {
+    api = await waitForApiHealth(LOCAL_API_URL, timeoutSeconds);
+  }
+  const result = {
+    cluster: DEFAULT_CLUSTER_NAME,
+    context: DEFAULT_KUBE_CONTEXT,
+    version: deployedVersion,
+    skip_deploy: skipDeploy,
+    skip_health: skipHealth,
+    api,
+    urls: {
+      api: LOCAL_API_URL,
+      auth: "http://auth.eve.lvh.me",
+      mail: "http://mail.eve.lvh.me",
+      sso: "http://sso.eve.lvh.me"
+    }
+  };
+  if (json) {
+    outputJson(result, true);
+    return;
+  }
+  console.log("");
+  console.log("Local Eve stack is ready:");
+  console.log(`  API:   ${result.urls.api}`);
+  console.log(`  Auth:  ${result.urls.auth}`);
+  console.log(`  Mail:  ${result.urls.mail}`);
+  console.log(`  SSO:   ${result.urls.sso}`);
+  console.log("");
+  console.log("Next steps:");
+  console.log(`  export EVE_API_URL=${LOCAL_API_URL}`);
+  console.log('  eve org ensure "my-org" --slug my-org');
+}
+async function handleDown(flags, json) {
+  const destroy = getBooleanFlag(flags, ["destroy"]) ?? false;
+  const force = getBooleanFlag(flags, ["force"]) ?? false;
+  if (destroy && !force) {
+    const confirmed = await confirm("Destroy local cluster and all persisted data? [y/N] ");
+    if (!confirmed) {
+      throw new Error("Aborted.");
+    }
+  }
+  const k3d = findExecutable("k3d");
+  if (!k3d) {
+    outputJson(
+      { stopped: false, reason: "k3d_missing", cluster: DEFAULT_CLUSTER_NAME },
+      json,
+      "k3d is not installed. Run 'eve local up' first."
+    );
+    return;
+  }
+  if (destroy) {
+    const cluster2 = getClusterSnapshot();
+    if (!cluster2.exists) {
+      outputJson({ destroyed: false, reason: "cluster_not_found", cluster: DEFAULT_CLUSTER_NAME }, json, "Cluster not found. Nothing to destroy.");
+      return;
+    }
+    run(k3d, ["cluster", "delete", DEFAULT_CLUSTER_NAME]);
+    outputJson({ destroyed: true, cluster: DEFAULT_CLUSTER_NAME }, json, `Destroyed cluster '${DEFAULT_CLUSTER_NAME}'.`);
+    return;
+  }
+  const cluster = getClusterSnapshot();
+  if (!cluster.exists) {
+    outputJson({ stopped: false, reason: "cluster_not_found", cluster: DEFAULT_CLUSTER_NAME }, json, "Cluster not found. Nothing to stop.");
+    return;
+  }
+  if (!cluster.running) {
+    outputJson({ stopped: true, already_stopped: true, cluster: DEFAULT_CLUSTER_NAME }, json, `Cluster '${DEFAULT_CLUSTER_NAME}' is already stopped.`);
+    return;
+  }
+  run(k3d, ["cluster", "stop", DEFAULT_CLUSTER_NAME]);
+  outputJson(
+    { stopped: true, cluster: DEFAULT_CLUSTER_NAME, context: DEFAULT_KUBE_CONTEXT },
+    json,
+    `Stopped cluster '${DEFAULT_CLUSTER_NAME}' (state preserved).`
+  );
+}
+async function handleReset3(flags, json) {
+  const force = getBooleanFlag(flags, ["force"]) ?? false;
+  if (!force) {
+    const confirmed = await confirm("Reset local stack (destroy + recreate)? [y/N] ");
+    if (!confirmed) {
+      throw new Error("Aborted.");
+    }
+  }
+  await handleDown({ ...flags, destroy: true, force: true }, false);
+  await handleUp({ ...flags, "skip-deploy": false }, false);
+  if (json) {
+    outputJson({ reset: true, cluster: DEFAULT_CLUSTER_NAME }, true);
+  }
+}
+async function handleStatus4(flags, json) {
+  const watch = getBooleanFlag(flags, ["watch"]) ?? false;
+  do {
+    const report = await collectStatus();
+    if (json) {
+      outputJson(report, true);
+    } else {
+      if (watch) {
+        process.stdout.write("\x1Bc");
+      }
+      renderStatus(report);
+    }
+    if (!watch) return;
+    await sleep(WATCH_INTERVAL_MS);
+  } while (true);
+}
+async function handleHealth2(_flags, json) {
+  const report = await collectStatus();
+  const unhealthyServices = report.services.filter((service) => !service.healthy);
+  const healthy = report.cluster.running && report.api.ok && unhealthyServices.length === 0;
+  const payload = {
+    healthy,
+    cluster: report.cluster,
+    api: report.api,
+    unhealthy_services: unhealthyServices.map((service) => service.id)
+  };
+  if (json) {
+    outputJson(payload, true);
+  } else {
+    const icon = healthy ? "OK" : "FAIL";
+    console.log(`${icon} Local stack health: ${healthy ? "healthy" : "unhealthy"}`);
+    console.log(`  Cluster: ${report.cluster.exists ? report.cluster.running ? "running" : "stopped" : "missing"}`);
+    console.log(`  API: ${report.api.ok ? `ok (${report.api.status ?? "ok"})` : `unreachable (${report.api.error ?? "unknown"})`}`);
