@ponderbot/cli 0.1.0-alpha.21

package/dist/main.js

@@ -0,0 +1,2533 @@
+#!/usr/bin/env bun
+import { builtinModules } from "node:module";
+import { constants } from "node:fs";
+import { access, chmod, copyFile, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, extname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { RUN_TYPES, createClient, isPonderbotError, isRunType, ponderbotError, resolveEnvironment } from "@ponderbot/sdk";
+import { agentInstructionBudgets, buildManifest, checkSource, emitManifest, hasWorkerEntryHandlers, isManifestBuildError, loadProjectDefinition, loadSource, manifestBuildError, sourceWarnings } from "@ponderbot/sdk/authoring";
+import { Command } from "commander";
+import { cancelledResult, isLifecycleEvent, parseActionExecutionSnapshot, parseApplicationOrigin, parseSerializedExecutionBoundary, parseWorkerExecutionResult } from "@ponderbot/sdk/worker";
+import { watch } from "chokidar";
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+import { build } from "esbuild";
+import { createServer } from "node:http";
+import { createInterface } from "node:readline/promises";
+import { stderr, stdin } from "node:process";
+//#region src/config.ts
+const projectDir = () => resolve(process.cwd(), process.env.PONDERBOT_PROJECT ?? "./ponderbot");
+const exitConfig = (message) => {
+	console.error(`ponder: ${message}`);
+	process.exit(2);
+};
+const resolveProject = async () => {
+	const project = projectDir();
+	return {
+		project,
+		projectDefinition: await loadProjectDefinition(resolve(project, "config"))
+	};
+};
+const resolveConfig = async (envName) => requireExecutionSpace(await resolveEnvironmentConfig(envName));
+const resolveProjectReleaseConfig = async (envName) => resolveEnvironmentConfig(envName, { resolveApplicationOrigin: true });
+const resolveDevConfig = async (envName) => requireExecutionSpace(await resolveEnvironmentConfig(envName ?? "development", {
+	requireDevAllowed: true,
+	resolveApplicationOrigin: true,
+	useProjectEndpoint: true
+}));
+const resolveEnvironmentConfig = async (envName, options = {}) => {
+	let resolved;
+	const project = projectDir();
+	let projectDefinition;
+	try {
+		projectDefinition = await loadProjectDefinition(resolve(project, "config"));
+		resolved = resolveEnvironment(projectDefinition, envName);
+	} catch (error) {
+		return exitConfig(error instanceof Error ? error.message : String(error));
+	}
+	if (options.requireDevAllowed && !(resolved.projectEnvironment.allowDev ?? resolved.env === "development")) return exitConfig(`environment "${resolved.env}" does not allow ponder manifest dev`);
+	const endpoint = options.useProjectEndpoint ? {
+		baseUrl: resolved.projectEnvironment.url,
+		spaceId: resolved.projectEnvironment.spaceId
+	} : resolved.client;
+	let applicationOrigin;
+	if (options.resolveApplicationOrigin) try {
+		applicationOrigin = resolveProjectApplicationOrigin(projectDefinition);
+	} catch (error) {
+		return exitConfig(error instanceof Error ? error.message : String(error));
+	}
+	return {
+		project,
+		projectDefinition,
+		environment: resolved.env,
+		environmentRole: resolved.projectEnvironment.role ?? "execution",
+		allowDev: resolved.projectEnvironment.allowDev ?? resolved.env === "development",
+		sourceName: `${resolved.env}:${projectDefinition.name}`,
+		url: endpoint.baseUrl,
+		spaceId: endpoint.spaceId,
+		token: resolved.client.token,
+		applicationOrigin
+	};
+};
+const requireExecutionSpace = (config) => {
+	if (config.spaceId === void 0 || config.spaceId.length === 0) return exitConfig(`set spaceId for environment "${config.environment}" in ponderbot/config.ts or PONDERBOT_SPACE_ID for this command`);
+	return {
+		...config,
+		spaceId: config.spaceId
+	};
+};
+const resolveProjectApplicationOrigin = (projectDefinition) => {
+	const origin = projectDefinition.applicationOrigin;
+	if (origin === void 0) return;
+	const value = process.env[origin.env];
+	if (value === void 0 || value.length === 0) throw new Error(`application origin environment variable "${origin.env}" is not set`);
+	return parseApplicationOrigin(value);
+};
+const clientFor = (config) => createClient({
+	baseUrl: config.url,
+	token: config.token,
+	spaceId: config.spaceId
+});
+//#endregion
+//#region src/deployment-environment.ts
+const INERT_SOURCE_SETTINGS = {
+	allow_schedules: false,
+	allow_webhooks: false,
+	allow_manual_triggers: false
+};
+const reconcileDeploymentEnvironment = async (client, config) => {
+	if (config.environmentRole === "release-source") {
+		const { settings } = await client.spaces.settings.update(INERT_SOURCE_SETTINGS);
+		if (settings.allow_schedules !== false || settings.allow_webhooks !== false || settings.allow_manual_triggers !== false) throw new Error("release-source Space settings did not become execution-inert");
+	}
+};
+//#endregion
+//#region src/dev-manifest.ts
+const staticProjectManifest = (manifest) => ({
+	...manifest,
+	version: staticProjectVersion(manifest)
+});
+const staticProjectVersion = (manifest) => {
+	const sourceHash = createHash("sha256").update(JSON.stringify(manifest)).digest("hex").slice(0, 12);
+	return `${manifest.version ?? "dev"}-dev.${sourceHash}`;
+};
+//#endregion
+//#region src/dev-install.ts
+const INSTALL_CONCURRENCY = 8;
+/**
+* Installs the current Project Release for this environment into every Space
+* associated with the manifest, except the Space the dev loop deploys into.
+*
+* Every `ponder manifest dev` run calls this, whatever the environment role.
+* The `release-source` role only adds inert Space settings and skips the local
+* event tail; it does not own the install. A project with no associated Space
+* is normal, so an empty target list logs nothing.
+*/
+const installDevelopmentProjectRelease = async (client, config, manifestName) => {
+	const { space_ids: spaceIds } = await client.dev.manifests.targets(manifestName, config.environment);
+	const targets = spaceIds.filter((spaceId) => spaceId !== config.spaceId);
+	if (targets.length === 0) return targets;
+	await eachConcurrent(targets, INSTALL_CONCURRENCY, async (spaceId) => {
+		await client.projects.releases.install(manifestName, config.environment, spaceId);
+	});
+	console.log(`installed project release in ${targets.length} associated Spaces: ${targets.join(", ")}`);
+	return targets;
+};
+const eachConcurrent = async (values, concurrency, run) => {
+	let index = 0;
+	let failure;
+	const worker = async () => {
+		while (index < values.length) {
+			const value = values[index];
+			index += 1;
+			if (value !== void 0) try {
+				await run(value);
+			} catch (error) {
+				failure ??= error;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, () => worker()));
+	if (failure !== void 0) throw failure;
+};
+//#endregion
+//#region src/node-worker-runner.ts
+const MAXIMUM_WORKER_RESPONSE_BYTES = 1e6;
+const MAXIMUM_WORKER_STDERR_BYTES = 65536;
+const MAXIMUM_TIMER_DELAY = 2147483647;
+var NodeWorkerFailure = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.name = "NodeWorkerFailure";
+		this.reason = reason;
+	}
+};
+const createWorkerTermination = (input) => {
+	let aborted = false;
+	let forceKillTimer;
+	const abort = () => {
+		if (aborted) return;
+		aborted = true;
+		input.kill("SIGTERM");
+		forceKillTimer = input.schedule(() => {
+			if (input.isRunning()) input.kill("SIGKILL");
+		}, input.completionGraceMilliseconds);
+	};
+	const settle = () => {
+		if (forceKillTimer === void 0) return;
+		input.cancel(forceKillTimer);
+		forceKillTimer = void 0;
+	};
+	return {
+		abort,
+		settle,
+		wasAborted: () => aborted
+	};
+};
+const executePonderbotWorkerInNode = (async (options) => {
+	const { completionGraceMilliseconds, nodeBinary, signal, environment, stderr: stderrTarget, ...requestOptions } = options;
+	if (!Number.isSafeInteger(completionGraceMilliseconds) || completionGraceMilliseconds < 0 || completionGraceMilliseconds > MAXIMUM_TIMER_DELAY) throw new Error("invalid_worker_completion_grace");
+	const execution = parseSerializedExecutionBoundary(requestOptions.execution);
+	if (signal?.aborted) return cancellationResult(requestOptions.invocation, "caller_cancelled");
+	if (Date.parse(execution.deadlineAt) <= Date.now()) return cancellationResult(requestOptions.invocation, "deadline_exceeded");
+	const request = {
+		...requestOptions,
+		execution
+	};
+	const directory = await mkdtemp(join(tmpdir(), "ponderbot-node-worker-"));
+	const requestPath = join(directory, "request.json");
+	const responsePath = join(directory, "response.json");
+	try {
+		await writeFile(requestPath, `${JSON.stringify(request)}\n`, { mode: 384 });
+		const childResult = await runNodeWorker({
+			nodeBinary: nodeBinary ?? process.env.PONDERBOT_NODE_BINARY ?? "node",
+			requestPath,
+			responsePath,
+			execution: request.execution,
+			completionGraceMilliseconds,
+			signal,
+			environment
+		});
+		if (childResult.stderr.length > 0) (stderrTarget ?? process.stderr).write(childResult.stderr);
+		if (childResult.cancellationReason !== void 0) return cancellationResult(request.invocation, childResult.cancellationReason);
+		try {
+			if ((await stat(responsePath)).size > MAXIMUM_WORKER_RESPONSE_BYTES) throw new NodeWorkerFailure("runner_contract_invalid_result", "node_worker_response_too_large");
+			return parseWorkerExecutionResult(JSON.parse(await readFile(responsePath, "utf8")), { kind: request.invocation.kind });
+		} catch (error) {
+			if (error instanceof NodeWorkerFailure) throw error;
+			throw new NodeWorkerFailure(isRecord$2(error) && error.code === "ENOENT" ? "runner_contract_missing_result" : "runner_contract_invalid_result", errorMessage$1(error));
+		}
+	} finally {
+		await rm(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+});
+const actionCheckpoint = (invocation) => invocation.kind === "action" ? { onceRecords: invocation.execution.onceRecords } : void 0;
+const cancellationResult = (invocation, reason) => invocation.kind === "action" ? cancelledResult("action", reason, actionCheckpoint(invocation)) : cancelledResult("hook", reason);
+const runNodeWorker = async (input) => {
+	const workerExecutable = await resolveWorkerExecutable();
+	return new Promise((resolveRun, rejectRun) => {
+		const child = spawn(input.nodeBinary, [
+			workerExecutable,
+			"--request",
+			input.requestPath,
+			"--response",
+			input.responsePath
+		], {
+			stdio: [
+				"ignore",
+				"inherit",
+				"pipe"
+			],
+			...input.environment === void 0 ? {} : { env: {
+				...process.env,
+				...input.environment
+			} }
+		});
+		let stderr = "";
+		const deadlineAt = Date.parse(input.execution.deadlineAt);
+		const termination = createWorkerTermination({
+			completionGraceMilliseconds: input.completionGraceMilliseconds,
+			isRunning: () => child.exitCode === null && child.signalCode === null,
+			kill: (signal) => {
+				child.kill(signal);
+			},
+			schedule: setTimeout,
+			cancel: clearTimeout
+		});
+		const cancellation = createWorkerCancellation(termination);
+		let deadlineTimer;
+		const abortFromDeadline = () => {
+			cancellation.abort("deadline_exceeded");
+		};
+		const abortFromCaller = () => {
+			cancellation.abort("caller_cancelled");
+		};
+		const scheduleDeadline = () => {
+			const remaining = Math.max(0, deadlineAt - Date.now());
+			deadlineTimer = setTimeout(remaining > MAXIMUM_TIMER_DELAY ? scheduleDeadline : abortFromDeadline, Math.min(remaining, MAXIMUM_TIMER_DELAY));
+		};
+		scheduleDeadline();
+		const settle = () => {
+			clearTimeout(deadlineTimer);
+			termination.settle();
+			input.signal?.removeEventListener("abort", abortFromCaller);
+		};
+		child.stderr.setEncoding("utf8");
+		child.stderr.on("data", (chunk) => {
+			if (stderr.length < MAXIMUM_WORKER_STDERR_BYTES) stderr += chunk.slice(0, MAXIMUM_WORKER_STDERR_BYTES - stderr.length);
+		});
+		if (input.signal?.aborted) abortFromCaller();
+		else input.signal?.addEventListener("abort", abortFromCaller, { once: true });
+		child.on("error", (error) => {
+			settle();
+			rejectRun(error);
+		});
+		child.on("exit", (code) => {
+			settle();
+			const cancellationReason = cancellation.reason();
+			if (cancellationReason !== void 0) {
+				resolveRun({
+					stderr,
+					cancellationReason
+				});
+				return;
+			}
+			if (code === 0) {
+				resolveRun({ stderr });
+				return;
+			}
+			rejectRun(new NodeWorkerFailure(stderr.trim() === "invalid_node_worker_request" ? "runner_dispatch_failed" : "runner_failed", stderr.trim() || `node_worker_exited: ${code ?? "signal"}`));
+		});
+	});
+};
+const createWorkerCancellation = (termination) => {
+	let cancellationReason;
+	return {
+		abort: (reason) => {
+			if (cancellationReason !== void 0) return;
+			cancellationReason = reason;
+			termination.abort();
+		},
+		reason: () => cancellationReason
+	};
+};
+const resolveWorkerExecutable = async () => {
+	const sdkDirectory = dirname(dirname(fileURLToPath(import.meta.resolve("@ponderbot/sdk/worker"))));
+	const packageJson = JSON.parse(await readFile(join(sdkDirectory, "package.json"), "utf8"));
+	if (!isRecord$2(packageJson) || !isRecord$2(packageJson.bin) || typeof packageJson.bin["ponderbot-worker"] !== "string") throw new Error("ponderbot_worker_executable_missing");
+	return resolve(sdkDirectory, packageJson.bin["ponderbot-worker"]);
+};
+const isRecord$2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const errorMessage$1 = (error) => error instanceof Error ? error.message : String(error);
+//#endregion
+//#region src/output.ts
+const print = (data, options = {}) => {
+	if (options.json) {
+		console.log(JSON.stringify(jsonData(data)));
+		return;
+	}
+	for (const line of lines(data)) console.log(line);
+};
+const fail = (error, code = 1) => {
+	console.error(formatError(error));
+	process.exit(code);
+};
+const formatError = (error) => {
+	if (isManifestBuildError(error)) return error.message;
+	if (isPonderbotError(error)) {
+		const conflictVersion = manifestReleaseVersionConflict(error.detail);
+		if (conflictVersion !== void 0) return `version ${conflictVersion} is already released with different content — bump version in ponderbot/config.ts or rerun with --bump patch`;
+		return typeof error.detail === "undefined" ? error.code : JSON.stringify(error.detail);
+	}
+	if (error instanceof Error) return error.message;
+	return String(error);
+};
+const lines = (data) => {
+	if (isStartedDevStack(data)) return [
+		"Ponderbot dev stack ready.",
+		`  PONDERBOT_URL=${data.dev_environment.url}`,
+		`  PONDERBOT_SPACE_ID=${data.dev_environment.space_id}`,
+		`  PONDERBOT_TOKEN=${data.dev_environment.token}`,
+		"Put these in your app's .env - createClient() reads them."
