@kalphq/cli 0.0.0-dev-20260512203604 → 0.0.0-dev-20260513001041

package/dist/chunk-YMEEYCMI.js

@@ -0,0 +1,717 @@
+#!/usr/bin/env node
+
+// src/utils/secret.ts
+import { randomBytes } from "crypto";
+import { readFile, writeFile } from "fs/promises";
+import { join } from "path";
+var SECRET_KEY = "KALP_SECRET_KEY";
+var STUDIO_PASSWORD = "KALP_STUDIO_PASSWORD";
+var STUDIO_ADMIN_USER = "KALP_STUDIO_ADMIN_USER";
+var SERVICE_KEY = "KALP_SERVICE_KEY";
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function parseEnv(content) {
+  const result = {};
+  for (const line of content.split(/\r?\n/g)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIndex = trimmed.indexOf("=");
+    if (eqIndex <= 0) continue;
+    const key = trimmed.slice(0, eqIndex).trim();
+    const value = trimmed.slice(eqIndex + 1).trim();
+    result[key] = value;
+  }
+  return result;
+}
+function applyEnvUpdates(content, updates) {
+  let next = content;
+  for (const [key, value] of Object.entries(updates)) {
+    const line = `${key}=${value}`;
+    const pattern = new RegExp(`^${escapeRegExp(key)}=.*$`, "m");
+    if (pattern.test(next)) {
+      next = next.replace(pattern, line);
+      continue;
+    }
+    const trimmed = next.trimEnd();
+    next = trimmed.length > 0 ? `${trimmed}
+${line}
+` : `${line}
+`;
+  }
+  return next.trimEnd() + "\n";
+}
+async function readEnvFile(cwd) {
+  const envPath = join(cwd, ".env");
+  try {
+    return await readFile(envPath, "utf-8");
+  } catch {
+    return "";
+  }
+}
+async function readDevVarsFile(cwd) {
+  const devVarsPath = join(cwd, ".dev.vars");
+  try {
+    return await readFile(devVarsPath, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function generateStudioPassword() {
+  return randomBytes(24).toString("base64url");
+}
+function generateServiceKey() {
+  return `kalp_sk_live_${randomBytes(32).toString("base64url")}`;
+}
+async function ensureStudioSecrets(cwd) {
+  const envPath = join(cwd, ".env");
+  const devVarsPath = join(cwd, ".dev.vars");
+  const content = await readEnvFile(cwd);
+  const parsed = parseEnv(content);
+  const key = parsed[SECRET_KEY]?.trim() || randomBytes(32).toString("hex");
+  const studioPassword = parsed[STUDIO_PASSWORD]?.trim() || generateStudioPassword();
+  const studioAdminUser = parsed[STUDIO_ADMIN_USER]?.trim() || "admin";
+  const serviceKey = parsed[SERVICE_KEY]?.trim() || generateServiceKey();
+  const isNew = !parsed[SECRET_KEY]?.trim() || !parsed[STUDIO_PASSWORD]?.trim() || !parsed[STUDIO_ADMIN_USER]?.trim() || !parsed[SERVICE_KEY]?.trim();
+  const next = applyEnvUpdates(content, {
+    [SECRET_KEY]: key,
+    [STUDIO_PASSWORD]: studioPassword,
+    [STUDIO_ADMIN_USER]: studioAdminUser,
+    [SERVICE_KEY]: serviceKey
+  });
+  await writeFile(envPath, next, "utf-8");
+  const devVarsContent = await readDevVarsFile(cwd);
+  const nextDevVars = applyEnvUpdates(devVarsContent, {
+    [SECRET_KEY]: key,
+    [STUDIO_PASSWORD]: studioPassword,
+    [STUDIO_ADMIN_USER]: studioAdminUser,
+    [SERVICE_KEY]: serviceKey
+  });
+  await writeFile(devVarsPath, nextDevVars, "utf-8");
+  return { key, studioPassword, studioAdminUser, serviceKey, isNew };
+}
+async function ensureSecretKey(cwd) {
+  const secrets = await ensureStudioSecrets(cwd);
+  return { key: secrets.key, isNew: secrets.isNew };
+}
+
+// src/utils/project-state.ts
+import { mkdir, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+var KALP_DIR = ".kalp";