+    if (unhealthyServices.length > 0) {
+      console.log(`  Services: unhealthy -> ${unhealthyServices.map((service) => service.id).join(", ")}`);
+    }
+  }
+  if (!healthy) {
+    process.exitCode = 1;
+  }
+}
+function handleLogs7(positionals, flags) {
+  const kubectl = findExecutable("kubectl");
+  if (!kubectl) {
+    throw new Error("kubectl is not installed. Run 'eve local up' first.");
+  }
+  const cluster = getClusterSnapshot();
+  if (!cluster.running) {
+    throw new Error(`Cluster '${DEFAULT_CLUSTER_NAME}' is not running. Start it with: eve local up`);
+  }
+  const service = positionals[0];
+  const follow = getBooleanFlag(flags, ["follow", "f"]) ?? false;
+  const tail = getStringFlag(flags, ["tail"]) ?? "50";
+  const since = getStringFlag(flags, ["since"]);
+  const args = ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "logs"];
+  if (service) {
+    const target = LOG_TARGETS[service];
+    if (!target) {
+      const names = Object.keys(LOG_TARGETS).join(", ");
+      throw new Error(`Unknown service '${service}'. Supported services: ${names}`);
+    }
+    args.push(`${target.kind}/${target.resource}`);
+  } else {
+    args.push("-l", "app.kubernetes.io/name in (eve-api,eve-orchestrator,eve-worker,eve-gateway,eve-agent-runtime,supabase-auth,eve-sso,mailpit,postgres)");
+    args.push("--all-containers=true");
+  }
+  args.push("--tail", tail);
+  if (since) {
+    args.push("--since", since);
+  }
+  if (follow) {
+    args.push("-f");
+  }
+  run(kubectl, args, { stdio: "inherit" });
+}
+async function collectStatus() {
+  const cluster = getClusterSnapshot();
+  const services = getServiceStatuses(cluster.running);
+  const api = await probeApiHealth(LOCAL_API_URL);
+  return {
+    cluster: {
+      name: DEFAULT_CLUSTER_NAME,
+      context: DEFAULT_KUBE_CONTEXT,
+      exists: cluster.exists,
+      running: cluster.running
+    },
+    services,
+    api,
+    urls: {
+      api: LOCAL_API_URL,
+      auth: "http://auth.eve.lvh.me",
+      mail: "http://mail.eve.lvh.me",
+      sso: "http://sso.eve.lvh.me"
+    }
+  };
+}
+function renderStatus(report) {
+  const healthyServices = report.services.filter((service) => service.healthy).length;
+  const totalServices = report.services.length;
+  const clusterStatus = report.cluster.exists ? report.cluster.running ? "running" : "stopped" : "missing";
+  console.log("Local Eve Environment");
+  console.log("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`Cluster:    ${report.cluster.name} (${clusterStatus})`);
+  console.log(`Context:    ${report.cluster.context}`);
+  console.log(`API Health: ${report.api.ok ? `ok (${report.api.status ?? "ok"})` : `unreachable (${report.api.error ?? "unknown"})`}`);
+  console.log("");
+  console.log(`Services (${healthyServices}/${totalServices} healthy):`);
+  for (const service of report.services) {
+    const icon = service.healthy ? "OK" : "FAIL";
+    const ready2 = `${service.ready}/${service.desired}`;
+    const name = service.id.padEnd(13);
+    const workload = `${service.kind}/${service.workload}`;
+    console.log(`  ${icon} ${name} ${ready2.padEnd(5)} ${workload}`);
+  }
+  console.log("");
+  console.log("URLs:");
+  console.log(`  API:   ${report.urls.api}`);
+  console.log(`  Auth:  ${report.urls.auth}`);
+  console.log(`  Mail:  ${report.urls.mail}`);
+  console.log(`  SSO:   ${report.urls.sso}`);
+}
+function getServiceStatuses(clusterRunning) {
+  if (!clusterRunning) {
+    return SERVICE_DEFINITIONS.map((service) => ({
+      id: service.id,
+      workload: service.workload,
+      kind: service.kind,
+      exists: false,
+      desired: 0,
+      ready: 0,
+      healthy: false
+    }));
+  }
+  const kubectl = findExecutable("kubectl");
+  if (!kubectl) {
+    return SERVICE_DEFINITIONS.map((service) => ({
+      id: service.id,
+      workload: service.workload,
+      kind: service.kind,
+      exists: false,
+      desired: 0,
+      ready: 0,
+      healthy: false
+    }));
+  }
+  const raw = run(
+    kubectl,
+    ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "get", "deployments,statefulsets", "-o", "json"],
+    { stdio: "pipe", allowFailure: true }
+  );
+  if (raw.status !== 0) {
+    return SERVICE_DEFINITIONS.map((service) => ({
+      id: service.id,
+      workload: service.workload,