+	];
+	if (isRecord$1(data) && isRecord$1(data.release) && typeof data.release.id === "string") return [
+		...versionBumpLines(data.version_bump),
+		`release ${data.release.id}`,
+		...recordLines(data.registered)
+	];
+	if (isRecord$1(data) && data.ok === true && isRecord$1(data.counts)) return ["manifest valid", ...recordLines(data.counts)];
+	if (isRecord$1(data) && Array.isArray(data.spaces)) return ["id name status", ...data.spaces.map((space) => spaceLine(space))];
+	if (isRecord$1(data) && isRecord$1(data.space)) {
+		if (isRecord$1(data.budget) && isRecord$1(data.usage)) return spaceShowLines(data.space, data.budget, data.usage);
+		return [spaceLine(data.space)];
+	}
+	if (isRecord$1(data) && isRecord$1(data.budget)) return recordLines(data.budget);
+	if (isRecord$1(data) && Array.isArray(data.models)) return ["ref provider model", ...data.models.map((model) => modelLine(model))];
+	if (isRecord$1(data) && isRecord$1(data.model)) return [modelLine(data.model)];
+	if (isRecord$1(data) && isRecord$1(data.agent_model_refs)) return ["agent model", ...Object.entries(data.agent_model_refs).map(([agentRef, modelRef]) => `${agentRef} ${String(modelRef)}`)];
+	if (isRecord$1(data) && isRecord$1(data.run)) return lines(data.run);
+	if (isRecord$1(data) && data.type === "provider_auth" && typeof data.provider === "string" && typeof data.method === "string" && typeof data.space_id === "string") {
+		if (typeof data.binding_id === "string") {
+			const target = data.all_spaces === true ? "all Spaces" : `Spaces ${Array.isArray(data.space_ids) ? data.space_ids.join(", ") : data.space_id}`;
+			return [
+				`provider ${data.provider} ${data.method} shared credentials saved for ${target}`,
+				`binding ${data.binding_id}`,
+				`smoke test: ${String(data.smoke_test ?? "ponder spaces show")}`
+			];
+		}
+		return [`provider ${data.provider} ${data.method} credentials saved for space ${data.space_id}`, `smoke test: ${String(data.smoke_test ?? "ponder spaces show")}`];
+	}
+	if (Array.isArray(data)) return data.flatMap((item) => lines(item));
+	if (isRecord$1(data)) {
+		const arrayEntry = Object.entries(data).find((entry) => Array.isArray(entry[1]));
+		if (arrayEntry) return arrayEntry[1].flatMap((item) => lines(item));
+		return [recordSummary(data)];
+	}
+	return [String(data)];
+};
+const versionBumpLines = (data) => {
+	if (!isRecord$1(data) || typeof data.previousVersion !== "string" || typeof data.nextVersion !== "string") return [];
+	return [`version ${data.previousVersion} → ${data.nextVersion}`];
+};
+const jsonData = (data) => {
+	if (!isStartedDevStack(data)) return data;
+	return {
+		...data,
+		dev_environment: {
+			url: data.dev_environment.url,
+			space_id: data.dev_environment.space_id,
+			token_env: "PONDERBOT_TOKEN"
+		}
+	};
+};
+function isStartedDevStack(data) {
+	return isRecord$1(data) && data.type === "stack" && data.status === "started" && isRecord$1(data.dev_environment) && typeof data.dev_environment.url === "string" && typeof data.dev_environment.space_id === "string" && typeof data.dev_environment.token === "string";
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+const manifestReleaseVersionConflict = (detail) => {
+	const details = isRecord$1(detail) ? detail.details : detail;
+	if (Array.isArray(details) && (details[0] === "manifest_release_version_conflict" || details[0] === "manifest_project_release_version_conflict") && typeof details[3] === "string") return details[3];
+};
+const recordLines = (data) => {
+	if (!isRecord$1(data)) return [];
+	return Object.entries(data).map(([key, value]) => `${key} ${String(value)}`);
+};
+function spaceShowLines(space, budget, usage) {
+	return [
+		spaceLine(space),
+		"budget",
+		...recordLines(budget),
+		...spaceUsageLines(usage)
+	];
+}
+function spaceUsageLines(usage) {
+	const period = isRecord$1(usage.period) ? usage.period : {};
+	const resources = isRecord$1(usage.usage) ? usage.usage : {};
+	return [`usage ${String(period.type ?? "unknown")} ${String(period.starts_at ?? "")} ${String(period.ends_at ?? "")}`.trim(), ...Object.entries(resources).map(([key, value]) => {
+		if (!isRecord$1(value)) return `${key} ${JSON.stringify(value)}`;
+		return [
+			key,
+			`used=${String(value.used ?? "")}`,
+			`limit=${limitValue(value.limit)}`,
+			`remaining=${limitValue(value.remaining)}`
+		].join(" ");
+	})];
+}
+const limitValue = (value) => {
+	return value === null ? "unlimited" : String(value);
+};
+const spaceLine = (space) => {
+	if (!isRecord$1(space)) return String(space);
+	return [
+		field(space, "id"),
+		field(space, "name"),
+		field(space, "status")
+	].filter((value) => value !== void 0).join(" ");
+};
+const modelLine = (model) => {
+	if (!isRecord$1(model)) return String(model);
+	return [
+		field(model, "ref"),
+		field(model, "provider"),
+		field(model, "model")
+	].filter((value) => value !== void 0).join(" ");
+};
+function recordSummary(record) {
+	const fields = [
+		field(record, "type") ?? field(record, "run_type") ?? field(record, "target_type"),
+		field(record, "id") ?? field(record, "run_id") ?? field(record, "record_id") ?? field(record, "receipt_id"),
+		field(record, "ref") ?? field(record, "target_ref") ?? field(record, "action"),
+		field(record, "status")
+	].filter((value) => value !== void 0);
+	return fields.length === 0 ? JSON.stringify(record) : fields.join(" ");
+}
+function field(record, name) {
+	const value = record[name];
+	return typeof value === "string" ? value : void 0;
+}
+//#endregion
+//#region src/dev-runner.ts
+const DEFAULT_DEV_ACTION_CONCURRENCY = 4;
+const CLAIM_FAILURE_BACKOFF_MILLISECONDS = 3e4;
+const runKey = (run) => "actionRunId" in run ? `action:${run.spaceId}:${run.actionRunId}` : `hook:${run.hookDelivery.id}`;
+const claimRequestId = (run) => "actionRunId" in run ? void 0 : run.hookDelivery.dev_runner.request_id;
+const blockClaim = (queue, run) => {
+	queue.claimBackoff.set(runKey(run), {
+		requestId: claimRequestId(run),
+		blockedUntil: Date.now() + CLAIM_FAILURE_BACKOFF_MILLISECONDS
+	});
+};
+const claimBlocked = (queue, run) => {
+	const key = runKey(run);
+	const backoff = queue.claimBackoff.get(key);
+	if (backoff === void 0) return false;
+	if (backoff.requestId === claimRequestId(run) && Date.now() < backoff.blockedUntil) return true;
+	queue.claimBackoff.delete(key);
+	return false;
+};
+const createDevActionRunner = (client, config, options = {}) => {
+	const state = {
+		stopped: false,
+		concurrency: Math.max(1, Math.floor(options.concurrency ?? DEFAULT_DEV_ACTION_CONCURRENCY)),
+		active: /* @__PURE__ */ new Map(),
+		idlePromise: Promise.resolve(),
+		pending: [],
+		scheduledIds: /* @__PURE__ */ new Set(),
+		claimBackoff: /* @__PURE__ */ new Map()
+	};
+	const enqueue = (queue, run) => {
+		const key = runKey(run);
+		if (queue.stopped || queue.scheduledIds.has(key)) return;
+		if (claimBlocked(queue, run)) return;
+		if (queue.scheduledIds.size === 0) queue.idlePromise = new Promise((resolve) => {
+			queue.resolveIdle = resolve;
+		});
+		queue.pending.push(run);
+		queue.scheduledIds.add(key);
+		drain(queue);
+	};
+	const drain = (queue) => {
+		while (!queue.stopped && queue.active.size < queue.concurrency && queue.pending.length > 0) {
+			const run = queue.pending.shift();
+			if (run === void 0) continue;
+			const key = runKey(run);
+			const active = {};
+			queue.active.set(key, active);
+			executeDevRun(run, active).finally(() => {
+				queue.active.delete(key);
+				queue.scheduledIds.delete(key);
+				drain(queue);
+				settleIdle(queue);
+			});
+		}
+	};
+	const settleIdle = (queue) => {
+		if (queue.scheduledIds.size > 0) return;
+		queue.resolveIdle?.();
+		queue.resolveIdle = void 0;
+	};
+	const executeDevRun = async (run, active) => {
+		if ("hookDelivery" in run) {
+			await executeDevHook(run.hookDelivery, active);
+			return;
+		}
+		await executeDevAction(run, active);
+	};
+	const executeDevAction = async ({ actionRunId, spaceId }, active) => {
+		let callback;
+		try {
+			let { run } = await client.runs.show("action", actionRunId, spaceId);
+			if (state.stopped || run.runner !== "dev" || run.status !== "running") return;
+			if (typeof run.dev_runner?.secret_grant === "string" && run.dev_runner.secret_grant.length > 0) {
+				try {
+					await client.dev.actionRuns.claim(actionRunId, spaceId);
+				} catch (claimError) {
+					if (!(isPonderbotError(claimError) && claimError.status === 409)) throw claimError;
+					({run} = await client.runs.show("action", actionRunId, spaceId));
+					if (state.stopped || run.runner !== "dev" || run.status !== "running") return;
+					blockClaim(state, {
+						actionRunId,
+						spaceId
+					});
+					console.error(formatError(claimError));
+					return;
+				}
+				({run} = await client.runs.show("action", actionRunId, spaceId));
+				if (state.stopped || run.runner !== "dev" || run.status !== "running") return;
+			}
+			const context = devCallContext(run, spaceId);
+			const actionExecution = devActionExecution(run);
+			const activeCallback = {
+				...devRunnerCallback(run),
+				checkpoint: { onceRecords: actionExecution.onceRecords }
+			};
+			callback = activeCallback;
+			const execution = devExecutionBoundary(run);
+			const controller = new AbortController();
+			active.requestId = activeCallback.requestId;
+			active.controller = controller;
+			const environment = await redeemActionSecretGrant(run, spaceId, config);
+			const result = await executePonderbotWorkerInNode({
+				dir: config.project,
+				dev: true,
+				invocation: {
+					kind: "action",
+					name: run.ref ?? actionRunId,
+					input: devInput(run),
+					execution: actionExecution
+				},
+				context,
+				execution,
+				applicationOrigin: config.applicationOrigin ?? devApplicationOrigin(run),
+				completionGraceMilliseconds: devCompletionGraceMilliseconds(run),
+				environment,
+				reload: true,
+				signal: controller.signal
+			});
+			if (state.stopped) return;
+			try {
+				await postRunnerCallback(activeCallback, devRunnerCallbackBody(result));
+			} catch (callbackError) {
+				logCallbackDeliveryError(callbackError);
+				return;
+			}
+		} catch (error) {
+			if (state.stopped) return;
+			if (callback === void 0) {
+				console.error(formatError(error));
+				return;
+			}
+			try {
+				await postRunnerCallback(callback, devRunnerFailureBody(error, callback.checkpoint));
+			} catch (callbackError) {
+				logCallbackDeliveryError(callbackError);
+			}
+			console.error(formatError(error));
+		}
+	};
+	const executeDevHook = async (offered, active) => {
+		let delivery;
+		try {
+			({delivery} = await client.dev.hookDeliveries.claim(offered.id, offered.space_id));
+		} catch (claimError) {
+			if (state.stopped) return;
+			if (isPonderbotError(claimError) && claimError.status === 404) return;
+			if (isPonderbotError(claimError) && claimError.status === 409) blockClaim(state, { hookDelivery: offered });
+			console.error(formatError(claimError));
+			return;
+		}
+		const callback = devHookCallback(delivery);
+		try {
+			const context = devHookContext(delivery);
+			const execution = devHookExecution(delivery);
+			const controller = new AbortController();
+			active.requestId = callback.requestId;
+			active.controller = controller;
+			let environment;
+			try {
+				environment = await redeemSecretGrant({
+					token: delivery.dev_runner.secret_grant,
+					kind: "hook",
+					ownerId: delivery.id,
+					spaceId: context.space_id,
+					releaseId: context.release_id,
+					runId: context.run_id,
+					attempt: context.attempt,
+					requestId: delivery.dev_runner.request_id,
+					runnerId: delivery.dev_runner.runner_id
+				}, config, `dev_hook_secret_delivery_failed: ${delivery.id}`, `dev_hook_secret_delivery_invalid: ${delivery.id}`);
+			} catch (redeemError) {
+				if (state.stopped) return;
+				if (!isSecretGrantContention(redeemError)) throw redeemError;
+				blockClaim(state, { hookDelivery: offered });
+				console.error(formatError(redeemError));
+				return;
+			}
+			const event = delivery.dev_runner.worker_command.event;
+			if (!isLifecycleEvent(event)) throw new Error(`dev_hook_event_invalid: ${delivery.id}`);
+			const result = await executePonderbotWorkerInNode({
+				dir: config.project,
+				dev: true,
+				invocation: {
+					kind: "hook",
+					name: delivery.dev_runner.worker_command.name,
+					event
+				},
+				context,
+				execution,
+				applicationOrigin: config.applicationOrigin,
+				completionGraceMilliseconds: 0,
+				environment,
+				reload: true,