+var STATE_FILE = "state.json";
+function normalizeProjectState(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const value = raw;
+  const workerUrl = typeof value.workerUrl === "string" && value.workerUrl.length > 0 ? value.workerUrl : null;
+  const deployedAt = typeof value.deployedAt === "string" && value.deployedAt.length > 0 ? value.deployedAt : null;
+  const accountId = typeof value.accountId === "string" && value.accountId.length > 0 ? value.accountId : null;
+  const studioCredentialsFingerprint = typeof value.studioCredentialsFingerprint === "string" && value.studioCredentialsFingerprint.length > 0 ? value.studioCredentialsFingerprint : null;
+  const serviceKeyFingerprint = typeof value.serviceKeyFingerprint === "string" && value.serviceKeyFingerprint.length > 0 ? value.serviceKeyFingerprint : null;
+  const agents = {};
+  const rawAgents = value.agents && typeof value.agents === "object" ? value.agents : {};
+  for (const [name, entry] of Object.entries(rawAgents)) {
+    if (!entry || typeof entry !== "object") continue;
+    const item = entry;
+    if (typeof item.localPath !== "string" || item.localPath.length === 0) {
+      continue;
+    }
+    const currentVersion = typeof item.currentVersion === "number" && Number.isFinite(item.currentVersion) ? Math.max(0, Math.floor(item.currentVersion)) : 0;
+    agents[name] = {
+      currentHash: typeof item.currentHash === "string" ? item.currentHash : null,
+      currentVersion,
+      lastLocalHash: typeof item.lastLocalHash === "string" ? item.lastLocalHash : null,
+      lastRemoteHash: typeof item.lastRemoteHash === "string" ? item.lastRemoteHash : null,
+      lastPushedAt: typeof item.lastPushedAt === "string" ? item.lastPushedAt : null,
+      localPath: item.localPath,
+      workerUrl: typeof item.workerUrl === "string" ? item.workerUrl : null
+    };
+  }
+  return {
+    workerUrl,
+    deployedAt,
+    accountId,
+    studioCredentialsFingerprint,
+    serviceKeyFingerprint,
+    agents
+  };
+}
+async function readProjectState(cwd) {
+  try {
+    const statePath = join2(cwd, KALP_DIR, STATE_FILE);
+    const content = await readFile2(statePath, "utf-8");
+    return normalizeProjectState(JSON.parse(content));
+  } catch {
+    return null;
+  }
+}
+async function writeProjectState(cwd, state) {
+  const dir = join2(cwd, KALP_DIR);
+  await mkdir(dir, { recursive: true });
+  await writeFile2(join2(dir, STATE_FILE), `${JSON.stringify(state, null, 2)}
+`, "utf-8");
+}
+
+// src/utils/runtime.ts
+import { createHash } from "crypto";
+import {
+  access as access3,
+  cp,
+  mkdir as mkdir2,
+  readdir,
+  readFile as readFile4,
+  rm,
+  stat,
+  writeFile as writeFile4
+} from "fs/promises";
+import { basename, dirname, join as join6, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+import { deriveLabelFromName } from "@kalphq/project";
+
+// src/utils/ai.ts
+import { access, readFile as readFile3 } from "fs/promises";
+import { constants } from "fs";
+import { join as join3 } from "path";
+import { createJiti } from "jiti";
+var PROVIDER_SECRET_MAP = {
+  openai: "OPENAI_API_KEY",
+  anthropic: "ANTHROPIC_API_KEY",
+  openrouter: "OPENROUTER_API_KEY",
+  custom: "CUSTOM_AI_API_KEY"
+};
+function parseEnv2(content) {
+  const env = {};
+  for (const raw of content.split(/\r?\n/g)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const idx = line.indexOf("=");
+    if (idx <= 0) continue;
+    env[line.slice(0, idx).trim()] = line.slice(idx + 1);