+      kind: service.kind,
+      exists: false,
+      desired: 0,
+      ready: 0,
+      healthy: false
+    }));
+  }
+  let parsed = {};
+  try {
+    parsed = JSON.parse(raw.stdout);
+  } catch {
+    return SERVICE_DEFINITIONS.map((service) => ({
+      id: service.id,
+      workload: service.workload,
+      kind: service.kind,
+      exists: false,
+      desired: 0,
+      ready: 0,
+      healthy: false
+    }));
+  }
+  const deployments = /* @__PURE__ */ new Map();
+  const statefulsets = /* @__PURE__ */ new Map();
+  for (const item of parsed.items ?? []) {
+    const kind = String(item.kind ?? "").toLowerCase();
+    const metadata = item.metadata ?? {};
+    const name = String(metadata.name ?? "");
+    if (!name) continue;
+    if (kind === "deployment") {
+      deployments.set(name, item);
+    } else if (kind === "statefulset") {
+      statefulsets.set(name, item);
+    }
+  }
+  return SERVICE_DEFINITIONS.map((service) => {
+    const source = service.kind === "deployment" ? deployments.get(service.workload) : statefulsets.get(service.workload);
+    if (!source) {
+      return {
+        id: service.id,
+        workload: service.workload,
+        kind: service.kind,
+        exists: false,
+        desired: 0,
+        ready: 0,
+        healthy: false
+      };
+    }
+    const spec = source.spec ?? {};
+    const status = source.status ?? {};
+    const desired = Number(spec.replicas ?? status.replicas ?? 1);
+    const ready2 = Number(status.readyReplicas ?? 0);
+    const healthy = desired > 0 && ready2 >= desired;
+    return {
+      id: service.id,
+      workload: service.workload,
+      kind: service.kind,
+      exists: true,
+      desired: Number.isFinite(desired) ? desired : 0,
+      ready: Number.isFinite(ready2) ? ready2 : 0,
+      healthy
+    };
+  });
+}
+async function ensureManagedTool(tool, runtimeOptions) {
+  if (findExecutable(tool)) {
+    return;
+  }
+  (0, import_node_fs19.mkdirSync)(MANAGED_BIN_DIR, { recursive: true });
+  if (tool === "k3d") {
+    printProgress(runtimeOptions, `Installing k3d ${K3D_VERSION} into ${MANAGED_BIN_DIR}...`);
+    await installK3dBinary();
+  } else {
+    printProgress(runtimeOptions, `Installing kubectl into ${MANAGED_BIN_DIR}...`);
+    await installKubectlBinary();
+  }
+  if (!findExecutable(tool)) {
+    throw new Error(`Failed to install ${tool} into ${MANAGED_BIN_DIR}.`);
+  }
+}
+async function installK3dBinary() {
+  const platform2 = normalizePlatform(process.platform);
+  const arch = normalizeArch(process.arch);
+  const url = `https://github.com/k3d-io/k3d/releases/download/${K3D_VERSION}/k3d-${platform2}-${arch}`;
+  await downloadBinary(url, (0, import_node_path18.join)(MANAGED_BIN_DIR, "k3d"));
+}
+async function installKubectlBinary() {
+  const platform2 = normalizePlatform(process.platform);
+  const arch = normalizeArch(process.arch);
+  const stable = (await fetchText(KUBECTL_STABLE_URL)).trim();
+  if (!/^v\d+\.\d+\.\d+$/.test(stable)) {
+    throw new Error(`Unexpected kubectl stable release format: '${stable}'`);
+  }
+  const binaryUrl = `https://dl.k8s.io/release/${stable}/bin/${platform2}/${arch}/kubectl`;
+  const checksumUrl = `${binaryUrl}.sha256`;
+  const [binary, checksumText] = await Promise.all([
+    downloadBytes(binaryUrl),
+    fetchText(checksumUrl)
+  ]);
+  const expectedChecksum = checksumText.trim();
+  const actualChecksum = (0, import_node_crypto.createHash)("sha256").update(binary).digest("hex");
+  if (expectedChecksum !== actualChecksum) {
+    throw new Error(`kubectl checksum verification failed (expected ${expectedChecksum}, got ${actualChecksum}).`);
+  }
+  writeExecutable((0, import_node_path18.join)(MANAGED_BIN_DIR, "kubectl"), binary);
+}
+function normalizePlatform(platform2) {
+  if (platform2 === "darwin" || platform2 === "linux") {
+    return platform2;
+  }
+  throw new Error(`Unsupported platform '${platform2}'. 'eve local up' currently supports macOS and Linux.`);
+}
+function normalizeArch(arch) {
+  if (arch === "x64") return "amd64";
+  if (arch === "arm64") return "arm64";
+  throw new Error(`Unsupported CPU architecture '${arch}'.`);
+}
+async function downloadBinary(url, destination) {
+  const bytes = await downloadBytes(url);
+  writeExecutable(destination, bytes);
+}
+async function downloadBytes(url) {
+  const response = await fetch(url, {
