@paradigma-inc/flywheel 0.1.26 → 0.1.51

package/src/runtime/vendor/flywheel-cli-dist/main.js

@@ -0,0 +1,763 @@
+#!/usr/bin/env node
+import { randomUUID } from 'node:crypto';
+import { access, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { loadAuthConfig, DEFAULT_BASE_URL, resolveConfigPath, saveAuthConfig, } from './auth/config.js';
+import { baseUrlsEqual } from './auth/baseurl.js';
+import { getKey } from './auth/keychain.js';
+import { loadProfile } from './auth/profile.js';
+import { RUNTIME_ALIASES } from './commands/aliases.js';
+import { BUILTIN_PROFILE_NAMES, isBuiltinProfileName, resolveBuiltinBaseUrl, } from './auth/profiles.js';
+import { renderCommandHelp, renderCommandHelpAsJson, renderHelp, renderHelpAsJson, } from './commands/help.js';
+import { getCommandByName } from './commands/registry.js';
+import { MVP_COMMAND_HANDLERS } from './commands/index.js';
+import { CliApprovalPendingError, CliFinalizeFailedError, CliUsageError, CliWaitTimeoutError, } from './errors.js';
+import { EXIT_TRANSPORT, EXIT_USAGE } from './exit-codes.js';
+import { extractGlobals } from './grammar/globals.js';
+import { parseCliArgs } from './grammar/parse.js';
+import { CliHttpError, createHttpClient } from './http/client.js';
+import { renderOutput } from './output/format.js';
+import { CLI_VERSION } from './version.js';
+function defaultStdout(chunk) {
+    process.stdout.write(chunk);
+}
+function defaultStderr(chunk) {
+    process.stderr.write(chunk);
+}
+function writeLine(writer, text) {
+    if (text.endsWith('\n')) {
+        writer(text);
+        return;
+    }
+    writer(`${text}\n`);
+}
+/**
+ * Derive the active built-in profile state from the already-loaded
+ * AuthConfig. Reading from `config` (instead of re-reading the file at
+ * `configPath`) keeps the injectable `loadConfig` dependency
+ * authoritative — tests and programmatic embedders that hand the CLI an
+ * in-memory config must not be silently overridden by stale on-disk
+ * state.
+ */
+function activeBuiltinFromConfig(config) {
+    const empty = {
+        name: undefined,
+        baseUrl: undefined,
+        apiKey: undefined,
+    };
+    const rawName = config.activeProfile;
+    if (typeof rawName !== 'string' || !rawName.trim())
+        return empty;
+    const name = rawName.trim();
+    if (!isBuiltinProfileName(name))
+        return empty;
+    const baseUrl = resolveBuiltinBaseUrl(name);
+    const bucket = config.profileKeys?.[name];
+    const candidate = bucket?.apiKey;
+    const apiKey = typeof candidate === 'string' && candidate.trim() ? candidate : undefined;
+    return { name, baseUrl, apiKey };
+}
+async function resolveRuntimeAuthConfig(config, profile, resolveEnvApiKey) {
+    const envBaseUrl = process.env.FLYWHEEL_BASE_URL?.trim();
+    // Resolution order:
+    //   FLYWHEEL_BASE_URL → --env=<name>'s profile.baseUrl → active built-in
+    //   profile pointer in config.activeProfile → legacy config.baseUrl →
+    //   DEFAULT_BASE_URL. Built-in baseUrls are ephemeral constants — they are
+    //   never written into config.baseUrl, so upstream URL changes flow through
+    //   automatically.
+    const activeBuiltin = activeBuiltinFromConfig(config);
+    const baseUrl = envBaseUrl ||
+        profile?.baseUrl ||
+        activeBuiltin.baseUrl ||
+        config.baseUrl ||
+        DEFAULT_BASE_URL;
+    let apiKey = process.env.FLYWHEEL_API_KEY?.trim() || undefined;
+    // Token-scoping guard: a profile's `api_key_env` / `api_key_keychain`
+    // credentials are minted for the profile's declared baseUrl. If the
+    // resolved baseUrl has since moved off that origin (typically via
+    // FLYWHEEL_BASE_URL override), the profile's credential must NOT ride
+    // along to a different host — that would leak the token across
+    // environments. Every other credential source in this resolver is
+    // already baseUrl-scoped; these two sources were the last hole.