+				signal: controller.signal
+			});
+			if (state.stopped) return;
+			try {
+				await postHookRunnerCallback(callback, devHookCallbackBody(result));
+			} catch (callbackError) {
+				logCallbackDeliveryError(callbackError);
+			}
+		} catch (error) {
+			if (state.stopped) return;
+			try {
+				await postHookRunnerCallback(callback, devHookFailureBody(error));
+			} catch (callbackError) {
+				logCallbackDeliveryError(callbackError);
+			}
+			console.error(formatError(error));
+		}
+	};
+	return {
+		async catchUp() {
+			const response = await client.runs.list({
+				type: "action",
+				status: "running"
+			});
+			for (const run of response.runs) if (run.runner === "dev") enqueue(state, {
+				actionRunId: run.id,
+				spaceId: config.spaceId
+			});
+		},
+		async catchUpManifest(manifestName) {
+			const response = await client.dev.manifests.actionRuns(manifestName, config.environment);
+			const runningKeys = new Set(response.runs.map((run) => runKey({
+				actionRunId: run.id,
+				spaceId: run.space_id
+			})));
+			const hookResponse = await client.dev.manifests.hookDeliveries(manifestName, config.environment);
+			const hookKeys = new Set(hookResponse.deliveries.map((delivery) => runKey({ hookDelivery: delivery })));
+			for (const [key, active] of state.active) if (!runningKeys.has(key) && !hookKeys.has(key)) active.controller?.abort(new DOMException("Runtime cancelled execution", "AbortError"));
+			for (const run of response.runs) enqueue(state, {
+				actionRunId: run.id,
+				spaceId: run.space_id
+			});
+			for (const delivery of hookResponse.deliveries) enqueue(state, { hookDelivery: delivery });
+		},
+		handleEvent(event) {
+			if (isDevActionDispatchHint(event)) {
+				enqueue(state, {
+					actionRunId: event.data.run_id,
+					spaceId: eventSpaceId(event, config.spaceId)
+				});
+				return;
+			}
+			if (isDevActionTerminalHint(event)) {
+				const active = state.active.get(runKey({
+					actionRunId: event.data.run_id,
+					spaceId: eventSpaceId(event, config.spaceId)
+				}));
+				if (active?.requestId === event.data.metadata.request_id) active.controller?.abort(new DOMException("Runtime cancelled execution", "AbortError"));
+			}
+		},
+		idle() {
+			return state.idlePromise;
+		},
+		stop() {
+			if (!state.stopped) {
+				state.stopped = true;
+				for (const run of state.pending) state.scheduledIds.delete(runKey(run));
+				state.pending.length = 0;
+				for (const active of state.active.values()) active.controller?.abort(new DOMException("Dev runner stopped", "AbortError"));
+				settleIdle(state);
+			}
+			return state.idlePromise;
+		}
+	};
+};
+const isDevActionTerminalHint = (event) => event.event === "run_updated" && isRecord(event.data) && event.data.type === "run_updated" && event.data.run_type === "action" && typeof event.data.run_id === "string" && isRecord(event.data.metadata) && event.data.metadata.runner === "dev" && typeof event.data.metadata.request_id === "string" && [
+	"cancelled",
+	"failed",
+	"completed"
+].includes(String(event.data.metadata.status));
+const isDevActionDispatchHint = (event) => event.event === "run_updated" && isRecord(event.data) && event.data.type === "run_updated" && event.data.run_type === "action" && typeof event.data.run_id === "string" && isRecord(event.data.metadata) && event.data.metadata.runner === "dev" && event.data.metadata.status === "running";
+const eventSpaceId = (event, fallback) => isRecord(event.data) && typeof event.data.space_id === "string" ? event.data.space_id : fallback;
+const isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const isJsonObject = (value) => isRecord(value) && Object.values(value).every(isJsonValue);
+const isJsonValue = (value) => value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean" || Array.isArray(value) && value.every(isJsonValue) || isJsonObject(value);
+const devInput = (run) => {
+	const input = run.input ?? {};
+	if (!isJsonObject(input)) throw new Error(`dev_runner_input_invalid: ${run.id}`);
+	return input;
+};
+const devCallContext = (run, spaceId) => {
+	const devRunner = run.dev_runner;
+	if (devRunner === null || devRunner === void 0 || typeof devRunner.runner_id !== "string") throw new Error(`dev_runner_context_missing: ${run.id}`);
+	if (devRunner.schedule_ref === void 0 !== (devRunner.scheduled_at === void 0)) throw new Error(`dev_runner_schedule_context_invalid: ${run.id}`);
+	const context = {
+		space_id: spaceId,
+		action_run_id: run.id,
+		run_type: "action",
+		run_id: run.id,
+		release_id: devReleaseId(run),
+		attempt: devAttempt(run),
+		runner_id: devRunner.runner_id,
+		metadata: { request_id: devRequestId(run) }
+	};
+	if (devRunner.principal !== void 0) context.principal = devRunner.principal;
+	if (devRunner.workflow_run_id !== void 0) context.workflow_run_id = devRunner.workflow_run_id;
+	if (devRunner.schedule_ref !== void 0 && devRunner.scheduled_at !== void 0) {
+		context.schedule_ref = devRunner.schedule_ref;
+		context.scheduled_at = devRunner.scheduled_at;
+	}
+	return context;
+};
+const devReleaseId = (run) => {
+	if (typeof run.release_id !== "string" || run.release_id.length === 0) throw new Error(`dev_runner_release_id_invalid: ${run.id}`);
+	return run.release_id;
+};
+const devApplicationOrigin = (run) => {
+	const origin = run.dev_runner?.application_origin;
+	if (origin === void 0) return;
+	if (typeof origin !== "string" || origin.length === 0) throw new Error(`dev_runner_application_origin_invalid: ${run.id}`);
+	return origin;
+};
+const devRunnerCallback = (run) => {
+	const devRunner = run.dev_runner;
+	if (devRunner === null || devRunner === void 0 || typeof devRunner.callback_url !== "string" || typeof devRunner.callback_token !== "string" || typeof devRunner.runner_id !== "string") throw new Error(`dev_runner_context_missing: ${run.id}`);
+	return {
+		url: devRunner.callback_url,
+		token: devRunner.callback_token,
+		runnerId: devRunner.runner_id,
+		requestId: devRequestId(run),
+		actionRunId: run.id,
+		attempt: devAttempt(run)
+	};
+};
+const devExecutionBoundary = (run) => {
+	const execution = run.dev_runner?.execution;
+	try {
+		const parsed = parseSerializedExecutionBoundary(execution);
+		if (parsed.cancellationId !== devRequestId(run)) throw new Error("execution_request_identity_mismatch");
+		return parsed;
+	} catch {
+		throw new Error(`dev_runner_execution_boundary_invalid: ${run.id}`);
+	}
+};
+const devActionExecution = (run) => {
+	try {
+		return parseActionExecutionSnapshot(run.dev_runner?.action_execution);
+	} catch {
+		throw new Error(`dev_runner_action_execution_invalid: ${run.id}`);
+	}
+};
+const devRequestId = (run) => {
+	const requestId = run.dev_runner?.request_id;
+	if (typeof requestId !== "string" || requestId.length === 0) throw new Error(`dev_runner_request_id_invalid: ${run.id}`);
+	return requestId;
+};
+const devAttempt = (run) => {
+	if (!Number.isSafeInteger(run.attempt) || Number(run.attempt) <= 0) throw new Error(`dev_runner_attempt_invalid: ${run.id}`);
+	return Number(run.attempt);
+};
+const devCompletionGraceMilliseconds = (run) => {
+	const seconds = run.dev_runner?.completion_grace_seconds;
+	if (!Number.isSafeInteger(seconds) || Number(seconds) < 0) throw new Error(`dev_runner_completion_grace_invalid: ${run.id}`);
+	const milliseconds = Number(seconds) * 1e3;
+	if (!Number.isSafeInteger(milliseconds)) throw new Error(`dev_runner_completion_grace_invalid: ${run.id}`);
+	return milliseconds;
+};
+const postRunnerCallback = async (callback, body) => {
+	const occurredAt = (/* @__PURE__ */ new Date()).toISOString();
+	const response = await fetch(callback.url, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${callback.token}`,
+			"content-type": "application/json",
+			"x-ponderbot-runner-event-id": [
+				"dev-action",
+				callback.actionRunId,
+				callback.attempt,
+				body.status,
+				globalThis.crypto.randomUUID()
+			].join(":"),
+			"x-ponderbot-runner-timestamp": occurredAt
+		},
+		body: JSON.stringify({
+			runner_id: callback.runnerId,
+			status: body.status,
+			exit_code: body.exit_code,
+			result: body.result,
+			reason: body.reason,
+			checkpoint: body.checkpoint,
+			suspension: body.suspension,
+			occurred_at: occurredAt
+		})
+	});
+	const responseBody = await response.json().catch(() => ({}));
+	if (!response.ok) {
+		const error = isRecord(responseBody) && responseBody.error !== void 0 ? responseBody.error : response.statusText;
+		throw ponderbotError(response.status, String(error), responseBody);
+	}
+};
+const devRunnerCallbackBody = (result) => {
+	switch (result.status) {
+		case "completed": return {
+			status: "completed",
+			exit_code: 0,
+			result: result.output,
+			reason: null,
+			checkpoint: result.checkpoint
+		};
+		case "suspended": return {
+			status: "suspended",
+			exit_code: 0,
+			result: {},
+			reason: null,
+			checkpoint: result.checkpoint,
+			suspension: result.suspension
+		};
+		case "failed": return {
+			status: "failed",
+			exit_code: 1,
+			result: { error: result.error.detail === void 0 ? {
+				code: result.error.code,
+				message: result.error.message
+			} : {
+				code: result.error.code,
+				message: result.error.message,
+				detail: result.error.detail
+			} },
+			reason: result.error.code,
+			checkpoint: result.checkpoint
+		};
+		case "cancelled": return {
+			status: "cancelled",
+			exit_code: result.reason === "deadline_exceeded" ? 124 : 130,
+			result: {},
+			reason: result.reason,
+			checkpoint: result.checkpoint
+		};
+	}
+};
+const devRunnerFailureBody = (error, checkpoint) => {
+	const message = errorMessage(error);
+	const reason = error instanceof NodeWorkerFailure ? error.reason : "runner_failed";
+	return {
+		status: "failed",
+		exit_code: 1,
+		result: { error: {
+			code: reason,
+			message
+		} },
+		reason,
+		checkpoint
+	};
+};
+const devHookCallback = (delivery) => ({
+	url: delivery.dev_runner.callback_url,
+	token: delivery.dev_runner.callback_token,
+	runnerId: delivery.dev_runner.runner_id,
+	hookDeliveryId: delivery.id,
+	requestId: delivery.dev_runner.request_id
+});
+const devHookContext = (delivery) => {
+	const context = delivery.dev_runner.context;
+	const spaceId = context.space_id;
+	const runId = context.run_id;
+	const releaseId = context.release_id;
+	const hookDeliveryId = context.hook_delivery_id;
+	const attempt = context.attempt;
+	if (typeof spaceId !== "string" || typeof runId !== "string" || typeof releaseId !== "string" || typeof hookDeliveryId !== "string" || typeof attempt !== "number" || !Number.isSafeInteger(attempt) || attempt <= 0) throw new Error(`dev_hook_context_invalid: ${delivery.id}`);
+	return {
+		space_id: spaceId,
+		run_id: runId,
+		release_id: releaseId,
+		hook_delivery_id: hookDeliveryId,
+		attempt,
+		runner_id: delivery.dev_runner.runner_id,
+		metadata: { request_id: delivery.dev_runner.request_id }
+	};
+};
+const devHookExecution = (delivery) => {
+	try {
+		const execution = delivery.dev_runner.context.execution;
+		const parsed = parseSerializedExecutionBoundary(execution);
+		if (parsed.cancellationId !== delivery.dev_runner.request_id) throw new Error("execution_request_identity_mismatch");
+		return parsed;
+	} catch {
+		throw new Error(`dev_hook_execution_boundary_invalid: ${delivery.id}`);
+	}
+};
+const redeemActionSecretGrant = async (run, spaceId, config) => {
+	const grant = run.dev_runner?.secret_grant;
+	if (grant === void 0) return;
+	if (typeof grant !== "string" || grant.length === 0) throw new Error(`dev_runner_secret_grant_invalid: ${run.id}`);
+	return redeemSecretGrant({
+		token: grant,
+		kind: "action",
+		ownerId: run.id,
+		spaceId,
+		releaseId: devReleaseId(run),
+		runId: run.id,
+		attempt: devAttempt(run),
+		requestId: devRequestId(run),
+		runnerId: devRunnerCallback(run).runnerId
+	}, config, `dev_action_secret_delivery_failed: ${run.id}`, `dev_action_secret_delivery_invalid: ${run.id}`);
+};
+const redeemSecretGrant = async (identity, config, failed, invalid) => {
+	const response = await fetch(`${config.url}/api/internal/secret-delivery/redeem`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			token: identity.token,
+			kind: identity.kind,
+			owner_id: identity.ownerId,
+			space_id: identity.spaceId,
+			release_id: identity.releaseId,
+			run_id: identity.runId,
+			attempt: identity.attempt,
+			request_id: identity.requestId,
+			runner_id: identity.runnerId
+		})
+	});
+	const body = await response.json().catch(() => void 0);
+	if (!response.ok) {