+    headers: {
+      "User-Agent": "eve-cli-local-stack",
+      Accept: "*/*"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`Download failed (${response.status}) for ${url}`);
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  return Buffer.from(arrayBuffer);
+}
+async function fetchText(url, headers) {
+  const response = await fetch(url, {
+    headers: {
+      "User-Agent": "eve-cli-local-stack",
+      Accept: "application/json,text/plain,*/*",
+      ...headers ?? {}
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`Request failed (${response.status}) for ${url}`);
+  }
+  return response.text();
+}
+function writeExecutable(destination, bytes) {
+  const tempPath = `${destination}.tmp-${Date.now()}-${process.pid}`;
+  (0, import_node_fs19.writeFileSync)(tempPath, bytes);
+  (0, import_node_fs19.chmodSync)(tempPath, 493);
+  (0, import_node_fs19.renameSync)(tempPath, destination);
+}
+async function ensureClusterReady(runtimeOptions) {
+  const k3d = requireToolPath("k3d", "Run 'eve local up' again to auto-install managed tools.");
+  const cluster = getClusterSnapshot();
+  if (!cluster.exists) {
+    printProgress(runtimeOptions, `Creating cluster '${DEFAULT_CLUSTER_NAME}'...`);
+    run(
+      k3d,
+      [
+        "cluster",
+        "create",
+        DEFAULT_CLUSTER_NAME,
+        "--api-port",
+        "127.0.0.1:6443",
+        "-p",
+        "80:80@loadbalancer",
+        "-p",
+        "443:443@loadbalancer"
+      ],
+      { stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe" }
+    );
+  } else if (!cluster.running) {
+    printProgress(runtimeOptions, `Starting cluster '${DEFAULT_CLUSTER_NAME}'...`);
+    run(k3d, ["cluster", "start", DEFAULT_CLUSTER_NAME], {
+      stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe"
+    });
+  } else {
+    printProgress(runtimeOptions, `Cluster '${DEFAULT_CLUSTER_NAME}' is already running.`);
+  }
+  trySelectLocalContext();
+  await ensureClusterConnectivity(runtimeOptions);
+}
+async function ensureClusterConnectivity(runtimeOptions) {
+  const kubectl = requireToolPath("kubectl", "Run 'eve local up' again to auto-install managed tools.");
+  const maxAttempts = 3;
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    const probe = run(kubectl, ["--context", DEFAULT_KUBE_CONTEXT, "get", "nodes"], {
+      stdio: "pipe",
+      allowFailure: true
+    });
+    if (probe.status === 0) {
+      return;
+    }
+    const errorText = `${probe.stderr}
+${probe.stdout}`;
+    if (!errorText.includes("EOF")) {
+      throw new Error(`Cannot connect to local cluster: ${probe.stderr.trim() || probe.stdout.trim()}`);
+    }
+    printProgress(runtimeOptions, `Cluster API returned EOF (attempt ${attempt}/${maxAttempts}); restarting load balancer...`);
+    run("docker", [`restart`, `k3d-${DEFAULT_CLUSTER_NAME}-serverlb`], { allowFailure: true, stdio: "pipe" });
+    await sleep(2e3);
+  }
+  throw new Error(`Failed to connect to cluster '${DEFAULT_CLUSTER_NAME}' after retrying load balancer restart.`);
+}
+async function resolveRequestedVersion(requestedVersion, runtimeOptions) {
+  if (requestedVersion === "latest") {
+    const version2 = await resolveLatestPlatformVersion();
+    printProgress(runtimeOptions, `Resolved platform version: ${version2}`);
+    return version2;
+  }
+  const normalized = normalizeVersion(requestedVersion);
+  if (!normalized) {
+    throw new Error(`Invalid --version value '${requestedVersion}'. Use a semantic version like '0.1.50' or 'latest'.`);
+  }
+  return normalized;
+}
+async function resolveLatestPlatformVersion() {
+  const semverSets = await Promise.all(
+    PLATFORM_IMAGES.map(async (image) => {
+      const tags = await fetchRegistryTags(image.remote);
+      return new Set(
+        tags.map((tag) => normalizeVersion(tag)).filter((value) => Boolean(value))
+      );
+    })
+  );
+  if (semverSets.length === 0) {
+    throw new Error("No platform images configured for local stack deployment.");
+  }
+  let intersection = new Set(semverSets[0]);
+  for (const set of semverSets.slice(1)) {
+    intersection = new Set(Array.from(intersection).filter((version2) => set.has(version2)));
+  }
+  const candidates = Array.from(intersection);
+  if (candidates.length === 0) {
+    throw new Error(
+      "Unable to resolve a common platform version from GHCR tags. Re-run with --version <x.y.z>."