+  }
+  return env;
+}
+async function resolveProviderFromConfig(cwd) {
+  const configPath = join3(cwd, "kalp.config.ts");
+  await access(configPath, constants.F_OK);
+  const jiti = createJiti(cwd, { interopDefault: true });
+  const config = await jiti.import(configPath);
+  const provider = config?.default?.ai?.provider ?? config?.ai?.provider ?? "openai";
+  return provider;
+}
+async function readDotEnv(cwd) {
+  const envPath = join3(cwd, ".env");
+  const content = await readFile3(envPath, "utf-8").catch(() => "");
+  return parseEnv2(content);
+}
+function getRequiredSecretForProvider(provider) {
+  return PROVIDER_SECRET_MAP[provider];
+}
+
+// src/utils/project-config.ts
+import { createJiti as createJiti2 } from "jiti";
+import { access as access2 } from "fs/promises";
+import { constants as constants2 } from "fs";
+import { join as join4, resolve } from "path";
+function normalizeStrategy(strategy) {
+  if (!strategy) return null;
+  if (strategy.type === "jwks") {
+    return {
+      type: "jwks",
+      jwksUrl: strategy.jwksUrl,
+      issuer: strategy.issuer,
+      audience: strategy.audience
+    };
+  }
+  if (strategy.type === "symmetric") {
+    return {
+      type: "symmetric",
+      secretEnvKey: strategy.secretEnvKey
+    };
+  }
+  return {
+    type: "apiKey",
+    headerName: strategy.headerName,
+    envKey: strategy.envKey
+  };
+}
+async function loadProjectConfig(cwd) {
+  const configPath = resolve(join4(cwd, "kalp.config.ts"));
+  await access2(configPath, constants2.F_OK);
+  const jiti = createJiti2(cwd, { interopDefault: true });
+  const moduleValue = await jiti.import(configPath);
+  const raw = moduleValue && typeof moduleValue === "object" && "default" in moduleValue ? moduleValue.default ?? moduleValue : moduleValue;
+  return { path: configPath, raw };
+}
+function resolveRuntimeIdentityConfig(rawConfig) {
+  const identity = rawConfig.identity && typeof rawConfig.identity === "object" ? rawConfig.identity : void 0;
+  const enforceGlobalAuth = typeof rawConfig.enforceGlobalAuth === "boolean" ? rawConfig.enforceGlobalAuth : true;
+  return {
+    enforceGlobalAuth,
+    identityId: identity && typeof identity.id === "string" && identity.id.length > 0 ? identity.id : null,
+    strategy: normalizeStrategy(identity?.strategy)
+  };
+}
+function resolveIdentityAuthRequirements(identity) {
+  if (!identity.strategy) return [];
+  if (identity.strategy.type === "symmetric") {
+    return [
+      {
+        envKey: identity.strategy.secretEnvKey?.trim() || "JWT_SIGNING_SECRET",
+        reason: "symmetric JWT validation"
+      }
+    ];
+  }
+  if (identity.strategy.type === "apiKey") {
+    const envKey = identity.strategy.envKey?.trim();
+    if (!envKey) {
+      return [
+        {
+          envKey: "KALP_API_KEY",
+          reason: "apiKey strategy (default env key)"
+        }
+      ];
+    }
+    return [{ envKey, reason: "apiKey strategy" }];
+  }
+  return [];
+}
+
+// src/utils/runtime-identity.ts
+import { build } from "esbuild";
+import { writeFile as writeFile3 } from "fs/promises";
+import { join as join5 } from "path";
+import { pathToFileURL } from "url";
+var NODE_BUILTIN_IMPORTS = /* @__PURE__ */ new Set([
+  "fs",
+  "path",
+  "crypto",
+  "os",
+  "child_process",
+  "worker_threads",
+  "net",
+  "tls",
+  "http",
+  "https",
+  "zlib",
+  "stream",
+  "url",
+  "process",
+  "buffer"
+]);
+var DEFAULT_IDENTITY_MAP_SOURCE = `export default function mapIdentity(payload) {