+		const code = isRecord(body) && typeof body.error === "string" ? body.error : "unknown_error";
+		throw Object.assign(ponderbotError(response.status, code, body), { message: `${failed}: HTTP ${response.status} ${code}` });
+	}
+	if (!isRecord(body) || !isRecord(body.env)) throw new Error(invalid);
+	const environment = {};
+	for (const [name, value] of Object.entries(body.env)) {
+		if (typeof value !== "string") throw new Error(invalid);
+		environment[name] = value;
+	}
+	return environment;
+};
+const postHookRunnerCallback = async (callback, body) => {
+	const occurredAt = (/* @__PURE__ */ new Date()).toISOString();
+	const response = await fetch(callback.url, {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${callback.token}`,
+			"content-type": "application/json",
+			"x-ponderbot-runner-event-id": [
+				"dev-hook",
+				callback.hookDeliveryId,
+				callback.requestId,
+				body.status,
+				globalThis.crypto.randomUUID()
+			].join(":"),
+			"x-ponderbot-runner-timestamp": occurredAt
+		},
+		body: JSON.stringify({
+			runner_id: callback.runnerId,
+			status: body.status,
+			exit_code: body.exit_code,
+			result: body.result,
+			reason: body.reason,
+			occurred_at: occurredAt
+		})
+	});
+	const responseBody = await response.json().catch(() => ({}));
+	if (!response.ok) {
+		const error = isRecord(responseBody) && responseBody.error !== void 0 ? responseBody.error : response.statusText;
+		throw ponderbotError(response.status, String(error), responseBody);
+	}
+};
+const devHookCallbackBody = (result) => {
+	switch (result.status) {
+		case "completed": return {
+			status: "completed",
+			exit_code: 0,
+			result: result.output,
+			reason: null
+		};
+		case "failed": return {
+			status: "failed",
+			exit_code: 1,
+			result: { error: result.error },
+			reason: result.error.code
+		};
+		case "cancelled": return {
+			status: "cancelled",
+			exit_code: result.reason === "deadline_exceeded" ? 124 : 130,
+			result: {},
+			reason: result.reason
+		};
+	}
+};
+const devHookFailureBody = (error) => ({
+	status: "failed",
+	exit_code: 1,
+	result: { error: {
+		code: error instanceof NodeWorkerFailure ? error.reason : "runner_failed",
+		message: errorMessage(error)
+	} },
+	reason: error instanceof NodeWorkerFailure ? error.reason : "runner_failed"
+});
+const errorMessage = (error) => {
+	return error instanceof Error ? error.message : String(error);
+};
+const logCallbackDeliveryError = (error) => {
+	if (isAttemptSupersededCallbackError(error)) return;
+	console.error(formatError(error));
+};
+const SECRET_GRANT_CONTENTION_CODES = ["secret_delivery_grant_redeemed", "secret_delivery_grant_not_active"];
+const isSecretGrantContention = (error) => isPonderbotError(error) && error.status === 409 && SECRET_GRANT_CONTENTION_CODES.includes(error.code);
+const isAttemptSupersededCallbackError = (error) => {
+	return isPonderbotError(error) && [401, 409].includes(error.status);
+};
+//#endregion
+//#region src/events.ts
+function followEvents(client, onEvent, options = {}) {
+	const controller = new AbortController();
+	return {
+		stop: () => controller.abort(),
+		done: runEventTail(client, onEvent, controller, options)
+	};
+}
+async function runEventTail(client, onEvent, controller, options) {
+	try {
+		for await (const event of client.events.streamEvents({
+			signal: controller.signal,
+			initialRetryMs: options.retryMs,
+			onReconnect: options.onReconnect
+		})) onEvent(event);
+	} catch (error) {
+		if (!controller.signal.aborted) {
+			if (options.onError) {
+				options.onError(error);
+				return;
+			}
+			throw error;
+		}
+	}
+}
+//#endregion
+//#region src/manifest-diagnostics.ts
+const printManifestDiagnostics = (budgets, warnings) => {
+	if (budgets.length > 0) {
+		console.error("agent instruction sizes:");
+		for (const budget of budgets) console.error(`  ${budget.ref}: ${instructionBudgetSummary(budget)}`);
+	}
+	for (const warning of warnings) console.error(`${warning.file}: warning: ${warning.message}`);
+};
+const instructionBudgetSummary = (budget) => {
+	const suffix = budget.overWarning ? " over budget" : "";
+	return `${formatCount(budget.chars)} chars (~${formatCount(budget.approxTokens)} tokens)${suffix}`;
+};
+const formatCount = (value) => value >= 1e3 ? `${(value / 1e3).toFixed(1)}k` : `${value}`;
+//#endregion
+//#region src/dev.ts
+const DEBOUNCE_MS = 300;
+const DEV_RUN_POLL_MS = 750;
+const SHUTDOWN_GRACE_MS = 2e3;
+async function devLoop(config) {
+	const client = clientFor(config);
+	let timer;
+	let building = false;
+	let queued = false;
+	let stopped = false;
+	let watcher;
+	let tail;
+	let runPoll;
+	let pollingRuns = false;
+	let manifestName;
+	await ensureDevSpace$1(client, config);
+	await reconcileDeploymentEnvironment(client, config);
+	const devRunner = createDevActionRunner(client, config);
+	const stop = async () => {
+		if (stopped) return;
+		stopped = true;
+		queued = false;
+		if (timer) clearTimeout(timer);
+		if (runPoll) clearInterval(runPoll);
+		tail?.stop();
+		const cleanup = Promise.allSettled([watcher?.close(), devRunner.stop()]);
+		await Promise.race([cleanup, new Promise((resolve) => setTimeout(resolve, SHUTDOWN_GRACE_MS))]);
+		process.exit(0);
+	};
+	const handleSignal = () => {
+		stop().catch((error) => {
+			console.error(formatError(error));
+			process.exit(1);
+		});
+	};
+	process.once("SIGINT", handleSignal);
+	process.once("SIGTERM", handleSignal);
+	async function rebuild(reason) {
+		if (stopped) return;
+		if (building) {
+			queued = true;
+			return;
+		}
+		building = true;
+		try {
+			const { manifest, warnings, instructionBudgets } = await buildManifest(config.project, {
+				dev: true,
+				reload: true
+			});
+			printManifestDiagnostics(instructionBudgets, warnings);
+			const developmentManifest = staticProjectManifest(manifest);
+			const release = await client.manifests.deploy(developmentManifest, `dev:${reason}`);
+			await client.projects.releases.deploy(developmentManifest.name, config.environment, developmentManifest, `dev:${reason}`, void 0, config.applicationOrigin);
+			console.log(deployLine(release, reason));
+			manifestName = developmentManifest.name;
+			await installDevelopmentProjectRelease(client, config, developmentManifest.name);
+		} catch (error) {
+			console.error(formatError(error));
+		} finally {
+			building = false;
+			if (queued && !stopped) {
+				queued = false;
+				rebuild("queued-changes");
+			}
+		}
+	}
+	watcher = watch(config.project, { ignoreInitial: true });
+	watcher.on("all", (_event, file) => {
+		if (stopped) return;
+		if (timer) clearTimeout(timer);
+		timer = setTimeout(() => void rebuild(file || "change"), DEBOUNCE_MS);
+	});
+	await new Promise((resolve, reject) => {
+		watcher?.once("ready", resolve);
+		watcher?.once("error", reject);
+	});
+	await rebuild("startup");
+	const catchUpManifest = async () => {
+		if (pollingRuns || manifestName === void 0 || stopped) return;
+		pollingRuns = true;
+		try {
+			await devRunner.catchUpManifest(manifestName);
+		} catch (error) {
+			console.error(formatError(error));
+		} finally {
+			pollingRuns = false;
+		}
+	};
+	await catchUpManifest();
+	runPoll = setInterval(() => void catchUpManifest(), DEV_RUN_POLL_MS);
+	if (config.environmentRole === "release-source") return;
+	await devRunner.catchUp().catch((error) => console.error(formatError(error)));
+	tail = followEvents(client, (event) => {
+		print(event);
+		devRunner.handleEvent(event);
+	}, {
+		onError: (error) => console.error(formatError(error)),
+		onReconnect: () => {
+			devRunner.catchUp().catch((error) => console.error(formatError(error)));
+		}
+	});
+}
+async function ensureDevSpace$1(client, config) {
+	try {
+		await client.spaces.get();
+	} catch (error) {
+		if (isPonderbotError(error) && error.status === 404 && error.code === "space_not_found") throw new Error(`space "${config.spaceId}" not found; run: ponder spaces create ${config.spaceId}`);
+		throw error;
+	}
+}
+const deployLine = (response, reason) => {
+	return [`deployed ${response.release.id} (${reason})`, ...Object.entries(response.registered).map(([key, value]) => `${key} ${value}`)].join(" ");
+};
+//#endregion
+//#region src/worker-artifact-dependencies.ts
+const NATIVE_FILE_PATTERN = /\.(?:wasm|node|gyp|c|cc|cpp|cxx|h|hpp|hxx)$/i;
+const builtins = new Set([...builtinModules, ...builtinModules.map((name) => `node:${name}`)]);
+const workerArtifactDependencyCollector = (forcedExternal) => {
+	const forced = new Set(forcedExternal);
+	const dependencies = /* @__PURE__ */ new Map();
+	const packageCache = /* @__PURE__ */ new Map();
+	const nativeCache = /* @__PURE__ */ new Map();
+	return {
+		dependencies: () => Object.fromEntries([...dependencies].sort()),
+		plugin: {
+			name: "ponderbot-worker-artifact-dependencies",
+			setup(build) {
+				build.onResolve({ filter: /.*/ }, async (args) => {
+					if (!isPackageImport(args.path) || builtins.has(args.path) || args.pluginData?.ponderbotDependencyProbe === true) return;
+					const importName = packageName(args.path);
+					if (dependencies.has(importName)) return {
+						path: args.path,
+						external: true
+					};
+					const resolved = await build.resolve(args.path, {
+						importer: args.importer,
+						kind: args.kind,
+						namespace: args.namespace,
+						resolveDir: args.resolveDir,
+						pluginData: { ponderbotDependencyProbe: true }
+					});
+					if (resolved.errors.length > 0 || resolved.path === "") return;
+					const identity = await packageIdentity(resolved.path, packageCache);
+					if (identity === null) {
+						if (forced.has(importName)) return { errors: [{ text: `External Worker dependency ${importName} has no package name and version` }] };
+						return;
+					}
+					if (!(forced.has(importName) || await packageUsesNativeCode(identity, resolved.path, nativeCache))) return;
+					dependencies.set(importName, identity.name === importName ? identity.version : `npm:${identity.name}@${identity.version}`);
+					return {
+						path: args.path,
+						external: true
+					};
+				});
+			}
+		}
+	};
+};
+const isPackageImport = (specifier) => ![
+	".",
+	"/",
+	"~",
+	"#",
+	"file:",
+	"data:"
+].some((prefix) => specifier.startsWith(prefix));
+const packageName = (specifier) => {
+	const parts = specifier.split("/");
+	return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0] ?? specifier;
+};
+const packageIdentity = async (resolvedPath, cache) => {
+	let directory = dirname(resolvedPath);
+	const root = parse(directory).root;
+	while (directory !== root) {
+		if (cache.has(directory)) return cache.get(directory) ?? null;
+		try {
+			const packageJson = JSON.parse(await readFile(join(directory, "package.json"), "utf8"));
+			if (typeof packageJson.name === "string" && packageJson.name !== "" && typeof packageJson.version === "string" && packageJson.version !== "") {
+				const identity = {
+					name: packageJson.name,
+					root: directory,
+					version: packageJson.version,
+					packageJson
+				};
+				cache.set(directory, identity);
+				return identity;
+			}
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		directory = dirname(directory);
+	}
+	cache.set(dirname(resolvedPath), null);
+	return null;
+};
+const packageUsesNativeCode = async (identity, resolvedPath, cache) => {
+	if (NATIVE_FILE_PATTERN.test(resolvedPath)) return true;
+	const cached = cache.get(identity.root);
+	if (cached !== void 0) return cached;
+	const declaredFiles = [...Array.isArray(identity.packageJson.files) ? identity.packageJson.files.filter((file) => typeof file === "string") : [], ...[
+		"main",
+		"module",
+		"browser"
+	].flatMap((field) => {
+		const value = identity.packageJson[field];
+		return typeof value === "string" ? [value] : [];
+	})];
+	let bindingGyp = false;
+	try {
+		await access(join(identity.root, "binding.gyp"));
+		bindingGyp = true;
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const native = identity.packageJson.gypfile === true || bindingGyp || declaredFiles.some((file) => NATIVE_FILE_PATTERN.test(file));
+	cache.set(identity.root, native);
+	return native;
+};
+//#endregion
+//#region src/worker-artifact.ts
+const ARTIFACT_FORMAT = "ponderbot-worker-artifact/v1";
+const PROJECT_DIRECTORY = "project";
+const WORKER_MAIN = "worker-main.ts";
+var WorkerArtifactError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WorkerArtifactError";
+	}
+};
+const containerfile = (hasDependencies) => `# syntax=docker/dockerfile:1.7
+${hasDependencies ? `FROM node:24-bookworm-slim AS dependencies