+    );
+  }
+  candidates.sort(compareSemverDesc);
+  return candidates[0];
+}
+async function fetchRegistryTags(imageRef) {
+  const repository = imageRef.replace(/^ghcr\.io\//, "");
+  const tokenPayload = await fetchText(`https://ghcr.io/token?scope=repository:${repository}:pull`);
+  const token = JSON.parse(tokenPayload).token;
+  if (!token) {
+    throw new Error(`Unable to fetch GHCR token for ${imageRef}.`);
+  }
+  const tagsPayload = await fetchText(
+    `https://ghcr.io/v2/${repository}/tags/list?n=200`,
+    { Authorization: `Bearer ${token}` }
+  );
+  return JSON.parse(tagsPayload).tags ?? [];
+}
+function normalizeVersion(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  let candidate = trimmed;
+  if (candidate.startsWith("release-v")) {
+    candidate = candidate.slice("release-v".length);
+  } else if (candidate.startsWith("v")) {
+    candidate = candidate.slice(1);
+  }
+  return /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : null;
+}
+function compareSemverDesc(a, b2) {
+  const pa = a.split(".").map((part) => Number.parseInt(part, 10));
+  const pb = b2.split(".").map((part) => Number.parseInt(part, 10));
+  for (let i = 0; i < 3; i += 1) {
+    const diff = (pb[i] ?? 0) - (pa[i] ?? 0);
+    if (diff !== 0) {
+      return diff;
+    }
+  }
+  return 0;
+}
+async function importPlatformImages(version2, runtimeOptions) {
+  const docker = requireToolPath("docker", "Install Docker Desktop.");
+  const k3d = requireToolPath("k3d", "Run 'eve local up' again to auto-install managed tools.");
+  const stdio = runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe";
+  for (const image of PLATFORM_IMAGES) {
+    const remoteTag = `${image.remote}:${version2}`;
+    printProgress(runtimeOptions, `Pulling image ${remoteTag}...`);
+    const pull = pullImageWithRetry(docker, remoteTag, stdio, runtimeOptions);
+    if (pull.status !== 0) {
+      throw new Error(
+        `Failed to pull ${remoteTag}. Ensure GHCR image visibility is public and the version exists. Try: eve local up --version <x.y.z>`
+      );
+    }
+    run(docker, ["tag", remoteTag, image.local], { stdio });
+    printProgress(runtimeOptions, `Importing image ${image.component} into k3d...`);
+    importImageViaTar(docker, k3d, image.local, image.component, stdio);
+  }
+}
+function importImageViaTar(docker, k3d, imageTag, component, stdio) {
+  const tarPath = (0, import_node_path18.join)((0, import_node_os6.tmpdir)(), `eve-local-${component}-${Date.now()}-${process.pid}.tar`);
+  try {
+    run(docker, ["image", "save", "--platform", "linux/amd64", imageTag, "-o", tarPath], { stdio });
+    run(k3d, ["image", "import", "--mode", "direct", tarPath, "-c", DEFAULT_CLUSTER_NAME], { stdio });
+  } finally {
+    if ((0, import_node_fs19.existsSync)(tarPath)) {
+      (0, import_node_fs19.unlinkSync)(tarPath);
+    }
+  }
+}
+function pullImageWithRetry(docker, remoteTag, stdio, runtimeOptions) {
+  const maxAttempts = 3;
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    const pull = run(docker, ["pull", "--platform", "linux/amd64", remoteTag], {
+      stdio,
+      allowFailure: true,
+      timeoutMs: 7 * 60 * 1e3
+    });
+    if (pull.status === 0) {
+      return pull;
+    }
+    const combined = `${pull.stderr}
+${pull.stdout}`.toLowerCase();
+    const retryable = combined.includes("unexpected eof") || combined.includes("short read") || combined.includes("i/o timeout") || combined.includes("timed out");
+    if (!retryable || attempt === maxAttempts) {
+      return pull;
+    }
+    printProgress(runtimeOptions, `Pull failed for ${remoteTag} (attempt ${attempt}/${maxAttempts}). Retrying...`);
+  }
+  return { status: 1, stdout: "", stderr: "pull retry exhausted" };
+}
+function applyLocalManifests(runtimeOptions) {
+  const kubectl = requireToolPath("kubectl", "Run 'eve local up' again to auto-install managed tools.");
+  printProgress(runtimeOptions, "Applying local Kubernetes manifests...");
+  run(
+    kubectl,
+    ["--context", DEFAULT_KUBE_CONTEXT, "apply", "-k", LOCAL_STACK_OVERLAY],
+    { stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe" }
+  );
+}
+function runDbMigration(timeoutSeconds, runtimeOptions) {
+  const kubectl = requireToolPath("kubectl", "Run 'eve local up' again to auto-install managed tools.");
+  const migrateJobPath = (0, import_node_path18.join)(LOCAL_STACK_BASE, "db-migrate-job.yaml");
+  printProgress(runtimeOptions, "Running database migrations...");
+  run(kubectl, ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "delete", "job/eve-db-migrate", "--ignore-not-found"], {
+    stdio: "pipe",
+    allowFailure: true
+  });
+  run(kubectl, ["--context", DEFAULT_KUBE_CONTEXT, "apply", "-f", migrateJobPath], {
+    stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe"
+  });
+  const wait = run(