+    const profileBindsToResolvedBaseUrl = profile !== null &&
+        profile.baseUrl !== undefined &&
+        baseUrlsEqual(baseUrl, profile.baseUrl);
+    if (!apiKey && profile?.apiKeyEnv && profileBindsToResolvedBaseUrl) {
+        apiKey = resolveEnvApiKey(profile.apiKeyEnv);
+    }
+    if (!apiKey && profile?.apiKeyKeychain && profileBindsToResolvedBaseUrl) {
+        const stored = await getKey('flywheel-cli', profile.name);
+        if (stored) {
+            apiKey = stored;
+        }
+    }
+    // `--env=<builtin>` selects a built-in profile for this invocation.
+    // Pull its stored apiKey from `config.profileKeys[name]` so the
+    // one-shot override gets the same auth a persisted `env switch` would.
+    // Tied to the built-in's baseUrl so a manual baseUrl override (e.g.
+    // FLYWHEEL_BASE_URL) doesn't carry the per-profile token to a
+    // different origin.
+    if (!apiKey &&
+        profile !== null &&
+        isBuiltinProfileName(profile.name) &&
+        baseUrlsEqual(baseUrl, resolveBuiltinBaseUrl(profile.name))) {
+        const candidate = config.profileKeys?.[profile.name]?.apiKey;
+        if (typeof candidate === 'string' && candidate.trim()) {
+            apiKey = candidate;
+        }
+    }
+    // Prefer the per-profile apiKey stored by `auth:login` while a built-in
+    // profile is active — but only when the resolved baseUrl is still that
+    // built-in's origin. A `FLYWHEEL_BASE_URL` override or `--env=<legacy>`
+    // flag moves the request to a different host; attaching the stored
+    // prod/staging bearer there would leak credentials across environments.
+    // The legacy flat `config.apiKey` is intentionally left unset under
+    // active-profile logins (so the built-in baseUrl never bleeds into
+    // config.json); consult it only when no per-profile key is present.
+    if (!apiKey &&
+        activeBuiltin.apiKey &&
+        baseUrlsEqual(baseUrl, activeBuiltin.baseUrl)) {
+        apiKey = activeBuiltin.apiKey;
+    }
+    // The legacy `config.apiKey` belongs to `config.baseUrl` and only to
+    // that origin. Every path that resolves `baseUrl` to anything else
+    // (built-in profile pointer, `--env=<legacy-profile>`, or
+    // `FLYWHEEL_BASE_URL` override) must NOT have the legacy key ride
+    // along: that single stored key would otherwise leak across any target
+    // origin the user points the CLI at.
+    // Canonical equality so `FLYWHEEL_BASE_URL=<config.baseUrl>/` (and
+    // other RFC 3986 §6.2.2-equivalent variants) still binds the legacy
+    // flat key to its origin instead of being treated as an unrelated
+    // host. See `auth/baseurl.ts` for the normalisation rules.