+WORKDIR /opt/ponderbot
+RUN apt-get update && apt-get install -y --no-install-recommends python3 make g++ && rm -rf /var/lib/apt/lists/*
+COPY package.json ./
+RUN npm install --omit=dev --no-package-lock --no-audit --no-fund
+` : ""}FROM node:24-bookworm-slim
+ENV NODE_ENV=production
+ENV PONDERBOT_PROJECT_DIR=/opt/ponderbot/project
+WORKDIR /workspace
+${hasDependencies ? "COPY --from=dependencies --chown=node:node /opt/ponderbot/node_modules /opt/ponderbot/node_modules\n" : ""}COPY --chown=node:node . /opt/ponderbot
+USER node
+ENTRYPOINT ["node", "/opt/ponderbot/worker-main.js"]
+`;
+const buildWorkerArtifact = async (source, projectDir, options = {}) => {
+	const projectRoot = resolve(projectDir);
+	const root = await mkdtemp(join(tmpdir(), "ponderbot-worker-artifact-"));
+	const entries = join(root, "entries");
+	const context = join(root, "artifact");
+	try {
+		await mkdir(entries, { recursive: true });
+		await mkdir(context, { recursive: true });
+		const definitionFiles = [
+			await projectConfigFile(projectRoot),
+			...source.actions.map(({ file }) => file),
+			...source.agents.map(({ file }) => file),
+			...source.groups.map(({ file }) => file),
+			...source.workflows.map(({ file }) => file)
+		];
+		const entrypoints = [];
+		const entryPaths = /* @__PURE__ */ new Set();
+		for (const file of [...new Set(definitionFiles)].sort()) {
+			const projectPath = artifactProjectPath(projectRoot, file);
+			const entryPath = join(entries, PROJECT_DIRECTORY, projectPath.slice(0, -extname(projectPath).length) + ".ts");
+			if (entryPaths.has(entryPath)) throw new WorkerArtifactError(`Worker artifact entry path collision for ${projectPath}`);
+			entryPaths.add(entryPath);
+			await mkdir(dirname(entryPath), { recursive: true });
+			await writeFile(entryPath, definitionWrapper(resolve(file)), { mode: 384 });
+			entrypoints.push(entryPath);
+		}
+		const workerEntry = join(entries, WORKER_MAIN);
+		await writeFile(workerEntry, workerMainWrapper(), { mode: 384 });
+		entrypoints.push(workerEntry);
+		console.error(`bundling ${entrypoints.length - 1} Ponderbot definition modules`);
+		const dependencies = await bundleEntries(entries, context, entrypoints, options.external ?? []);
+		const assetFiles = /* @__PURE__ */ new Set();
+		for (const skill of source.skills) assetFiles.add(skill.file);
+		for (const agent of source.agents) {
+			assetFiles.add(agent.instructionsFile);
+			if (agent.soulFile !== void 0) assetFiles.add(agent.soulFile);
+		}
+		for (const file of [...assetFiles].sort()) {
+			const destination = join(context, PROJECT_DIRECTORY, artifactProjectPath(projectRoot, file));
+			await mkdir(dirname(destination), { recursive: true });
+			await copyFile(file, destination);
+		}
+		await writeFile(join(context, "package.json"), `${JSON.stringify({
+			name: "ponderbot-worker-artifact",
+			private: true,
+			type: "module",
+			engines: { node: ">=22.4.0" },
+			dependencies
+		}, null, 2)}\n`, { mode: 384 });
+		const dockerfile = join(context, "Containerfile");
+		await writeFile(dockerfile, containerfile(Object.keys(dependencies).length > 0), { mode: 384 });
+		const contentHash = await artifactContentHash(context);
+		await writeFile(join(context, "ponderbot-build.json"), `${JSON.stringify({
+			format: ARTIFACT_FORMAT,
+			content_hash: contentHash,
+			project: {
+				name: source.project.name,
+				version: source.project.version ?? null
+			},
+			definition_modules: entrypoints.length - 1,
+			external_dependencies: Object.keys(dependencies).length
+		}, null, 2)}\n`, { mode: 384 });
+		return {
+			context,
+			dockerfile,
+			dispose: async () => rm(root, {
+				recursive: true,
+				force: true
+			})
+		};
+	} catch (error) {
+		await rm(root, {
+			recursive: true,
+			force: true
+		});
+		if (error instanceof WorkerArtifactError) throw error;
+		throw new WorkerArtifactError(error instanceof Error ? error.message : String(error));
+	}
+};
+const projectConfigFile = async (projectRoot) => {
+	for (const extension of [
+		".ts",
+		".js",
+		".mjs"
+	]) {
+		const path = join(projectRoot, `config${extension}`);
+		try {
+			await access(path);
+			return path;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+	throw new WorkerArtifactError(`Ponderbot project config was not found under ${projectRoot}`);
+};
+const artifactProjectPath = (projectRoot, file) => {
+	const projectPath = relative(projectRoot, resolve(file));
+	if (projectPath === ".." || projectPath.startsWith(`..${sep}`) || isAbsolute(projectPath)) throw new WorkerArtifactError(`Ponderbot definition ${file} must be inside project ${projectRoot}`);
+	return projectPath;
+};
+const definitionWrapper = (file) => {
+	const specifier = JSON.stringify(file);
+	return `export * from ${specifier};
+import * as loaded from ${specifier};
+export default loaded.default;
+`;
+};
+const workerMainWrapper = () => {
+	const workerModule = fileURLToPath(import.meta.resolve("@ponderbot/sdk/worker"));
+	return `import { runNodeWorkerMain } from ${JSON.stringify(workerModule)};
+await runNodeWorkerMain();
+`;
+};
+const bundleEntries = async (root, outdir, entrypoints, forcedExternal) => {
+	const collector = workerArtifactDependencyCollector(forcedExternal);
+	try {
+		await build({
+			entryPoints: entrypoints,
+			outbase: root,
+			outdir,
+			bundle: true,
+			splitting: true,
+			packages: "bundle",
+			platform: "node",
+			target: "node22.4",
+			format: "esm",
+			sourcemap: false,
+			minifySyntax: true,
+			minifyWhitespace: true,
+			keepNames: true,
+			legalComments: "none",
+			entryNames: "[dir]/[name]",
+			chunkNames: "chunks/[name]-[hash]",
+			assetNames: "assets/[name]-[hash]",
+			plugins: [collector.plugin],
+			logLevel: "silent"
+		});
+		return collector.dependencies();
+	} catch (error) {
+		throw new WorkerArtifactError(`Ponderbot Worker artifact bundle failed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+};
+const artifactContentHash = async (context) => {
+	const files = [];
+	const pending = [context];
+	while (pending.length > 0) {
+		const directory = pending.pop();
+		if (directory === void 0) break;
+		for (const entry of await readdir(directory, { withFileTypes: true })) {
+			const path = join(directory, entry.name);
+			if (entry.isDirectory()) pending.push(path);
+			else if (entry.isFile()) files.push(path);
+		}
+	}
+	const hash = createHash("sha256");
+	for (const file of files.sort()) {
+		hash.update(relative(context, file).split(sep).join("/"));
+		hash.update("\0");
+		hash.update(await readFile(file));
+		hash.update("\0");
+	}
+	return `sha256:${hash.digest("hex")}`;
+};
+//#endregion
+//#region src/worker-image.ts
+const WORKER_IMAGE_TAG_ENV = "PONDERBOT_WORKER_IMAGE_TAG";
+const WORKER_IMAGE_TAG_TOKEN = "${PONDERBOT_WORKER_IMAGE_TAG}";
+const WORKER_IMAGE_TAG_ERROR = "PONDERBOT_WORKER_IMAGE_TAG must be a tag or sha256 digest; pass full refs via --image";
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+var WorkerImageError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WorkerImageError";
+	}
+};
+async function deployManifestPlan(projectDir, options = {}) {
+	const source = await loadSource(projectDir, { reload: true });
+	const staticRelease = options.staticRelease === true && options.image === void 0;
+	const explicit = staticRelease ? void 0 : configuredWorkerImage(source.project, options.image);
+	const hasHandlers = hasWorkerEntryHandlers(source);
+	const errors = checkSource(setWorkerImage(source, explicit), { requireWorkerImage: hasHandlers && explicit === void 0 && !staticRelease && source.project.worker?.build === void 0 });
+	if (errors.length > 0) throw manifestBuildError(errors);
+	const plan = await resolveBuiltWorkerImage(source, projectDir, explicit, options, staticRelease);
+	const finalSource = setWorkerImage(source, plan.workerImage ?? explicit);
+	const manifest = emitManifest(finalSource, {
+		dev: staticRelease,
+		workerImage: finalSource.project.workerImage
+	});
+	return {
+		manifest: staticRelease ? staticProjectManifest(manifest) : manifest,
+		workerImage: plan.workerImage,
+		warnings: sourceWarnings(finalSource),
+		instructionBudgets: agentInstructionBudgets(finalSource)
+	};
+}
+async function resolveBuiltWorkerImage(source, projectDir, explicit, options, staticRelease) {
+	if (!hasWorkerEntryHandlers(source)) return {};
+	if (explicit !== void 0) return { workerImage: explicit };
+	if (staticRelease) return {};
+	const build = source.project.worker?.build;
+	if (build === void 0) return {};
+	return { workerImage: await buildAndPushWorkerImage(source, build, projectDir, options.platform) };
+}
+const setWorkerImage = (source, workerImage) => {
+	return {
+		...source,
+		project: {
+			...source.project,
+			workerImage
+		}
+	};
+};
+function configuredWorkerImage(project, override) {
+	const envValue = process.env[WORKER_IMAGE_TAG_ENV];
+	return resolveWorkerImage(envValue === void 0 || envValue.length === 0 ? project.workerImage : project.workerImage ?? project.worker?.build?.image, override, envValue);
+}
+function resolveWorkerImage(configured, override, envTag) {
+	if (override !== void 0) return override;
+	const tagOrDigest = envTag === "" ? void 0 : envTag;
+	if (tagOrDigest === void 0) return configured?.includes("${PONDERBOT_WORKER_IMAGE_TAG}") ? void 0 : configured;
+	if (configured === void 0) return;
+	if (DIGEST_PATTERN.test(tagOrDigest)) return `${repository(configured)}@${tagOrDigest}`;
+	if (tagOrDigest.includes("/") || tagOrDigest.includes("@") || tagOrDigest.includes(":")) throw new WorkerImageError(WORKER_IMAGE_TAG_ERROR);
+	if (configured.includes("${PONDERBOT_WORKER_IMAGE_TAG}")) return configured.split(WORKER_IMAGE_TAG_TOKEN).join(tagOrDigest);
+	return `${repository(configured)}:${tagOrDigest}`;
+}
+async function buildAndPushWorkerImage(source, build, projectDir, platform) {
+	const tag = build.image;
+	const repo = repository(tag);
+	const configuredContext = resolve(process.cwd(), build.context ?? ".");
+	const metadataDirectory = await mkdtemp(join(tmpdir(), "ponderbot-worker-buildx-"));
+	const metadataFile = join(metadataDirectory, "metadata.json");
+	let artifact;
+	try {
+		let context = configuredContext;
+		let dockerfile = resolve(process.cwd(), build.dockerfile ?? "Containerfile");
+		if (build.dockerfile === void 0) {
+			const resolvedContext = await realpath(configuredContext);
+			projectDirectoryInContext(await realpath(projectDir), resolvedContext);
+			try {
+				artifact = await buildWorkerArtifact(source, projectDir, { external: build.external });
+			} catch (error) {
+				if (error instanceof WorkerArtifactError) throw new WorkerImageError(error.message);
+				throw error;
+			}
+			context = artifact.context;
+			dockerfile = artifact.dockerfile;
+		}
+		const cacheReference = `${repo}:buildcache`;
+		const buildArgs = [
+			"buildx",
+			"build",
+			"--file",
+			dockerfile,
+			"--tag",
+			tag,
+			"--push",
+			"--provenance",
+			"false",
+			"--metadata-file",
+			metadataFile,
+			"--progress",
+			"plain",
+			"--cache-from",
+			`type=registry,ref=${cacheReference}`,
+			"--cache-to",
+			`type=registry,mode=max,image-manifest=true,oci-mediatypes=true,ref=${cacheReference}`,
+			...platform === void 0 ? [] : ["--platform", platform],
+			...Object.entries(build.args ?? {}).flatMap(([name, value]) => ["--build-arg", `${name}=${value}`]),
+			context
+		];
+		console.error(`building worker image ${tag}`);
+		await runDocker(buildArgs, repo);
+		const digest = await buildxDigest(metadataFile);
+		if (digest === void 0) throw new WorkerImageError(`docker buildx did not report a registry digest for ${tag}`);
+		const pinned = `${repo}@${digest}`;
+		console.error(`pinned worker image ${pinned}`);
+		return pinned;
+	} finally {
+		if (artifact !== void 0) await artifact.dispose();
+		await rm(metadataDirectory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+const projectDirectoryInContext = (projectDir, context) => {
+	const projectRelativeToContext = relative(context, projectDir);
+	if (projectRelativeToContext === ".." || projectRelativeToContext.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(projectRelativeToContext)) throw new WorkerImageError(`Ponderbot project ${projectDir} must be inside Worker Image build context ${context}`);
+	const dockerPath = process.platform === "win32" ? projectRelativeToContext.split("\\").join("/") : projectRelativeToContext;
+	return dockerPath.length === 0 ? "." : `./${dockerPath}`;
+};
+async function runDocker(args, registryHint) {