+    kubectl,
+    ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "wait", "--for=condition=complete", "job/eve-db-migrate", timeoutArg(timeoutSeconds)],
+    {
+      stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe",
+      allowFailure: true
+    }
+  );
+  if (wait.status !== 0) {
+    run(kubectl, ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "logs", "job/eve-db-migrate"], { stdio: "inherit", allowFailure: true });
+    throw new Error("Database migration failed. Inspect job logs above.");
+  }
+}
+function generateAuthSecrets(runtimeOptions) {
+  const kubectl = requireToolPath("kubectl", "Run 'eve local up' again to auto-install managed tools.");
+  printProgress(runtimeOptions, "Generating auth secrets...");
+  const existingJwtSecret = readSecretValue(kubectl, "SUPABASE_JWT_SECRET");
+  const existingAdminPassword = readSecretValue(kubectl, "EVE_AUTH_ADMIN_PASSWORD");
+  const existingAuthPrivateKey = readSecretValue(kubectl, "EVE_AUTH_PRIVATE_KEY");
+  const existingAuthPublicKey = readSecretValue(kubectl, "EVE_AUTH_PUBLIC_KEY");
+  const existingInternalApiKey = readSecretValue(kubectl, "EVE_INTERNAL_API_KEY");
+  const existingSecretsMasterKey = readSecretValue(kubectl, "EVE_SECRETS_MASTER_KEY");
+  const existingBootstrapToken = readSecretValue(kubectl, "EVE_BOOTSTRAP_TOKEN");
+  const jwtSecret = existingJwtSecret || (0, import_node_crypto.randomBytes)(32).toString("hex");
+  const adminPassword = existingAdminPassword || (0, import_node_crypto.randomBytes)(24).toString("base64url").slice(0, 32);
+  const dbUrl = `postgres://eve_auth_admin:${adminPassword}@postgres.eve.svc.cluster.local:5432/eve?sslmode=disable`;
+  let authPrivateKey = existingAuthPrivateKey;
+  let authPublicKey = existingAuthPublicKey;
+  if (!authPrivateKey || !authPublicKey) {
+    const keyPair = (0, import_node_crypto.generateKeyPairSync)("rsa", {
+      modulusLength: 2048,
+      publicKeyEncoding: { type: "spki", format: "pem" },
+      privateKeyEncoding: { type: "pkcs8", format: "pem" }
+    });
+    authPrivateKey = keyPair.privateKey;
+    authPublicKey = keyPair.publicKey;
+  }
+  const iat = Math.floor(Date.now() / 1e3);
+  const exp = iat + 10 * 365 * 24 * 60 * 60;
+  const serviceKey = generateHs256Jwt({ role: "service_role", iss: "supabase", iat, exp }, jwtSecret);
+  const anonKey = generateHs256Jwt({ role: "anon", iss: "supabase", iat, exp }, jwtSecret);
+  const stringData = {
+    EVE_INTERNAL_API_KEY: existingInternalApiKey || (0, import_node_crypto.randomBytes)(24).toString("hex"),
+    EVE_SECRETS_MASTER_KEY: existingSecretsMasterKey || (0, import_node_crypto.randomBytes)(32).toString("hex"),
+    EVE_BOOTSTRAP_TOKEN: existingBootstrapToken || (0, import_node_crypto.randomBytes)(24).toString("hex"),
+    SUPABASE_JWT_SECRET: jwtSecret,
+    EVE_AUTH_ADMIN_PASSWORD: adminPassword,
+    SUPABASE_AUTH_DATABASE_URL: dbUrl,
+    SUPABASE_AUTH_SERVICE_KEY: serviceKey,
+    SUPABASE_ANON_KEY: anonKey,
+    EVE_AUTH_PRIVATE_KEY: authPrivateKey,
+    EVE_AUTH_PUBLIC_KEY: authPublicKey
+  };
+  const optionalKeys = [
+    "EVE_GITHUB_WEBHOOK_SECRET",
+    "EVE_SLACK_SIGNING_SECRET",
+    "EVE_GATEWAY_PROJECT_ID"
+  ];
+  for (const key of optionalKeys) {
+    const value = process.env[key];
+    if (typeof value === "string" && value.length > 0) {
+      stringData[key] = value;
+    }
+  }
+  const patchPayload = JSON.stringify({ stringData });
+  run(
+    kubectl,
+    ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "patch", "secret", "eve-app", "--type", "merge", "-p", patchPayload],
+    { stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe" }
+  );
+}
+function readSecretValue(kubectl, key) {
+  const result = run(
+    kubectl,
+    ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "get", "secret", "eve-app", "-o", `jsonpath={.data.${key}}`],
+    { stdio: "pipe", allowFailure: true }
+  );
+  if (result.status !== 0) {
+    return "";
+  }
+  const encoded = result.stdout.trim();
+  if (!encoded) {
+    return "";
+  }
+  try {
+    return Buffer.from(encoded, "base64").toString("utf8");
+  } catch {
+    return "";
+  }
+}
+function runAuthBootstrap(timeoutSeconds, runtimeOptions) {
+  const kubectl = requireToolPath("kubectl", "Run 'eve local up' again to auto-install managed tools.");
+  const bootstrapJobPath = (0, import_node_path18.join)(LOCAL_STACK_BASE, "auth-bootstrap-job.yaml");
+  printProgress(runtimeOptions, "Bootstrapping auth database role...");
+  run(kubectl, ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "delete", "job/auth-db-bootstrap", "--ignore-not-found"], {
+    stdio: "pipe",
+    allowFailure: true
+  });
+  run(kubectl, ["--context", DEFAULT_KUBE_CONTEXT, "apply", "-f", bootstrapJobPath], {
+    stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe"
+  });