+    if (!apiKey && baseUrlsEqual(config.baseUrl, baseUrl)) {
+        apiKey = config.apiKey ?? undefined;
+    }
+    return {
+        baseUrl,
+        apiKey,
+        defaultFormat: profile?.defaultFormat,
+    };
+}
+const HELP_TOKENS = new Set(['--help', '-h']);
+const SCHEMA_TOKEN = '--schema';
+const HELP_EXTRAS_PREFIX = '--_help_extras=';
+const VALID_TOPIC_IDS = new Set([
+    'setup-admin',
+    'auth',
+    'profile',
+    'nodes-graph',
+    'artifacts-files',
+    'compute-executions',
+    'approvals-budgets',
+    'export-import',
+    'updates-resources',
+    'account-credits',
+    'integrations',
+    'api-keys',
+    'developer-admin',
+]);
+function parseHelpExtras(argv) {
+    let raw;
+    for (const token of argv) {
+        if (token.startsWith(HELP_EXTRAS_PREFIX)) {
+            raw = token.slice(HELP_EXTRAS_PREFIX.length);
+            break;
+        }
+    }
+    if (raw === undefined)
+        return { kind: 'absent' };
+    let decoded;
+    try {
+        decoded = JSON.parse(raw);
+    }
+    catch {
+        return { kind: 'invalid' };
+    }
+    if (!Array.isArray(decoded))
+        return { kind: 'invalid' };
+    const extras = [];
+    for (const entry of decoded) {
+        if (!entry ||
+            typeof entry !== 'object' ||
+            typeof entry.group !== 'string' ||
+            typeof entry.name !== 'string' ||
+            typeof entry.summary !== 'string') {
+            return { kind: 'invalid' };
+        }
+        const group = entry.group;
+        if (!VALID_TOPIC_IDS.has(group))
+            return { kind: 'invalid' };
+        extras.push({
+            group,
+            name: entry.name,
+            summary: entry.summary,
+        });
+    }
+    return { kind: 'ok', extras };
+}
+function stripHelpExtras(argv) {
+    return argv.filter((t) => !t.startsWith(HELP_EXTRAS_PREFIX));
+}
+// Commands that do not touch the HTTP runtime and therefore must run even
+// when ~/.config/flywheel-cli/config.json is absent. These are purely local
+// state operations (profile bookkeeping, keychain reads/writes) plus the
+// bootstrap auth:login flow, so gating them on runtime config would break the
+// exact recovery paths a user needs when the config is missing.
+const RUNTIME_CONFIG_OPTIONAL_COMMANDS = new Set([
+    'profile:list',
+    'profile:show',
+    'profile:set',
+    'profile:unset',
+    'auth:login',
+    'auth:keychain:set',
+    'auth:keychain:clear',
+    'env:list',
+    'env:switch',
+]);
+function isHelpToken(token) {
+    return HELP_TOKENS.has(token);
+}
+/**
+ * Resolve runtime aliases before dispatch so the SHORTCUTS section advertised
+ * in `flywheel help` is executable, not cosmetic. Mirrors the rewrite the
+ * setup wrapper performs, but kept co-located with the runtime CLI so direct
+ * invocations of this entrypoint (for example an agent using the published
+ * dist) see identical behaviour to `flywheel <alias>` through the wrapper.
+ *
+ * `help`, `--help`, `-h` are reserved and never rewritten — they dispatch
+ * help paths that have their own alias handling for `help <alias>`.
+ */
+function rewriteAlias(argv) {
+    if (argv.length === 0)
+        return argv;
+    const head = argv[0];
+    if (head === 'help' || head === '--help' || head === '-h')
+        return argv;
+    if (!Object.prototype.hasOwnProperty.call(RUNTIME_ALIASES, head))
+        return argv;
+    const canonical = RUNTIME_ALIASES[head];
+    return [canonical, ...argv.slice(1)];
+}
+function parseHelpFormat(argv) {
+    let result = { kind: 'absent' };
+    for (let i = 0; i < argv.length; i += 1) {
+        const token = argv[i];
+        let value;
+        if (token.startsWith('--format=')) {
+            value = token.slice('--format='.length);
+        }
+        else if (token === '--format') {
+            value = argv[i + 1];
+        }
+        else {
+            continue;
+        }
+        if (value === 'json') {
+            result = { kind: 'json' };
+        }
+        else {
+            return { kind: 'invalid', value: value ?? '' };
+        }
+    }
+    return result;
+}
+/**
+ * Strip `--format=...` / `--format <value>` tokens from argv so the help
+ * dispatcher can pick out the positional <command> without tripping over the
+ * format global. Callers must validate the format value via parseHelpFormat
+ * before calling this — unsupported values should surface as usage errors,
+ * not be silently dropped.