+	return new Promise((resolveRun, rejectRun) => {
+		const child = spawn("docker", args, { stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		] });
+		let stdout = "";
+		let stderr = "";
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			stdout += chunk;
+			process.stderr.write(chunk);
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr += chunk;
+			process.stderr.write(chunk);
+		});
+		child.on("error", (error) => {
+			if (error.code === "ENOENT") {
+				rejectRun(new WorkerImageError("docker not found; install Docker and make sure docker is on PATH"));
+				return;
+			}
+			rejectRun(error);
+		});
+		child.on("exit", (code) => {
+			if (code === 0) {
+				resolveRun({
+					stdout,
+					stderr
+				});
+				return;
+			}
+			rejectRun(new WorkerImageError(`docker buildx build failed with exit code ${code}; run docker login for ${registryHint} if the registry requires authentication`));
+		});
+	});
+}
+const buildxDigest = async (metadataFile) => {
+	try {
+		const digest = JSON.parse(await readFile(metadataFile, "utf8"))["containerimage.digest"];
+		return typeof digest === "string" && DIGEST_PATTERN.test(digest) ? digest : void 0;
+	} catch {
+		return;
+	}
+};
+const repository = (image) => {
+	const withoutDigest = image.split("@", 1)[0] ?? image;
+	const slash = withoutDigest.lastIndexOf("/");
+	const colon = withoutDigest.lastIndexOf(":");
+	if (colon > slash) return withoutDigest.slice(0, colon);
+	return withoutDigest;
+};
+//#endregion
+//#region src/model-policy.ts
+const modelDefinitionInput = (options) => ({
+	provider: modelProvider(options.provider),
+	model: options.model,
+	capabilities: Object.fromEntries((options.capability ?? []).map((capability) => [capability, true])),
+	fallback_model_refs: options.fallback ?? []
+});
+const modelProvider = (provider) => {
+	switch (provider) {
+		case "anthropic":
+		case "fake":
+		case "mistral":
+		case "openai": return provider;
+		default: throw new Error("--provider must be anthropic, fake, mistral, or openai");
+	}
+};
+//#endregion
+//#region src/provider-auth.ts
+const providerAuth = async (options) => {
+	const config = await resolveConfig(options.env);
+	const spaceId = options.space ?? config.spaceId;
+	const client = clientFor(config);
+	const registry = await client.modelProviders.list(spaceId);
+	const provider = await resolveProvider(options.provider, registry.providers);
+	const providerEntry = registry.providers.find((entry) => entry.id === provider);
+	if (providerEntry === void 0) throw new Error(`provider ${provider} is not available`);
+	const method = await resolveMethod(providerEntry, options.method);
+	if (options.allSpaces === true && options.shared !== true) throw new Error("--all-spaces requires --shared");
+	if (options.spaces !== void 0 && options.shared !== true) throw new Error("--spaces requires --shared");
+	if (options.allSpaces === true && options.spaces !== void 0) throw new Error("use either --all-spaces or --spaces, not both");
+	const sharedSpaceIds = options.spaces ?? [spaceId];
+	if (options.shared === true) {
+		const { binding } = await client.providerBindings.create(provider);
+		if (method === "api-key") {
+			const apiKey = await readApiKey(options);
+			await client.providerBindings.setApiKey(binding.id, { apiKey });
+		} else {
+			if (!canPrompt()) throw new Error("OAuth login needs an interactive terminal. Run locally with a browser, or rerun with --no-browser to paste the callback URL.");
+			await authorizeOAuthLogin(() => client.providerBindings.startOAuthLogin(binding.id), (authorizationResponse, state) => client.providerBindings.completeOAuthLogin(binding.id, {
+				authorizationResponse,
+				state
+			}), options.browser !== false);
+		}
+		if (options.allSpaces === true) await client.providerBindings.authorize(binding.id, { allSpaces: true });
+		else await client.providerBindings.authorize(binding.id, { spaceIds: sharedSpaceIds });
+		return providerAuthResult(provider, method, spaceId, {
+			bindingId: binding.id,
+			allSpaces: options.allSpaces === true,
+			spaceIds: options.allSpaces === true ? void 0 : sharedSpaceIds
+		});
+	}
+	if (method === "api-key") {
+		const apiKey = await readApiKey(options);
+		await client.modelProviders.setApiKey(spaceId, {
+			provider,
+			apiKey
+		});
+		return providerAuthResult(provider, method, spaceId);
+	}
+	if (!canPrompt()) throw new Error("OAuth login needs an interactive terminal. Run locally with a browser, or rerun with --no-browser to paste the callback URL.");
+	await authorizeOAuthLogin(() => client.modelProviders.startOAuthLogin(spaceId, provider), (authorizationResponse, state) => client.modelProviders.completeOAuthLogin(spaceId, provider, {
+		authorizationResponse,
+		state
+	}), options.browser !== false);
+	return providerAuthResult(provider, method, spaceId);
+};
+const providerAuthResult = (provider, method, spaceId, shared) => ({
+	type: "provider_auth",
+	status: "saved",
+	provider,
+	method,
+	space_id: spaceId,
+	binding_id: shared?.bindingId,
+	all_spaces: shared?.allSpaces,
+	space_ids: shared?.spaceIds,
+	smoke_test: "ponder spaces show"
+});
+const resolveProvider = async (value, entries) => {
+	const providers = entries.map((entry) => entry.id);
+	if (value !== void 0) {
+		const provider = providers.find((candidate) => candidate === value);
+		if (provider !== void 0) return provider;
+		throw new Error(`--provider must be one of ${providers.join(", ")}`);
+	}
+	return promptChoice("Provider", providers);
+};
+const resolveMethod = async (provider, value) => {
+	const supportsApiKey = provider.auth_methods.some((method) => method.id === "api_key");
+	const supportsOAuth = provider.auth_methods.some((method) => method.id !== "api_key");
+	if (value !== void 0) {
+		if (value === "api-key" && supportsApiKey) return "api-key";
+		if ((value === "oauth" || value === "codex") && supportsOAuth) return "oauth";
+		throw new Error(`--method is not supported by --provider ${provider.id}`);
+	}
+	if (!supportsOAuth) return "api-key";
+	if (!supportsApiKey) return "oauth";
+	return promptChoice("Authentication method", ["api-key", "oauth"]);
+};
+const readApiKey = async (options) => {
+	const envValue = process.env.PONDER_PROVIDER_API_KEY;
+	if (envValue !== void 0 && envValue !== "") return envValue;
+	if (!process.stdin.isTTY) {
+		const piped = (await readStdin()).trim();
+		if (piped !== "") return piped;
+		throw new Error("set PONDER_PROVIDER_API_KEY or pipe the API key on stdin");
+	}
+	if (options.provider !== void 0 && options.method !== void 0 && !canPrompt()) throw new Error("set PONDER_PROVIDER_API_KEY or pipe the API key on stdin");
+	return promptSecret("API key");
+};
+const authorizeOAuthLogin = async (start, complete, openBrowser) => {
+	const { login } = await start();
+	const authorization = {
+		authUrl: login.authUrl,
+		callbackUrl: login.callbackUrl,
+		state: login.state
+	};
+	let authorizationResponse;
+	if (openBrowser) {
+		const callback = listenForCallback(authorization);
+		console.error(`Open this URL if your browser does not open automatically:\n${authorization.authUrl}`);
+		if (await loopbackReady(callback) && await openSystemBrowser(authorization.authUrl)) authorizationResponse = await callback.code;
+		else {
+			callback.close();
+			console.error(`Open this URL and paste the redirected callback URL:\n${authorization.authUrl}`);
+			authorizationResponse = await promptLine("Callback URL or code");
+		}
+	} else {
+		console.error(`Open this URL and paste the redirected callback URL:\n${authorization.authUrl}`);
+		authorizationResponse = await promptLine("Callback URL or code");
+	}
+	await complete(authorizationResponse, authorization.state);
+};
+const listenForCallback = (authorization) => {
+	const callback = new URL(authorization.callbackUrl);
+	const server = createServer((request, response) => {
+		try {
+			const code = authorizationCodeFromInput(new URL(request.url ?? "/", callback).toString(), authorization.state);
+			response.writeHead(200, { "content-type": "text/html" });
+			response.end("<html><body>OpenAI login complete. You can close this window.</body></html>");
+			server.close();
+			resolve(code);
+		} catch (error) {
+			response.writeHead(400, { "content-type": "text/plain" });
+			response.end(error instanceof Error ? error.message : "invalid callback");
+			reject(error);
+		}
+	});
+	let resolve;
+	let reject;
+	let readyResolve;
+	let readyReject;
+	const code = new Promise((promiseResolve, promiseReject) => {
+		resolve = promiseResolve;
+		reject = promiseReject;
+	});
+	const ready = new Promise((promiseResolve, promiseReject) => {
+		readyResolve = promiseResolve;
+		readyReject = promiseReject;
+	});
+	server.once("listening", readyResolve);
+	server.once("error", (error) => {
+		const normalized = error.code === "EADDRINUSE" ? /* @__PURE__ */ new Error("port 1455 is already in use") : error;
+		readyReject(normalized);
+		reject(normalized);
+	});
+	server.listen(Number(callback.port), callback.hostname);
+	return {
+		code,
+		ready,
+		close: () => server.close()
+	};
+};
+const loopbackReady = async (callback) => {
+	try {
+		await callback.ready;
+		return true;
+	} catch (error) {
+		console.error(error instanceof Error ? `${error.message}; falling back to paste mode` : "falling back to paste mode");
+		callback.close();
+		return false;
+	}
+};
+const authorizationCodeFromInput = (inputValue, expectedState) => {
+	const trimmed = inputValue.trim();
+	if (trimmed === "") throw new Error("missing authorization code");
+	const params = trimmed.includes("://") ? new URL(trimmed).searchParams : new URLSearchParams(trimmed.startsWith("?") ? trimmed.slice(1) : trimmed);
+	const returnedState = params.get("state");
+	const code = params.get("code") ?? (trimmed.includes("=") ? null : trimmed);
+	if (returnedState !== null && returnedState !== expectedState) throw new Error("OAuth state did not match");
+	if (code === null || code === "") throw new Error("missing authorization code");
+	return code;
+};
+const promptChoice = async (label, choices) => {
+	const answer = await promptLine(`${label}\n${choices.map((choice, index) => `${index + 1}) ${choice}`).join("\n")}\nChoose`);
+	const index = Number(answer.trim());
+	if (Number.isInteger(index) && index >= 1 && index <= choices.length) return choices[index - 1];
+	if (choices.includes(answer.trim())) return answer.trim();
+	throw new Error(`invalid ${label.toLowerCase()}`);
+};
+const promptLine = async (label) => {
+	const rl = createInterface({
+		input: stdin,
+		output: stderr
+	});
+	try {
+		return await rl.question(`${label}: `);
+	} finally {
+		rl.close();
+	}
+};
+const promptSecret = async (label) => {
+	process.stderr.write(`${label}: `);
+	const chunks = [];
+	const stdin = process.stdin;
+	const wasRaw = stdin.isRaw;
+	stdin.setRawMode?.(true);
+	stdin.resume();
+	return await new Promise((resolve, reject) => {
+		const cleanup = () => {
+			stdin.setRawMode?.(wasRaw);
+			stdin.pause();
+			stdin.off("data", onData);
+			process.stderr.write("\n");
+		};
+		const onData = (chunk) => {
+			const value = chunk.toString("utf8");
+			if (value === "") {
+				cleanup();
+				reject(/* @__PURE__ */ new Error("cancelled"));
+				return;
+			}
+			if (value === "\r" || value === "\n") {
+				cleanup();
+				resolve(chunks.join(""));
+				return;
+			}
+			if (value === "") {
+				chunks.pop();
+				return;
+			}
+			chunks.push(value);
+		};
+		stdin.on("data", onData);
+	});
+};
+const openSystemBrowser = (url) => {
+	const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+	const args = process.platform === "win32" ? [
+		"/c",
+		"start",
+		"",
+		url
+	] : [url];
+	return new Promise((resolve) => {
+		const child = spawn(command, args, {
+			stdio: "ignore",
+			detached: true
+		});
+		child.once("error", () => resolve(false));
+		child.once("spawn", () => {
+			child.unref();
+			resolve(true);
+		});
+	});
+};
+const readStdin = async () => {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+	return Buffer.concat(chunks).toString("utf8");
+};
+const canPrompt = () => {
+	return process.stdin.isTTY === true && process.stderr.isTTY === true;
+};
+//#endregion
+//#region src/spaces.ts
+const spacePageLimit = 100;
+const listSpaces = async (client) => {
+	const spaces = [];
+	let cursor;
+	do {
+		const page = await client.spaces.list({
+			cursor,
+			limit: spacePageLimit
+		});
+		spaces.push(...page.spaces);
+		cursor = page.next_cursor ?? void 0;
+	} while (cursor !== void 0);