+  const sub =
+    payload && typeof payload === "object" && typeof payload.sub === "string"
+      ? payload.sub
+      : "anonymous";
+  return { userId: sub, claims: {} };
+}
+`;
+function readIdentityMapCandidate(rawConfig) {
+  if (!rawConfig.identity || typeof rawConfig.identity !== "object") return null;
+  return rawConfig.identity.mapIdentity;
+}
+async function writeDefaultIdentityMap(identityMapPath) {
+  await writeFile3(identityMapPath, DEFAULT_IDENTITY_MAP_SOURCE, "utf-8");
+}
+async function bundleIdentityMap(params) {
+  const { cwd, configPath, identityMapPath } = params;
+  const configSpecifier = pathToFileURL(configPath).href;
+  const entrySource = `
+import configModule from ${JSON.stringify(configSpecifier)};
+const config = (configModule && typeof configModule === "object" && "default" in configModule)
+  ? (configModule.default ?? configModule)
+  : configModule;
+
+const mapper = config?.identity?.mapIdentity;
+if (typeof mapper !== "function") {
+  throw new Error("identity.mapIdentity must be a function.");
+}
+
+export default mapper;
+`;
+  try {
+    await build({
+      absWorkingDir: cwd,
+      bundle: true,
+      format: "esm",
+      platform: "browser",
+      target: ["es2022"],
+      write: true,
+      outfile: identityMapPath,
+      logLevel: "silent",
+      plugins: [
+        {
+          name: "kalp-edge-identity-guard",
+          setup(buildContext) {
+            buildContext.onResolve({ filter: /.*/ }, (args) => {
+              const raw = args.path.startsWith("node:") ? args.path.slice(5) : args.path;
+              if (NODE_BUILTIN_IMPORTS.has(raw)) {
+                return {
+                  errors: [
+                    {
+                      text: `Node builtin "${args.path}" is not supported in identity.mapIdentity for edge runtime.`
+                    }
+                  ]
+                };
+              }
+              return null;
+            });
+          }
+        }
+      ],
+      stdin: {
+        contents: entrySource,
+        resolveDir: cwd,
+        sourcefile: "kalp-identity-map-entry.mjs",
+        loader: "js"
+      }
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `Could not bundle identity.mapIdentity for runtime. Ensure mapIdentity is edge-safe (no Node built-ins). ${message}`
+    );
+  }
+}
+async function materializeRuntimeIdentity(params) {
+  const { cwd, runtimeDir } = params;
+  const identityConfigPath = join5(runtimeDir, "identity.config.json");
+  const identityMapPath = join5(runtimeDir, "identity.map.mjs");
+  let rawConfig = {};
+  let configPath = null;
+  try {
+    const loaded = await loadProjectConfig(cwd);
+    rawConfig = loaded.raw;
+    configPath = loaded.path;
+  } catch {
+    rawConfig = {};
+    configPath = null;
+  }
+  const identityConfig = resolveRuntimeIdentityConfig(rawConfig);
+  await writeFile3(identityConfigPath, `${JSON.stringify(identityConfig, null, 2)}
+`, "utf-8");
+  const mapIdentity = readIdentityMapCandidate(rawConfig);
+  if (typeof mapIdentity === "function" && configPath) {
+    await bundleIdentityMap({
+      cwd,
+      configPath,
+      identityMapPath
+    });
+  } else {
+    await writeDefaultIdentityMap(identityMapPath);
+  }
+  return { identityConfig, identityConfigPath, identityMapPath };
+}
+
+// src/utils/runtime.ts
+var RUNTIME_ROOT = ".kalp";
+var RUNTIME_DIR = "runtime";
+var STUDIO_DIR = "studio";