+ */
+function stripFormatTokens(argv) {
+    const out = [];
+    for (let i = 0; i < argv.length; i += 1) {
+        const token = argv[i];
+        if (token.startsWith('--format='))
+            continue;
+        if (token === '--format') {
+            i += 1; // skip the value
+            continue;
+        }
+        out.push(token);
+    }
+    return out;
+}
+function emitCommandHelp(stdout, stderr, commandName, schema, asJson) {
+    if (asJson) {
+        const payload = renderCommandHelpAsJson(commandName);
+        const parsed = JSON.parse(payload);
+        if (parsed.error) {
+            writeLine(stderr, parsed.error);
+            return 1;
+        }
+        stdout(payload);
+        return 0;
+    }
+    const helpText = renderCommandHelp(commandName, { schema });
+    if (helpText.startsWith('unknown command:')) {
+        writeLine(stderr, helpText.trim());
+        return 1;
+    }
+    stdout(helpText);
+    return 0;
+}
+function buildMissingParamHint(commandName, message) {
+    const command = getCommandByName(commandName);
+    if (!command) {
+        return message;
+    }
+    const lines = [message];
+    if (command.required.length > 0) {
+        lines.push('Required:');
+        for (const param of command.required) {
+            const typeHint = param.type === 'boolean' ? '' : ` <${param.type}>`;
+            lines.push(`  --${param.name}${typeHint}  ${param.description}`);
+        }
+    }
+    if (command.examples.length > 0) {
+        lines.push('Example:');
+        lines.push(`  ${command.examples[0].invocation}`);
+    }
+    return lines.join('\n');
+}
+function buildCommitSchemaHint(commandName, message) {
+    const command = getCommandByName(commandName);
+    if (!command?.schema) {
+        return message;
+    }
+    const lines = [message];
+    lines.push(`hint: payload rejected by server. Run \`flywheel help ${commandName} --schema\` to see the required JSON shape.`);
+    lines.push('Required payload keys (see schema for full shape):');
+    const keyMatches = command.schema.match(/^\s*"([^"]+)"\s*:/gm) ?? [];
+    const topLevelKeys = Array.from(new Set(keyMatches
+        .map((line) => line.match(/"([^"]+)"/)?.[1])
+        .filter((key) => Boolean(key)))).slice(0, 6);
+    for (const key of topLevelKeys) {
+        lines.push(`  ${key}`);
+    }
+    return lines.join('\n');
+}
+function buildLocalhostTransportHint(message, baseUrl) {
+    if (!message.includes('transport error')) {
+        return message;
+    }
+    const normalizedBase = baseUrl.replace(/\/+$/, '');
+    if (normalizedBase !== DEFAULT_BASE_URL.replace(/\/+$/, '')) {
+        return message;
+    }
+    const lines = [message];
+    lines.push(`hint: runtime is pointing at the default localhost fallback (${DEFAULT_BASE_URL}).`);
+    // Only --mode cli provisions ~/.config/flywheel-cli/config.json; --mode mcp
+    // writes host MCP entries and cannot fix a stale runtime base URL, so do not
+    // offer it as an alternative here.
+    lines.push('  Run `npx --yes @paradigma-inc/flywheel setup --mode cli` to configure Flywheel.');
+    return lines.join('\n');
+}
+function formatConfigPathForMessage(configPath) {
+    const homeDir = os.homedir();
+    const withSlash = `${homeDir}/`;
+    if (configPath === homeDir) {
+        return '~';
+    }
+    if (configPath.startsWith(withSlash)) {
+        return `~/${configPath.slice(withSlash.length)}`;
+    }
+    return configPath;
+}
+function buildMissingRuntimeConfigMessage(configPath) {
+    const displayPath = formatConfigPathForMessage(configPath);
+    // Only --mode cli writes ~/.config/flywheel-cli/config.json. Pointing at
+    // --mode mcp as a fix would loop users back to this same error because MCP
+    // setup only touches host MCP entries, not the runtime CLI config.