+  const wait = run(
+    kubectl,
+    ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "wait", "--for=condition=complete", "job/auth-db-bootstrap", timeoutArg(timeoutSeconds)],
+    {
+      stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe",
+      allowFailure: true
+    }
+  );
+  if (wait.status !== 0) {
+    run(kubectl, ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "logs", "job/auth-db-bootstrap"], { stdio: "inherit", allowFailure: true });
+    throw new Error("Auth bootstrap failed. Inspect job logs above.");
+  }
+}
+function restartAndWaitRollouts(timeoutSeconds, runtimeOptions) {
+  const kubectl = requireToolPath("kubectl", "Run 'eve local up' again to auto-install managed tools.");
+  printProgress(runtimeOptions, "Restarting and waiting for service rollouts...");
+  run(
+    kubectl,
+    [
+      "--context",
+      DEFAULT_KUBE_CONTEXT,
+      "-n",
+      "eve",
+      "rollout",
+      "restart",
+      "deployment/eve-api",
+      "deployment/eve-orchestrator",
+      "deployment/eve-worker",
+      "deployment/eve-gateway",
+      "deployment/supabase-auth",
+      "deployment/mailpit",
+      "deployment/eve-sso"
+    ],
+    { stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe" }
+  );
+  run(
+    kubectl,
+    ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "rollout", "restart", "statefulset/eve-agent-runtime"],
+    { stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe" }
+  );
+  const workloads = [
+    { kind: "deployment", name: "eve-api" },
+    { kind: "deployment", name: "eve-orchestrator" },
+    { kind: "deployment", name: "eve-worker" },
+    { kind: "deployment", name: "eve-gateway" },
+    { kind: "deployment", name: "supabase-auth" },
+    { kind: "deployment", name: "mailpit" },
+    { kind: "deployment", name: "eve-sso" },
+    { kind: "statefulset", name: "eve-agent-runtime" }
+  ];
+  for (const workload of workloads) {
+    const status = run(
+      kubectl,
+      ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "rollout", "status", `${workload.kind}/${workload.name}`, timeoutArg(timeoutSeconds)],
+      {
+        stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe",
+        allowFailure: true
+      }
+    );
+    if (status.status !== 0) {
+      throw new Error(`Rollout failed for ${workload.kind}/${workload.name}. Run 'eve local status' and inspect service logs with 'eve local logs <service>'.`);
+    }
+  }
+}
+function waitForStatefulSetRollout(name, timeoutSeconds, runtimeOptions) {
+  const kubectl = requireToolPath("kubectl", "Run 'eve local up' again to auto-install managed tools.");
+  const status = run(
+    kubectl,
+    ["--context", DEFAULT_KUBE_CONTEXT, "-n", "eve", "rollout", "status", `statefulset/${name}`, timeoutArg(timeoutSeconds)],
+    {
+      stdio: runtimeOptions.verbose && !runtimeOptions.quiet ? "inherit" : "pipe",
+      allowFailure: true
+    }
+  );
+  if (status.status !== 0) {
+    throw new Error(`StatefulSet '${name}' did not become ready in ${timeoutSeconds}s.`);
+  }
+}
+function timeoutArg(timeoutSeconds) {
+  return `--timeout=${Math.max(timeoutSeconds, 1)}s`;
+}
+function generateHs256Jwt(payload, secret) {
+  const headerBase64 = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+  const payloadBase64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const signature = (0, import_node_crypto.createHmac)("sha256", secret).update(`${headerBase64}.${payloadBase64}`).digest("base64url");
+  return `${headerBase64}.${payloadBase64}.${signature}`;
+}
+function assertLocalAssetsPresent() {
+  const files = [
+    LOCAL_STACK_OVERLAY,
+    LOCAL_STACK_BASE,
+    (0, import_node_path18.join)(LOCAL_STACK_OVERLAY, "kustomization.yaml"),
+    (0, import_node_path18.join)(LOCAL_STACK_BASE, "db-migrate-job.yaml"),
+    (0, import_node_path18.join)(LOCAL_STACK_BASE, "auth-bootstrap-job.yaml")
+  ];
+  for (const file of files) {
+    if (!(0, import_node_fs19.existsSync)(file)) {
+      throw new Error(
+        `Missing local stack assets at ${file}. Reinstall the CLI or ensure package assets were published.`
+      );
+    }
+  }
+}
+async function waitForApiHealth(url, timeoutSeconds) {
+  const deadline = Date.now() + Math.max(timeoutSeconds, 1) * 1e3;
+  let latest = await probeApiHealth(url);
+  while (!latest.ok && Date.now() < deadline) {
+    await sleep(2e3);
+    latest = await probeApiHealth(url);
+  }
+  if (!latest.ok) {
+    throw new Error(`Local API did not become healthy within ${timeoutSeconds}s (${latest.error ?? "unknown error"}).`);
+  }
+  return latest;
+}
+async function probeApiHealth(url) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3e3);
+  try {
+    const response = await fetch(`${url}/health`, { signal: controller.signal });
+    if (!response.ok) {
+      return {
+        url,
+        ok: false,