+var WRANGLER_CONFIG_FILE = "wrangler.jsonc";
+var WORKER_ENTRY_FILE = "worker-entry.js";
+var COMPATIBILITY_DATE = "2026-05-10";
+function sanitizeSegment(input) {
+  return input.toLowerCase().replace(/^@/, "").replace(/\//g, "-").replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
+}
+async function resolveProjectSlug(cwd) {
+  const fallback = sanitizeSegment(basename(cwd)) || "agent";
+  const packageJsonPath = join6(cwd, "package.json");
+  try {
+    const content = await readFile4(packageJsonPath, "utf-8");
+    const pkg = JSON.parse(content);
+    const name = typeof pkg.name === "string" ? pkg.name : "";
+    const sanitized = sanitizeSegment(name);
+    return sanitized || fallback;
+  } catch {
+    return fallback;
+  }
+}
+function buildWorkerName(slug, cwd) {
+  const cwdHash = createHash("sha1").update(cwd).digest("hex").slice(0, 8);
+  const withPrefix = `kalp-${slug}-${cwdHash}`;
+  const maxLen = 63;
+  if (withPrefix.length <= maxLen) {
+    return withPrefix;
+  }
+  const clipped = withPrefix.slice(0, maxLen).replace(/-+$/g, "");
+  return clipped || `kalp-${cwdHash}`;
+}
+function createRuntimeConfig(workerName, mode, requiredSecrets) {
+  return {
+    $schema: "node_modules/wrangler/config-schema.json",
+    name: workerName,
+    main: `./${WORKER_ENTRY_FILE}`,
+    compatibility_date: COMPATIBILITY_DATE,
+    compatibility_flags: ["nodejs_compat"],
+    migrations: [
+      {
+        tag: "v1",
+        new_sqlite_classes: ["AgentDurableObject"]
+      }
+    ],
+    durable_objects: {
+      bindings: [
+        {
+          name: "KALP_RUNTIME_CLOUDFLARE",
+          class_name: "AgentDurableObject"
+        }
+      ]
+    },
+    kv_namespaces: [
+      {
+        binding: "KALP_MANIFESTS"
+      }
+    ],
+    assets: {
+      directory: `./${STUDIO_DIR}`,
+      binding: "ASSETS",
+      run_worker_first: true
+    },
+    observability: { enabled: true },
+    upload_source_maps: true,
+    vars: {
+      KALP_ENV: mode
+    },
+    secrets: {
+      required: requiredSecrets
+    }
+  };
+}
+function runtimeTemplateCandidates() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const distTemplateRoot = resolve2(here, "runtime-template");
+  const packageRootTemplate = resolve2(here, "..", "runtime-template");
+  const sourceTemplateRoot = resolve2(here, "..", "..", "runtime-template");
+  const monorepoStudioDist = resolve2(
+    here,
+    "..",
+    "..",
+    "..",
+    "..",
+    "apps",
+    "studio",
+    "dist",
+    "client"
+  );
+  return [
+    {
+      studioTemplateDir: join6(distTemplateRoot, STUDIO_DIR),
+      workerEntryPath: join6(distTemplateRoot, WORKER_ENTRY_FILE)
+    },
+    {
+      studioTemplateDir: join6(packageRootTemplate, STUDIO_DIR),
+      workerEntryPath: join6(packageRootTemplate, WORKER_ENTRY_FILE)
+    },
+    {
+      studioTemplateDir: join6(sourceTemplateRoot, STUDIO_DIR),
+      workerEntryPath: join6(sourceTemplateRoot, WORKER_ENTRY_FILE)
+    },
+    {
+      studioTemplateDir: monorepoStudioDist,
+      workerEntryPath: join6(sourceTemplateRoot, WORKER_ENTRY_FILE)
+    }
+  ];
+}
+async function resolveRuntimeTemplate() {
+  for (const candidate of runtimeTemplateCandidates()) {
+    try {
+      await access3(candidate.studioTemplateDir);
+      await access3(candidate.workerEntryPath);
+      return candidate;
+    } catch {
+    }
+  }
+  throw new Error(
+    "Kalp runtime template not found in CLI package. Reinstall @kalphq/cli."