+	return spaces;
+};
+//#endregion
+//#region src/stack.ts
+const DEFAULT_TARGET = "core";
+const DEFAULT_DEV_RUNTIME_IMAGE = "ponderbot-runtime:dev";
+const DEFAULT_DEV_SPACE_ID = "default";
+const DEFAULT_DEV_URL = "http://127.0.0.1:4100";
+const DEV_BOOTSTRAP_TOKEN_FILE = "dev-bootstrap-token";
+const OUTPUT_TAIL_LIMIT = 16384;
+const WAIT_TIMEOUT_SECONDS = "180";
+var StackError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "StackError";
+	}
+};
+async function findRepoRoot(start = process.cwd()) {
+	let current = resolve(start);
+	while (true) {
+		try {
+			await access(join(current, "docker", "compose", "targets"));
+			return current;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const parent = dirname(current);
+		if (parent === current) throw new StackError(`could not find docker/compose/targets from ${resolve(start)}`);
+		current = parent;
+	}
+}
+async function startStack(options = {}) {
+	const stack = await resolveStack(options.target, options.dev);
+	const bootstrapToken = await bootstrapTokenForHome(stack.ponderbotHome);
+	const devEnvironment = devStackEnvironment(stack, options.space, bootstrapToken);
+	await runDockerCompose([
+		...composeArgs(stack),
+		"up",
+		...options.dev ? ["--watch"] : [],
+		...options.attach || options.dev ? [] : [
+			"-d",
+			"--wait",
+			"--wait-timeout",
+			WAIT_TIMEOUT_SECONDS
+		],
+		...options.build ? ["--build"] : []
+	], stack, bootstrapToken);
+	await ensureDevSpace(devEnvironment);
+	return result(stack, "started", devEnvironment);
+}
+async function stopStack(options = {}) {
+	const stack = await resolveStack(options.target, false);
+	await runDockerCompose([
+		...composeArgs(stack),
+		"down",
+		"--remove-orphans"
+	], stack);
+	return result(stack, "stopped");
+}
+async function resolveStack(target, dev) {
+	const repoRoot = await findRepoRoot();
+	const resolvedTarget = targetName(target);
+	const baseImagesEnvFile = await baseImagesEnvFileForRepo(repoRoot);
+	const environmentFile = await environmentFileForRepo(repoRoot);
+	const composeFile = await composeFileForRepo(repoRoot, resolvedTarget);
+	const devComposeFile = dev ? await devComposeFileForRepo(repoRoot) : void 0;
+	const ponderbotHome = await ensurePonderbotHome(repoRoot);
+	const configuredUrl = process.env.PONDERBOT_URL;
+	return {
+		baseImagesEnvFile,
+		composeFile,
+		devComposeFile,
+		devUrl: configuredUrl === void 0 || configuredUrl.length === 0 ? DEFAULT_DEV_URL : configuredUrl,
+		environmentFile,
+		ponderbotHome,
+		repoRoot,
+		spaceId: DEFAULT_DEV_SPACE_ID,
+		target: resolvedTarget
+	};
+}
+const composeArgs = (stack) => {
+	return [
+		"compose",
+		"--env-file",
+		stack.baseImagesEnvFile,
+		...stack.environmentFile === void 0 ? [] : ["--env-file", stack.environmentFile],
+		"-f",
+		stack.composeFile,
+		...stack.devComposeFile === void 0 ? [] : ["-f", stack.devComposeFile]
+	];
+};
+const environmentFileForRepo = async (repoRoot) => {
+	const environmentFile = join(repoRoot, ".env");
+	try {
+		await access(environmentFile);
+		return environmentFile;
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+};
+async function baseImagesEnvFileForRepo(repoRoot) {
+	const envFile = join(repoRoot, "docker", "env", "base-images.env");
+	try {
+		await access(envFile);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new StackError(`base image env file not found at ${envFile}`);
+		throw error;
+	}
+	return envFile;
+}
+async function composeFileForRepo(repoRoot, target) {
+	if (target === "dev") throw new StackError("compose target \"dev\" is an overlay; use ponder start --dev");
+	if (!/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(target)) throw new StackError(`invalid compose target "${target}"`);
+	const composeFile = join(repoRoot, "docker", "compose", "targets", `${target}.yml`);
+	try {
+		await access(composeFile);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new StackError(`compose target "${target}" not found at ${composeFile}`);
+		throw error;
+	}
+	return composeFile;
+}
+async function devComposeFileForRepo(repoRoot) {
+	const devComposeFile = join(repoRoot, "docker", "compose", "targets", "dev.yml");
+	try {
+		await access(devComposeFile);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new StackError(`dev compose overlay not found at ${devComposeFile}`);
+		throw error;
+	}
+	return devComposeFile;
+}
+async function ensurePonderbotHome(repoRoot) {
+	const configured = process.env.PONDERBOT_HOME;
+	const ponderbotHome = configured === void 0 || configured.length === 0 ? join(repoRoot, ".ponderbot") : configured;
+	await mkdir(ponderbotHome, { recursive: true });
+	return ponderbotHome;
+}
+const bootstrapTokenForHome = async (ponderbotHome) => {
+	const configured = process.env.PONDERBOT_BOOTSTRAP_TOKEN;
+	if (configured !== void 0 && configured.trim().length > 0) return configured;
+	const tokenPath = join(ponderbotHome, DEV_BOOTSTRAP_TOKEN_FILE);
+	try {
+		const token = (await readFile(tokenPath, "utf8")).trim();
+		if (token.length > 0) return token;
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const token = `pb_dev_${randomBytes(32).toString("base64url")}`;
+	await writeFile(tokenPath, `${token}\n`, { mode: 384 });
+	await chmod(tokenPath, 384);
+	return token;
+};
+const devStackEnvironment = (stack, space, token) => ({
+	url: stack.devUrl,
+	space_id: space === void 0 || space.length === 0 ? stack.spaceId : space,
+	token
+});
+const ensureDevSpace = async (environment) => {
+	const client = createClient({
+		baseUrl: environment.url,
+		spaceId: environment.space_id,
+		token: environment.token
+	});
+	const space = (await listSpaces(client)).find((space) => space.id === environment.space_id);
+	if (space === void 0) {
+		await client.spaces.create({
+			id: environment.space_id,
+			name: environment.space_id
+		});
+		return;
+	}
+	if (space.status !== "active") await client.spaces.update({ status: "active" }, environment.space_id);
+};
+async function runDockerCompose(args, stack, bootstrapToken) {
+	await new Promise((resolveRun, rejectRun) => {
+		const child = spawn("docker", args, {
+			cwd: stack.repoRoot,
+			env: {
+				...process.env,
+				...stack.devComposeFile === void 0 ? {} : { PONDERBOT_RUNTIME_IMAGE: process.env.PONDERBOT_RUNTIME_IMAGE || DEFAULT_DEV_RUNTIME_IMAGE },
+				...bootstrapToken === void 0 ? {} : { PONDERBOT_BOOTSTRAP_TOKEN: bootstrapToken },
+				PONDERBOT_DATA_MOUNT_SOURCE: stack.ponderbotHome,
+				PONDERBOT_HOME: stack.ponderbotHome
+			},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let outputTail = "";
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			outputTail = (outputTail + chunk).slice(-OUTPUT_TAIL_LIMIT);
+			process.stderr.write(chunk);
+		});
+		child.stderr.on("data", (chunk) => {
+			outputTail = (outputTail + chunk).slice(-OUTPUT_TAIL_LIMIT);
+			process.stderr.write(chunk);
+		});
+		child.on("error", (error) => {
+			if (error.code === "ENOENT") {
+				rejectRun(new StackError("docker not found; install Docker and make sure docker is on PATH"));
+				return;
+			}
+			rejectRun(error);
+		});
+		child.on("close", (code) => {
+			if (code === 0) {
+				resolveRun();
+				return;
+			}
+			rejectRun(new StackError(composeFailureMessage(args, code, outputTail)));
+		});
+	});
+}
+const composeFailureMessage = (args, code, output) => {
+	if (/Cannot connect to the Docker daemon|Is the docker daemon running|docker daemon is not running/i.test(output)) return "docker daemon unavailable; start Docker and try again";
+	return `docker compose ${args.includes("up") ? "up" : args.includes("down") ? "down" : "compose"} failed with exit code ${code ?? "unknown"}`;
+};
+function result(stack, status, devEnvironment) {
+	const base = {
+		type: "stack",
+		id: stack.target,
+		status,
+		compose_file: stack.composeFile,
+		ponderbot_home: stack.ponderbotHome
+	};
+	return devEnvironment === void 0 ? base : {
+		...base,
+		dev_environment: devEnvironment
+	};
+}
+const targetName = (target) => {
+	return target === void 0 || target.length === 0 ? DEFAULT_TARGET : target;
+};
+//#endregion
+//#region src/version-bump.ts
+const VERSION_LITERAL_PATTERN = /\bversion:\s*"([^"\r\n]+)"/g;
+const SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+const bumpProjectVersion = async (projectDir, currentVersion, level) => {
+	const bumpLevel = parseBumpLevel(level);
+	const file = join(projectDir, "config.ts");
+	const source = await readFile(file, "utf8");
+	const matches = [...source.matchAll(VERSION_LITERAL_PATTERN)];
+	if (matches.length !== 1) throw manualBumpError(file);
+	const match = matches[0];
+	const literalVersion = match?.[1];
+	if (match?.index === void 0 || literalVersion === void 0 || currentVersion === void 0 || literalVersion !== currentVersion) throw manualBumpError(file);
+	const nextVersion = bumpedVersion(currentVersion, bumpLevel);
+	const replacement = match[0].replace(`"${literalVersion}"`, `"${nextVersion}"`);
+	await writeFile(file, `${source.slice(0, match.index)}${replacement}${source.slice(match.index + match[0].length)}`);
+	return {
+		previousVersion: currentVersion,
+		nextVersion
+	};
+};
+const parseBumpLevel = (level) => {
+	switch (level) {
+		case "patch":
+		case "minor":
+		case "major": return level;
+		default: throw new Error("--bump must be patch, minor, or major");
+	}
+};
+const bumpedVersion = (version, level) => {
+	const match = SEMVER_PATTERN.exec(version);
+	if (match === null) throw new Error(`project version ${JSON.stringify(version)} is not x.y.z semver; bump the version manually`);
+	const major = Number(match[1]);
+	const minor = Number(match[2]);
+	const patch = Number(match[3]);
+	switch (level) {
+		case "patch": return `${major}.${minor}.${patch + 1}`;
+		case "minor": return `${major}.${minor + 1}.0`;
+		case "major": return `${major + 1}.0.0`;
+	}
+};
+const manualBumpError = (file) => /* @__PURE__ */ new Error(`${file} does not contain exactly one version string literal; bump the version manually`);
+//#endregion
+//#region src/main.ts
+const program = new Command("ponder").option("--json", "machine output").showHelpAfterError();
+program.command("start").option("--target <name>", "compose target", "core").option("--attach", "run compose in the foreground and stream logs until stopped").option("--build", "build compose images before starting").option("--dev", "run the runtime with Docker Compose Watch and Phoenix code reloading").option("--space <id>", "space id to create and print for local app credentials").description("start the local Docker compose stack").action(async (options) => {
+	try {
+		print(await startStack({
+			attach: options.attach,
+			build: options.build,
+			dev: options.dev,
+			space: options.space,
+			target: options.target
+		}), program.opts());
+	} catch (error) {
+		fail(error, error instanceof StackError ? 2 : 1);
+	}
+});
+program.command("stop").option("--target <name>", "compose target", "core").description("stop the local Docker compose stack").action(async (options) => {
+	try {
+		print(await stopStack(options), program.opts());
+	} catch (error) {
+		fail(error, error instanceof StackError ? 2 : 1);
+	}
+});
+program.command("init").description("scaffold ponderbot/config.ts").action(async () => {
+	await scaffold();
+	print({
+		ok: true,
+		project: "ponderbot"
+	}, program.opts());
+});
+const manifest = program.command("manifest").description("author, validate, and deploy the manifest");
+manifest.command("validate").description("build the manifest and report structural errors").action(async () => {
+	try {
+		const config = await resolveProject();
+		const { manifest, warnings, instructionBudgets } = await buildManifest(config.project, {
+			workerImage: configuredWorkerImage(config.projectDefinition),
+			requireWorkerImage: false
+		});
+		printManifestDiagnostics(instructionBudgets, warnings);
+		print({
+			ok: true,
+			counts: countByKind(manifest)
+		}, program.opts());
+	} catch (error) {
+		fail(error, error instanceof WorkerImageError ? 2 : 1);
+	}
+});
+manifest.command("deploy").option("--env <name>", "environment").option("--image <ref>", "prebuilt worker image ref").option("--platform <platform>", "docker build platform").option("--bump <patch|minor|major>", "bump ponderbot/config.ts version before deploy").description("build and deploy the manifest").action(async (options) => {
+	const config = await resolveProjectReleaseConfig(options.env);
+	const client = clientFor(config);
+	try {