+    return `Flywheel CLI runtime config not found at ${displayPath}. Run \`npx --yes @paradigma-inc/flywheel setup --mode cli\` to configure Flywheel.`;
+}
+async function defaultConfigExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function runCli(argv, dependencies = {}) {
+    const stdout = dependencies.stdout ?? defaultStdout;
+    const stderr = dependencies.stderr ?? defaultStderr;
+    if (argv.length === 0) {
+        writeLine(stderr, 'usage: flywheel <command> [options]');
+        return EXIT_USAGE;
+    }
+    argv = rewriteAlias(argv);
+    const [first, ...rest] = argv;
+    // Help-format validation intentionally runs only inside the help branches
+    // below. Non-help commands let `parseCliArgs` validate --format against the
+    // full json|tsv|csv|table set; validating here would reject legitimate
+    // runtime formats like `flywheel nodes:list --format=csv`.
+    function resolveHelpFormat() {
+        const fmt = parseHelpFormat(argv);
+        if (fmt.kind === 'invalid') {
+            writeLine(stderr, `invalid --format=${fmt.value}: help supports --format=json or no --format (text)`);
+            return EXIT_USAGE;
+        }
+        return { json: fmt.kind === 'json' };
+    }
+    // Top-level help / `help ...` dispatcher runs BEFORE parseCliArgs because
+    // `flywheel --help` and `flywheel help ...` aren't valid command tokens —
+    // they'd fail COMMAND_TOKEN_PATTERN and return "unknown command" if we
+    // let the parser run first. Per-command help (`flywheel <cmd> --help`,
+    // `flywheel <cmd> --schema --help`) is detected AFTER parseCliArgs binds
+    // values to flags, so a call like `profile:set --name -h --base_url ...`
+    // does not incorrectly drop into help mode on the `-h` value token.
+    if (isHelpToken(first)) {
+        const resolved = resolveHelpFormat();
+        if (typeof resolved === 'number')
+            return resolved;
+        const extrasParsed = parseHelpExtras(argv);
+        if (extrasParsed.kind === 'invalid') {
+            writeLine(stderr, 'invalid --_help_extras payload');
+            return EXIT_USAGE;
+        }
+        const extras = extrasParsed.kind === 'ok' ? extrasParsed.extras : [];
+        stdout(resolved.json ? renderHelpAsJson(extras) : renderHelp(extras));
+        return 0;
+    }
+    if (first === 'help') {
+        const resolved = resolveHelpFormat();
+        if (typeof resolved === 'number')
+            return resolved;
+        // Strip --format and --_help_extras tokens so the positional <command>
+        // lookup isn't fooled by them occupying rest[0].
+        const helpArgs = stripHelpExtras(stripFormatTokens(rest));
+        const extrasParsed = parseHelpExtras(argv);
+        if (extrasParsed.kind === 'invalid') {
+            writeLine(stderr, 'invalid --_help_extras payload');
+            return EXIT_USAGE;
+        }
+        if (helpArgs.length === 0) {
+            const extras = extrasParsed.kind === 'ok' ? extrasParsed.extras : [];
+            stdout(resolved.json ? renderHelpAsJson(extras) : renderHelp(extras));
+            return 0;
+        }
+        // --_help_extras is only valid on top-level help. Surface mis-use
+        // as a usage error rather than silently ignoring it.
+        if (extrasParsed.kind === 'ok') {
+            writeLine(stderr, 'unknown flag: --_help_extras');
+            return EXIT_USAGE;
+        }
+        // `help <alias>` must resolve the same alias map used by the SHORTCUTS
+        // section so advertised shortcuts get executable help pages.
+        const rawCommandName = helpArgs[0];
+        const commandName = Object.prototype.hasOwnProperty.call(RUNTIME_ALIASES, rawCommandName)
+            ? RUNTIME_ALIASES[rawCommandName]
+            : rawCommandName;
+        const schema = helpArgs.slice(1).includes(SCHEMA_TOKEN);
+        return emitCommandHelp(stdout, stderr, commandName, schema, resolved.json);
+    }
+    // --_help_extras is reserved for top-level help dispatch only. Reject it
+    // when seen on any other command path so it cannot leak into runtime
+    // argument parsing downstream.