+  );
+}
+function createStudioShell(entryScript, cssFiles) {
+  const cssLinks = cssFiles.map((file) => `    <link rel="stylesheet" href="/studio/assets/${file}" />`).join("\n");
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Kalp Studio</title>
+${cssLinks}
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/studio/assets/${entryScript}"></script>
+  </body>
+</html>
+`;
+}
+async function ensureStudioIndex(studioDir) {
+  const indexPath = join6(studioDir, "index.html");
+  try {
+    await access3(indexPath);
+    return;
+  } catch {
+  }
+  const assetsDir = join6(studioDir, "assets");
+  const assetFiles = await readdir(assetsDir);
+  const entryScript = assetFiles.find((file) => /^index-.*\.js$/i.test(file)) ?? assetFiles.find((file) => file.endsWith(".js"));
+  if (!entryScript) {
+    throw new Error(
+      "Studio runtime template is missing an entry JS bundle in studio/assets."
+    );
+  }
+  const cssFiles = assetFiles.filter((file) => file.endsWith(".css")).sort();
+  const html = createStudioShell(entryScript, cssFiles);
+  await writeFile4(indexPath, html, "utf-8");
+}
+async function readLocalAgentNames(cwd) {
+  const agentsDir = join6(cwd, "agents");
+  try {
+    const entries = await readdir(agentsDir, { withFileTypes: true });
+    const names = [];
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const indexPath = join6(agentsDir, entry.name, "index.ts");
+      const exists = await stat(indexPath).then(() => true).catch(() => false);
+      if (exists) names.push(entry.name);
+    }
+    return names.sort((a, b) => a.localeCompare(b));
+  } catch {
+    return [];
+  }
+}
+async function createAgentsSnapshot(cwd, mode) {
+  const localAgentNames = await readLocalAgentNames(cwd);
+  const state = await readProjectState(cwd);
+  const byName = /* @__PURE__ */ new Map();
+  const stateAgents = state?.agents ?? {};
+  for (const name of localAgentNames) {
+    const localPath = join6(cwd, "agents", name, "index.ts");
+    const saved = stateAgents[name];
+    const hasRemoteVersion = !!saved?.lastRemoteHash && (saved?.currentVersion ?? 0) > 0;
+    if (mode === "remote" && !hasRemoteVersion) {
+      continue;
+    }
+    const resolvedWorkerUrl = saved?.workerUrl ?? (state?.workerUrl ? `${state.workerUrl.replace(/\/$/, "")}/a/${name}` : null);
+    const versionNumber = typeof saved?.currentVersion === "number" && saved.currentVersion > 0 ? saved.currentVersion : null;
+    byName.set(name, {
+      name,
+      label: deriveLabelFromName(name),
+      tags: [],
+      environment: mode === "remote" ? "remote" : hasRemoteVersion ? "both" : "local",
+      status: resolvedWorkerUrl ? "online" : "offline",
+      hash: saved?.currentHash ?? null,
+      version: versionNumber ? `v${versionNumber}` : null,
+      versionNumber,
+      lastRemoteHash: saved?.lastRemoteHash ?? null,
+      lastLocalHash: saved?.lastLocalHash ?? null,
+      workerUrl: resolvedWorkerUrl,
+      localPath,
+      updatedAt: saved?.lastPushedAt ?? state?.deployedAt ?? null
+    });
+  }
+  if (mode === "remote") {
+    for (const [name, saved] of Object.entries(stateAgents)) {
+      const hasRemoteVersion = !!saved.lastRemoteHash && (saved.currentVersion ?? 0) > 0;
+      if (!hasRemoteVersion || byName.has(name)) continue;
+      const localPath = saved.localPath ?? join6(cwd, "agents", name, "index.ts");