+		const versionBump = options.bump === void 0 ? void 0 : await bumpProjectVersion(config.project, config.projectDefinition.version, options.bump);
+		const plan = await deployManifestPlan(config.project, {
+			...options,
+			staticRelease: options.image === void 0 && config.allowDev
+		});
+		printManifestDiagnostics(plan.instructionBudgets, plan.warnings);
+		const release = await client.projects.releases.deploy(config.projectDefinition.name, config.environment, plan.manifest, config.sourceName, void 0, config.applicationOrigin);
+		print(versionBump === void 0 ? release : {
+			...release,
+			version_bump: versionBump
+		}, program.opts());
+	} catch (error) {
+		fail(error, error instanceof WorkerImageError ? 2 : 1);
+	}
+});
+manifest.command("dev").option("--env <name>", "environment").description("watch, deploy to a dev environment, and follow runtime events").action(async (options) => {
+	try {
+		await devLoop(await resolveDevConfig(options.env));
+	} catch (error) {
+		fail(error, 1);
+	}
+});
+const spaces = program.command("spaces").description("manage runtime spaces");
+spaces.command("list").option("--env <name>", "environment").description("list spaces").action(async (options) => {
+	const config = await resolveConfig(options.env);
+	await runSpacesCommand("spaces:read", "*", async () => {
+		print({ spaces: await listSpaces(clientFor(config)) }, program.opts());
+	});
+});
+spaces.command("create <spaceId>").option("--name <name>", "space name").option("--env <name>", "environment").description("create a space").action(async (spaceId, options) => {
+	const config = await resolveConfig(options.env);
+	await runSpacesCommand("spaces:write", "*", async () => {
+		try {
+			print(await clientFor(config).spaces.create({
+				id: spaceId,
+				name: options.name ?? spaceId
+			}), program.opts());
+		} catch (error) {
+			throw spaceCreateError(error, spaceId);
+		}
+	});
+});
+spaces.command("show [spaceId]").option("--env <name>", "environment").description("show a space with budget and usage").action(async (spaceId, options) => {
+	const config = await resolveConfig(options.env);
+	const client = clientFor(config);
+	const resolvedSpaceId = spaceId ?? config.spaceId;
+	await runSpacesCommand("spaces:read", resolvedSpaceId, async () => {
+		const [space, budget, usage] = await Promise.all([
+			client.spaces.get(resolvedSpaceId),
+			client.spaces.budget.get(resolvedSpaceId),
+			client.spaces.usage(resolvedSpaceId)
+		]);
+		print({
+			space: space.space,
+			budget: budget.budget,
+			usage
+		}, program.opts());
+	});
+});
+spaces.command("budget [spaceId]").option("--set <file>", "replace budget from a JSON file").option("--env <name>", "environment").description("show or replace a space budget").action(async (spaceId, options) => {
+	const config = await resolveConfig(options.env);
+	const client = clientFor(config);
+	const resolvedSpaceId = spaceId ?? config.spaceId;
+	await runSpacesCommand(options.set === void 0 ? "spaces:read" : "spaces:write", resolvedSpaceId, async () => {
+		if (options.set === void 0) {
+			print(await client.spaces.budget.get(resolvedSpaceId), program.opts());
+			return;
+		}
+		print(await client.spaces.budget.set(await readJsonFile(options.set), resolvedSpaceId), program.opts());
+	});
+});
+program.command("provider").description("configure model provider credentials").command("auth").description("authenticate a model provider for a space").option("--env <name>", "environment").option("--space <spaceId>", "target space (defaults to the configured space)").option("--provider <name>", "anthropic | mistral | openai (skips the picker)").option("--method <method>", "api-key | oauth").option("--shared", "store one Runtime credential binding instead of a Space credential").option("--all-spaces", "authorize the shared binding for every Space").option("--spaces <spaceIds...>", "authorize the shared binding for selected Spaces").option("--no-browser", "print the Codex authorize URL and paste the callback URL").action(async (options) => {
+	print(await providerAuth(options), program.opts());
+});
+const model = program.command("model").description("manage Space model policy");
+model.command("add <modelRef>").requiredOption("--provider <name>", "anthropic | fake | mistral | openai").requiredOption("--model <name>", "provider model name").option("--capability <name...>", "declared model capabilities").option("--fallback <modelRef...>", "ordered fallback model refs").option("--space <spaceId>", "target space (defaults to the configured space)").option("--env <name>", "environment").description("add or update a model in the Space catalog").action(async (modelRef, options) => {
+	const config = await resolveConfig(options.env);
+	const spaceId = options.space ?? config.spaceId;
+	await runSpacesCommand("spaces:write", spaceId, async () => {
+		print(await clientFor(config).models.upsert(modelRef, modelDefinitionInput(options), spaceId), program.opts());
+	});
+});
+model.command("list").option("--space <spaceId>", "target space (defaults to the configured space)").option("--env <name>", "environment").description("list models in the Space catalog").action(async (options) => {
+	const config = await resolveConfig(options.env);
+	const spaceId = options.space ?? config.spaceId;
+	await runSpacesCommand("spaces:read", spaceId, async () => {
+		print(await clientFor(config).models.list(spaceId), program.opts());
+	});
+});
+model.command("assign <agentRef> <modelRef>").option("--space <spaceId>", "target space (defaults to the configured space)").option("--env <name>", "environment").description("assign a Space catalog model to an exact Agent ref").action(async (agentRef, modelRef, options) => {
+	const config = await resolveConfig(options.env);
+	const spaceId = options.space ?? config.spaceId;
+	await runSpacesCommand("spaces:write", spaceId, async () => {
+		print(await clientFor(config).models.assign(agentRef, modelRef, spaceId), program.opts());
+	});
+});
+model.command("assignments").option("--space <spaceId>", "target space (defaults to the configured space)").option("--env <name>", "environment").description("list exact Agent model assignments for a Space").action(async (options) => {
+	const config = await resolveConfig(options.env);
+	const spaceId = options.space ?? config.spaceId;
+	await runSpacesCommand("spaces:read", spaceId, async () => {
+		print(await clientFor(config).models.assignments(spaceId), program.opts());
+	});
+});
+program.command("releases").option("--env <name>", "environment").description("list releases").action(async (options) => {
+	print(await clientFor(await resolveConfig(options.env)).releases.list(), program.opts());
+});
+program.command("rollback <releaseId>").option("--env <name>", "environment").description("roll back to a release").action(async (releaseId, options) => {
+	print(await clientFor(await resolveConfig(options.env)).releases.rollback(releaseId), program.opts());
+});
+program.command("runs").option("--type <type>", "run type").option("--status <status>", "run status").option("--env <name>", "environment").description("list runs").action(async (options) => {
+	print(await clientFor(await resolveConfig(options.env)).runs.list(Object.fromEntries([["type", options.type], ["status", options.status]].filter((entry) => typeof entry[1] === "string"))), program.opts());
+});
+program.command("run <type> <id>").option("--export", "export run bundle").option("--env <name>", "environment").description("show a run or export bundle").action(async (type, id, options) => {
+	const runType = parseRunType(type);
+	const client = clientFor(await resolveConfig(options.env));
+	print(options.export ? await client.runs.export(runType, id) : await client.runs.show(runType, id), program.opts());
+});
+program.command("cancel <type> <id>").option("--env <name>", "environment").description("cancel a run").action(async (type, id, options) => {
+	const runType = parseRunType(type);
+	print(await clientFor(await resolveConfig(options.env)).runs.cancel(runType, id), program.opts());
+});
+program.command("action").command("run <ref>").option("--input <json>", "input payload", "{}").option("--env <name>", "environment").option("--release-id <id>", "pinned release id").option("--manifest-name <name>", "current release selector").description("start an Action Run").action(async (ref, options) => {
+	print(await clientFor(await resolveConfig(options.env)).actions.run(ref, JSON.parse(options.input), {
+		releaseId: options.releaseId,
+		manifestName: options.manifestName
+	}), program.opts());
+});
+program.command("workflow").command("trigger <ref>").option("--input <json>", "input payload", "{}").option("--env <name>", "environment").option("--release-id <id>", "pinned release id").option("--manifest-name <name>", "current release selector").description("start a Workflow Run").action(async (ref, options) => {
+	print(await clientFor(await resolveConfig(options.env)).workflows.trigger(ref, JSON.parse(options.input), {
+		releaseId: options.releaseId,
+		manifestName: options.manifestName
+	}), program.opts());
+});
+program.command("decisions").option("--env <name>", "environment").option("--actionable", "only generations this actor could answer").description("list pending decisions").action(async (options) => {
+	print(await clientFor(await resolveConfig(options.env)).decisions.list({
+		status: "pending",
+		...options.actionable ? { actionable: true } : {}
+	}), program.opts());
+});
+program.command("approve <id>").option("--env <name>", "environment").option("--reason <reason>", "bounded reason recorded on the response").description("approve a decision").action(async (id, options) => {
+	print(await clientFor(await resolveConfig(options.env)).decisions.approve(id, { ...options.reason === void 0 ? {} : { reason: options.reason } }), program.opts());
+});
+program.command("reject <id>").option("--env <name>", "environment").option("--reason <reason>", "bounded reason recorded on the response").description("reject a decision").action(async (id, options) => {
+	print(await clientFor(await resolveConfig(options.env)).decisions.reject(id, { ...options.reason === void 0 ? {} : { reason: options.reason } }), program.opts());
+});
+program.command("events").option("--follow", "follow runtime events").option("--env <name>", "environment").description("show recent events or follow the event stream").action(async (options) => {
+	const client = clientFor(await resolveConfig(options.env));
+	if (!options.follow) {
+		print(await client.events.recent(), program.opts());
+		return;
+	}
+	const tail = followEvents(client, (event) => print(event, program.opts()));
+	process.once("SIGINT", () => tail.stop());
+	await tail.done;
+});
+program.parseAsync().catch((error) => fail(error, 1));
+async function scaffold() {
+	const root = process.cwd();
+	const templateRoot = fileURLToPath(new URL("../templates", import.meta.url));
+	const projectFile = join(root, "ponderbot", "config.ts");
+	await assertNewProjectFiles([projectFile]);
+	await mkdir(dirname(projectFile), { recursive: true });
+	await copyFile(join(templateRoot, "ponderbot", "config.ts"), projectFile, constants.COPYFILE_EXCL);
+}
+async function assertNewProjectFiles(paths) {
+	for (const path of paths) try {
+		await access(path);
+		throw new Error(`${path} already exists`);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+}
+function countByKind(manifest) {
+	return {
+		actions: manifest.actions.length,
+		skills: manifest.skills.length,
+		schedules: manifest.schedules.length,
+		workflows: manifest.workflows.length,
+		agents: manifest.agents.length,
+		agent_groups: manifest.agent_groups.length
+	};
+}
+function parseRunType(value) {
+	if (!isRunType(value)) throw new TypeError(`run type must be one of ${RUN_TYPES.join(", ")}`);
+	return value;
+}
+async function readJsonFile(path) {
+	return JSON.parse(await readFile(path, "utf8"));
+}
+async function runSpacesCommand(scope, space, run) {
+	try {
+		await run();
+	} catch (error) {
+		fail(spaceScopeError(error, scope, space), 1);
+	}
+}
+const spaceScopeError = (error, scope, space) => {
+	if (isPonderbotError(error) && error.status === 403) return /* @__PURE__ */ new Error(`your token lacks ${scope} on ${space} - mint one with that grant`);
+	return error;
+};
+const spaceCreateError = (error, spaceId) => {
+	if (isPonderbotError(error) && error.status === 409) return /* @__PURE__ */ new Error(`space "${spaceId}" already exists`);
+	return error;
+};
+//#endregion
+export {};
+
+//# sourceMappingURL=main.js.map