+    if (argv.some((t) => t.startsWith(HELP_EXTRAS_PREFIX))) {
+        writeLine(stderr, 'unknown flag: --_help_extras');
+        return EXIT_USAGE;
+    }
+    const parsed = parseCliArgs(argv);
+    if (!parsed.ok) {
+        writeLine(stderr, parsed.message);
+        return parsed.exitCode;
+    }
+    // Per-command help detection happens AFTER the parser has bound values
+    // to flags. `--help` / `-h` / `--schema` appear in parsed.params only
+    // when they were standalone flags on the command, never when they were
+    // consumed as a value for a preceding flag.
+    const helpRequested = parsed.params.help === true || parsed.params.h === true;
+    const schemaRequested = parsed.params.schema === true;
+    if (helpRequested) {
+        const resolved = resolveHelpFormat();
+        if (typeof resolved === 'number')
+            return resolved;
+        return emitCommandHelp(stdout, stderr, parsed.command, schemaRequested, resolved.json);
+    }
+    if (schemaRequested) {
+        writeLine(stderr, '--schema is only valid with --help');
+        return 1;
+    }
+    if (!getCommandByName(parsed.command)) {
+        writeLine(stderr, `unknown command: ${parsed.command}`);
+        return 1;
+    }
+    const handler = MVP_COMMAND_HANDLERS[parsed.command];
+    if (!handler) {
+        writeLine(stderr, `unknown command: ${parsed.command}`);
+        return 1;
+    }
+    const commandName = parsed.command;
+    const configPath = dependencies.configPath ?? resolveConfigPath();
+    const loadConfig = dependencies.loadConfig ?? loadAuthConfig;
+    const configExists = dependencies.configExists ?? defaultConfigExists;
+    const saveConfig = dependencies.saveConfig ?? saveAuthConfig;
+    const profileLoader = dependencies.loadProfile ?? loadProfile;
+    const resolveEnvApiKey = dependencies.resolveEnvApiKey ??
+        ((envVar) => process.env[envVar]?.trim() || undefined);
+    const writeOutputFile = dependencies.writeOutputFile ??
+        (async (path, contents) => {
+            await writeFile(path, contents);
+        });
+    let effectiveBaseUrl = DEFAULT_BASE_URL;
+    let globals = {};
+    try {
+        const extracted = extractGlobals(parsed.params);
+        globals = { ...extracted.globals, format: parsed.format, formatExplicit: parsed.formatExplicit };
+        const { handlerParams, flagNames } = extracted;
+        // `--env=<name>` accepts both legacy TOML profiles AND built-in
+        // profile names (prod / staging). Built-ins synthesise a minimal
+        // Profile so the rest of the pipeline (baseUrl resolution,
+        // per-profile keychain lookups, etc.) treats them uniformly. The
+        // built-in baseUrl is the runtime source of truth (never written to
+        // config.json); the `--env=<builtin>` invocation effectively flips
+        // the active profile for this one call without mutating disk state.
+        let profile = null;
+        if (globals.env) {
+            // Built-in names (`prod` / `staging`) are reserved and must always
+            // resolve to `BUILTIN_PROFILES`. Checking built-ins BEFORE the
+            // TOML loader prevents a stray `profiles/staging.toml` (e.g. left
+            // over from manual setup before built-ins existed) from silently
+            // shadowing the built-in and routing requests — and, via the
+            // per-profile key lookup in `resolveRuntimeAuthConfig`, stored
+            // credentials — to an unintended origin. `env:switch` enforces
+            // the same reservation; resolving built-ins first keeps
+            // `--env=<name>` and `env:switch --name <name>` in lockstep.