+      const workerUrl = saved.workerUrl ?? (state?.workerUrl ? `${state.workerUrl.replace(/\/$/, "")}/a/${name}` : null);
+      const versionNumber = saved.currentVersion > 0 ? saved.currentVersion : null;
+      byName.set(name, {
+        name,
+        label: deriveLabelFromName(name),
+        tags: [],
+        environment: "remote",
+        status: workerUrl ? "online" : "offline",
+        hash: saved.currentHash ?? null,
+        version: versionNumber ? `v${versionNumber}` : null,
+        versionNumber,
+        lastRemoteHash: saved.lastRemoteHash ?? null,
+        lastLocalHash: saved.lastLocalHash ?? null,
+        workerUrl,
+        localPath,
+        updatedAt: saved.lastPushedAt ?? state?.deployedAt ?? null
+      });
+    }
+  }
+  return {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    projectPath: cwd,
+    workerUrl: state?.workerUrl ?? null,
+    mode,
+    agents: Array.from(byName.values()).sort((a, b) => a.name.localeCompare(b.name))
+  };
+}
+async function writeRuntimeAgentsSnapshot(params) {
+  const snapshot = await createAgentsSnapshot(params.cwd, params.mode);
+  await writeFile4(
+    join6(params.runtimeDir, "agents.snapshot.json"),
+    `${JSON.stringify(snapshot, null, 2)}
+`,
+    "utf-8"
+  );
+}
+async function materializeRuntime(cwd, options = {}) {
+  const mode = options.mode ?? "remote";
+  const runtimeDir = join6(cwd, RUNTIME_ROOT, RUNTIME_DIR);
+  const studioDir = join6(runtimeDir, STUDIO_DIR);
+  const workerEntrypointPath = join6(runtimeDir, WORKER_ENTRY_FILE);
+  const wranglerConfigPath = join6(runtimeDir, WRANGLER_CONFIG_FILE);
+  const template = await resolveRuntimeTemplate();
+  await rm(runtimeDir, { recursive: true, force: true });
+  await mkdir2(runtimeDir, { recursive: true });
+  await cp(template.studioTemplateDir, studioDir, { recursive: true });
+  await cp(template.workerEntryPath, workerEntrypointPath);
+  await ensureStudioIndex(studioDir);
+  await writeRuntimeAgentsSnapshot({ cwd, runtimeDir, mode });
+  const identity = await materializeRuntimeIdentity({ cwd, runtimeDir });
+  const projectSlug = await resolveProjectSlug(cwd);
+  const workerName = buildWorkerName(projectSlug, cwd);
+  const requiredSecrets = /* @__PURE__ */ new Set([
+    "KALP_SECRET_KEY",
+    "KALP_STUDIO_PASSWORD",
+    "KALP_STUDIO_ADMIN_USER",
+    "KALP_SERVICE_KEY"
+  ]);
+  try {
+    const provider = await resolveProviderFromConfig(cwd);
+    requiredSecrets.add(getRequiredSecretForProvider(provider));
+  } catch {
+  }
+  const identityRequirements = resolveIdentityAuthRequirements(identity.identityConfig);
+  for (const requirement of identityRequirements) {
+    requiredSecrets.add(requirement.envKey);
+  }
+  const wranglerConfig = createRuntimeConfig(
+    workerName,
+    mode,
+    [...requiredSecrets].sort((a, b) => a.localeCompare(b))
+  );
+  await writeFile4(
+    wranglerConfigPath,
+    `${JSON.stringify(wranglerConfig, null, 2)}
+`,
+    "utf-8"
+  );
+  return {
+    runtimeDir,
+    studioDir,
+    workerEntrypointPath,
+    wranglerConfigPath,
+    workerName
+  };
+}
+
+export {
+  ensureStudioSecrets,
+  ensureSecretKey,
+  readProjectState,
+  writeProjectState,
+  resolveProviderFromConfig,
+  readDotEnv,
+  getRequiredSecretForProvider,
+  loadProjectConfig,
+  resolveRuntimeIdentityConfig,
+  resolveIdentityAuthRequirements,
+  readLocalAgentNames,
+  writeRuntimeAgentsSnapshot,
+  materializeRuntime
+};
+//# sourceMappingURL=chunk-YMEEYCMI.js.map