+        error: `HTTP ${response.status}`
+      };
+    }
+    const payload = await response.json();
+    return {
+      url,
+      ok: payload.status === "ok" || payload.status === "healthy",
+      status: payload.status,
+      timestamp: payload.timestamp
+    };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      url,
+      ok: false,
+      error: message
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function getClusterSnapshot() {
+  const k3d = findExecutable("k3d");
+  if (!k3d) {
+    return { exists: false, running: false };
+  }
+  const result = run(k3d, ["cluster", "list", "-o", "json"], {
+    stdio: "pipe",
+    allowFailure: true
+  });
+  if (result.status !== 0) {
+    return { exists: false, running: false };
+  }
+  try {
+    const payload = JSON.parse(result.stdout);
+    const cluster = payload.find((item) => item.name === DEFAULT_CLUSTER_NAME);
+    if (!cluster) {
+      return { exists: false, running: false };
+    }
+    const serversRunning = Number(cluster.serversRunning ?? 0);
+    const serversCount = Number(cluster.serversCount ?? 0);
+    return {
+      exists: true,
+      running: serversCount > 0 && serversRunning >= serversCount
+    };
+  } catch {
+    return { exists: false, running: false };
+  }
+}
+function parseTimeoutSeconds(flags, defaultValue) {
+  const raw = getStringFlag(flags, ["timeout"]);
+  if (!raw) return defaultValue;
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error(`Invalid --timeout value: ${raw}`);
+  }
+  return value;
+}
+function run(command, args, options = {}) {
+  const env = { ...process.env };
+  if ((0, import_node_fs19.existsSync)(MANAGED_BIN_DIR)) {
+    env.PATH = `${MANAGED_BIN_DIR}:${env.PATH ?? ""}`;
+  }
+  const result = (0, import_node_child_process10.spawnSync)(command, args, {
+    cwd: options.cwd,
+    encoding: "utf8",
+    stdio: options.stdio ?? "pipe",
+    env,
+    timeout: options.timeoutMs
+  });
+  const status = result.status ?? 1;
+  const stdout = result.stdout ?? "";
+  const stderr = result.stderr ?? "";
+  if (status !== 0 && !options.allowFailure) {
+    const message = stderr.trim() || stdout.trim() || `${command} exited with status ${status}`;
+    throw new Error(message);
+  }
+  return { status, stdout, stderr };
+}
+function findExecutable(name) {
+  const managed = (0, import_node_path18.join)(MANAGED_BIN_DIR, name);
+  if ((0, import_node_fs19.existsSync)(managed)) {
+    return managed;
+  }
+  const found = (0, import_node_child_process10.spawnSync)("which", [name], {
+    encoding: "utf8",
+    stdio: "pipe"
+  });
+  if (found.status === 0 && found.stdout.trim()) {
+    return found.stdout.trim();
+  }
+  return void 0;
+}
+function ensureTool(name, installHint) {
+  if (!findExecutable(name)) {
+    throw new Error(`Missing required tool '${name}'. ${installHint}`);
+  }
+}
+function requireToolPath(name, hint) {
+  const path6 = findExecutable(name);
+  if (!path6) {
+    throw new Error(`Missing required tool '${name}'. ${hint}`);
+  }
+  return path6;
+}
+function assertDockerRunning() {
+  const docker = findExecutable("docker");
+  if (!docker) {
+    throw new Error("Missing required tool 'docker'. Install Docker Desktop.");
+  }
+  const result = run(docker, ["info"], { stdio: "pipe", allowFailure: true });
+  if (result.status !== 0) {
+    throw new Error("Docker daemon is not reachable. Start Docker Desktop and retry.");
+  }
+}
+function trySelectLocalContext() {
+  const kubectl = findExecutable("kubectl");
+  if (!kubectl) {
+    return;
+  }
+  const exists = run(
+    kubectl,
+    ["config", "get-contexts", DEFAULT_KUBE_CONTEXT],
+    { stdio: "pipe", allowFailure: true }
+  );
+  if (exists.status !== 0) {
+    return;
+  }
+  run(
+    kubectl,
+    ["config", "use-context", DEFAULT_KUBE_CONTEXT],
+    { stdio: "pipe", allowFailure: true }
+  );
+}
+function printProgress(runtimeOptions, message) {
+  if (!runtimeOptions.quiet) {
+    console.log(message);
+  }
+}
+async function confirm(promptText) {
+  if (!process.stdin.isTTY) {
+    return false;
+  }
+  const rl = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question(promptText);
+    const normalized = answer.trim().toLowerCase();
+    return normalized === "y" || normalized === "yes";
+  } finally {
+    rl.close();
+  }
+}
+function sleep(ms) {
+  return new Promise((resolvePromise) => {
+    setTimeout(resolvePromise, ms);
+  });
+}
+
 // src/index.ts
 async function main2() {
   const { flags, positionals } = parseArgs(process.argv.slice(2));
@@ -78585,6 +79858,9 @@ async function main2() {
     case "fs":
       await handleFs(subcommand, rest, flags, context2);
       return;
+    case "local":
+      await handleLocal(subcommand, rest, flags, context2);
+      return;
     default:
       showMainHelp();
   }