+            if (isBuiltinProfileName(globals.env)) {
+                const builtinBaseUrl = resolveBuiltinBaseUrl(globals.env);
+                if (builtinBaseUrl) {
+                    profile = { name: globals.env, baseUrl: builtinBaseUrl };
+                }
+            }
+            else {
+                const fromToml = await profileLoader(globals.env);
+                if (fromToml) {
+                    profile = fromToml;
+                }
+            }
+            if (!profile) {
+                const available = BUILTIN_PROFILE_NAMES.join(', ');
+                throw new CliUsageError(`unknown profile: ${globals.env}. Built-in profiles: ${available}`);
+            }
+        }
+        if (dependencies.loadConfig === undefined &&
+            !RUNTIME_CONFIG_OPTIONAL_COMMANDS.has(commandName)) {
+            // Env-only execution (CI/containers, scripted health checks) and
+            // profile-based auth resolve runtime config without the file on
+            // disk. Once `FLYWHEEL_BASE_URL` is set the CLI has enough to
+            // reach a server — the API key is a per-endpoint concern: some
+            // endpoints (e.g. `/auth/status`) are callable unauthenticated
+            // and return a "not authenticated" payload, and requiring a
+            // bogus `FLYWHEEL_API_KEY` just to satisfy the gate would force
+            // users to invent values for valid bootstrap/health-check flows.
+            // Server-side 401 is the right signal when a specific command
+            // needs auth and none is available.
+            const envBaseUrl = process.env.FLYWHEEL_BASE_URL?.trim();
+            const hasEnvBaseUrl = Boolean(envBaseUrl);
+            if (!profile && !hasEnvBaseUrl) {
+                const runtimeConfigExists = await configExists(configPath);
+                if (!runtimeConfigExists) {
+                    writeLine(stderr, buildMissingRuntimeConfigMessage(configPath));
+                    return EXIT_USAGE;
+                }
+            }
+        }
+        const config = await loadConfig(configPath);
+        const runtimeConfig = await resolveRuntimeAuthConfig(config, profile, resolveEnvApiKey);
+        effectiveBaseUrl = runtimeConfig.baseUrl;
+        const effectiveFormat = parsed.formatExplicit
+            ? parsed.format
+            : (runtimeConfig.defaultFormat ?? parsed.format);
+        const profileTimeoutS = typeof profile?.defaultTimeoutS === 'number' ? profile.defaultTimeoutS : undefined;
+        const effectiveTimeoutMs = typeof globals.timeoutS === 'number'
+            ? globals.timeoutS * 1000
+            : typeof profileTimeoutS === 'number'
+                ? profileTimeoutS * 1000
+                : undefined;
+        const buildClient = dependencies.createHttpClient ?? createHttpClient;
+        const client = buildClient({
+            baseUrl: runtimeConfig.baseUrl,
+            apiKey: runtimeConfig.apiKey,
+            cliVersion: CLI_VERSION,
+            commandName,
+            flagNames,
+            invocationId: randomUUID(),
+            retryMax: globals.retryMax,
+            retryEnabled: globals.retryEnabled,
+            debug: globals.debug,
+            timeoutMs: effectiveTimeoutMs,
+            idempotencyKey: globals.idempotencyKey,
+        });
+        const payload = await handler({
+            params: handlerParams,
+            requestJson: client.requestJson,
+            requestRaw: client.requestRaw,
+            requestRawExternal: client.requestRawExternal,
+            saveConfig,
+            configPath,
+            baseUrl: runtimeConfig.baseUrl,
+            apiKey: runtimeConfig.apiKey,
+            globals,
+            stderr,
+            stdout,
+            writeOutputFile,
+        });
+        if (payload === undefined || payload === null) {
+            return 0;
+        }
+        if (payload instanceof Uint8Array || payload instanceof Buffer) {
+            if (!globals.outPath) {
+                writeLine(stderr, `${commandName} returns binary output; pass --out=<path> or --out=- to write to stdout`);
+                return EXIT_USAGE;
+            }
+            if (globals.outPath === '-') {
+                // Route binary bytes through the injected stdout writer so
+                // programmatic runCli callers can capture them, matching the
+                // text-output path.
+                stdout(payload);
+            }
+            else {
+                await writeOutputFile(globals.outPath, payload);
+            }
+            return 0;
+        }
+        const rendered = renderOutput(payload, effectiveFormat);
+        if (globals.outPath) {
+            if (globals.outPath === '-') {
+                stdout(rendered);
+            }
+            else {
+                await writeOutputFile(globals.outPath, rendered);
+            }
+        }
+        else {
+            stdout(rendered);
+        }
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof CliUsageError) {
+            const augmented = error.message.startsWith('missing required parameter')
+                ? buildMissingParamHint(commandName, error.message)
+                : error.message;
+            writeLine(stderr, augmented);
+            return error.exitCode;
+        }
+        if (error instanceof CliApprovalPendingError) {
+            const envelope = {
+                error: {
+                    code: 'approval_required',
+                    message: error.message,
+                    exit_code: error.exitCode,
+                },
+            };
+            const errBody = envelope.error;
+            if (error.approvalUrl) {
+                errBody.approval_url = error.approvalUrl;
+            }
+            if (error.approvalRequestId) {
+                errBody.approval_request_id = error.approvalRequestId;
+            }
+            if (error.requiredSignoffs.length > 0) {
+                errBody.required_signoffs = error.requiredSignoffs;
+            }
+            if (error.grantId) {
+                errBody.grant_id = error.grantId;
+            }
+            if (error.serverResponse) {
+                errBody.server_response = error.serverResponse;
+            }
+            if (error.request) {
+                errBody.request = error.request;
+            }
+            writeLine(stderr, JSON.stringify(envelope));
+            return error.exitCode;
+        }
+        if (error instanceof CliFinalizeFailedError) {
+            const envelope = {
+                error: {
+                    code: 'finalize_failed',
+                    message: error.message,
+                    exit_code: error.exitCode,
+                    orphan_blob_ids: error.orphanBlobIds,
+                },
+            };
+            writeLine(stderr, JSON.stringify(envelope));
+            return error.exitCode;
+        }
+        if (error instanceof CliWaitTimeoutError) {
+            const envelope = {
+                error: {
+                    code: 'wait_timeout',
+                    message: error.message,
+                    exit_code: error.exitCode,
+                    last_state: error.lastState,
+                },
+            };
+            writeLine(stderr, JSON.stringify(envelope));
+            return error.exitCode;
+        }
+        if (error instanceof CliHttpError) {
+            let message = error.message;
+            if (error.status === 422 &&
+                (commandName === 'nodes:commit-new' || commandName === 'nodes:commit')) {
+                message = buildCommitSchemaHint(commandName, message);
+            }
+            message = buildLocalhostTransportHint(message, effectiveBaseUrl);
+            const code = error.status === 401 || error.status === 403
+                ? 'auth_error'
+                : error.status === undefined
+                    ? 'transport_error'
+                    : 'http_error';
+            const envelope = {
+                error: {
+                    code,
+                    message,
+                    exit_code: error.exitCode,
+                },
+            };
+            const inner = envelope.error;
+            if (typeof error.status === 'number') {
+                inner.server_response = { status: error.status, body: error.body };
+            }
+            if (error.request) {
+                inner.request = {
+                    method: error.request.method,
+                    path: error.request.path,
+                    request_id: error.request.requestId,
+                };
+            }
+            writeLine(stderr, JSON.stringify(envelope));
+            return error.exitCode;
+        }
+        if (error instanceof Error) {
+            writeLine(stderr, error.message);
+            return EXIT_TRANSPORT;
+        }
+        writeLine(stderr, 'runtime error');
+        return EXIT_TRANSPORT;
+    }
+    finally {
+        void globals;
+    }
+}
+async function main() {
+    const exitCode = await runCli(process.argv.slice(2), {});
+    process.exitCode = exitCode;
+}
+function isDirectExecution() {
+    const entrypoint = process.argv[1];
+    if (!entrypoint) {
+        return false;
+    }
+    return import.meta.url === pathToFileURL(resolve(entrypoint)).href;
+}
+if (isDirectExecution()) {
+    void main();
+}
+//# sourceMappingURL=main.js.map