@runtypelabs/cli 2.28.1 → 2.30.0

package/dist/index.js

@@ -136,15 +136,15 @@ var init_credential_store = __esm({
 });
 
 // src/index.ts
-import { Command as Command37 } from "commander";
-import chalk46 from "chalk";
+import { Command as Command39 } from "commander";
+import chalk48 from "chalk";
 
 // src/lib/load-env.ts
 import { readFileSync } from "fs";
 import { resolve } from "path";
-function loadEnv(path19 = resolve(process.cwd(), ".env")) {
+function loadEnv(path20 = resolve(process.cwd(), ".env")) {
   try {
-    const content = readFileSync(path19, "utf8").replace(/\r\n?/g, "\n");
+    const content = readFileSync(path20, "utf8").replace(/\r\n?/g, "\n");
     for (const line of content.split("\n")) {
       if (!line.trim() || line.trimStart().startsWith("#")) continue;
       const match = line.match(/^\s*([\w.-]+)\s*=\s*(.*)?\s*$/);
@@ -1386,10 +1386,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path19) {
-  if (!path19)
+function getElementAtPath(obj, path20) {
+  if (!path20)
     return obj;
-  return path19.reduce((acc, key) => acc?.[key], obj);
+  return path20.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1798,11 +1798,11 @@ function explicitlyAborted(x2, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path19, issues) {
+function prefixIssues(path20, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path19);
+    iss.path.unshift(path20);
     return iss;
   });
 }
@@ -1949,16 +1949,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path19 = []) => {
+  const processError = (error52, path20 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path19, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path20, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
       } else {
-        const fullpath = [...path19, ...issue2.path];
+        const fullpath = [...path20, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1985,17 +1985,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path19 = []) => {
+  const processError = (error52, path20 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path19, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path20, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path19, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path20, ...issue2.path]);
       } else {
-        const fullpath = [...path19, ...issue2.path];
+        const fullpath = [...path20, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -2027,8 +2027,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path19 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path19) {
+  const path20 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path20) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14720,13 +14720,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path19 = ref.slice(1).split("/").filter(Boolean);
-  if (path19.length === 0) {
+  const path20 = ref.slice(1).split("/").filter(Boolean);
+  if (path20.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path19[0] === defsKey) {
-    const key = path19[1];
+  if (path20[0] === defsKey) {
+    const key = path20[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -15326,8 +15326,8 @@ function renderDefaultModelStrengthsGuide() {
 }
 
 // ../shared/dist/chunk-UIQ7MVBO.mjs
-function getNestedValue(obj, path19) {
-  let normalizedPath = path19;
+function getNestedValue(obj, path20) {
+  let normalizedPath = path20;
   normalizedPath = normalizedPath.replace(/^\$\.?/, "");
   normalizedPath = normalizedPath.replace(/\[(\d+)\]/g, ".$1");
   normalizedPath = normalizedPath.replace(/\[['"]([^'"\]]+)['"]\]/g, ".$1");
@@ -17250,12 +17250,12 @@ function addSemanticIssues(schema, ctx, pathPrefix = []) {
     }
   }
   for (const [name, property] of Object.entries(schema.properties)) {
-    const path19 = [...pathPrefix, "properties", name];
+    const path20 = [...pathPrefix, "properties", name];
     if (property.type === "string" && property.enum) {
       if (new Set(property.enum).size !== property.enum.length) {
         ctx.addIssue({
           code: "custom",
-          path: [...path19, "enum"],
+          path: [...path20, "enum"],
           message: "Enum values must be unique"
         });
       }
@@ -17263,15 +17263,15 @@ function addSemanticIssues(schema, ctx, pathPrefix = []) {
     if (property.type === "number" && property.minimum !== void 0 && property.maximum !== void 0 && property.minimum > property.maximum) {
       ctx.addIssue({
         code: "custom",
-        path: path19,
+        path: path20,
         message: "minimum must be less than or equal to maximum"
       });
     }
     if (property.type === "object") {
-      addSemanticIssues(property, ctx, path19);
+      addSemanticIssues(property, ctx, path20);
     }
     if (property.type === "array" && property.items.type === "object") {
-      addSemanticIssues(property.items, ctx, [...path19, "items"]);
+      addSemanticIssues(property.items, ctx, [...path20, "items"]);
     }
   }
 }
@@ -20577,8 +20577,8 @@ function validateCodeToolNameCollisions(toolNames, stepRef, code, preSeededCount
   }
   return null;
 }
-function formatPath(path19) {
-  return path19.reduce((acc, part) => {
+function formatPath(path20) {
+  return path20.reduce((acc, part) => {
     if (typeof part === "number") {
       return `${acc}[${part}]`;
     }
@@ -20699,17 +20699,17 @@ function collectTransformDataCodeToolNameCheck(toolsConfig, stepIndex, stepRef,
     if (typeof toolId !== "string") {
       continue;
     }
-    const path19 = `flowSteps[${stepIndex}].config.tools.toolIds[${toolIdIndex}]`;
+    const path20 = `flowSteps[${stepIndex}].config.tools.toolIds[${toolIdIndex}]`;
     const named = parseNamedToolRef(toolId);
     if (named) {
-      selectedToolNames.push({ name: named.name, path: path19 });
+      selectedToolNames.push({ name: named.name, path: path20 });
       continue;
     }
     const { customToolIds } = separateToolIds([toolId]);
     if (customToolIds.length === 0) {
       continue;
     }
-    selectedToolIds.push({ toolId, path: path19 });
+    selectedToolIds.push({ toolId, path: path20 });
   }
   if (selectedToolIds.length > 0 || selectedToolNames.length > 0) {
     pendingChecks.hasAccountScopedReferences = true;
@@ -20742,10 +20742,10 @@ function collectCodeModeToolNameCheck(toolsConfig, stepIndex, stepRef, pendingCh
     if (typeof entry !== "string" || entry.length === 0 || entry.endsWith(":*")) {
       continue;
     }
-    const path19 = `flowSteps[${stepIndex}].config.tools.codeModeConfig.toolPool[${toolPoolIndex}]`;
+    const path20 = `flowSteps[${stepIndex}].config.tools.codeModeConfig.toolPool[${toolPoolIndex}]`;
     const named = parseNamedToolRef(entry);
     if (named) {
-      selectedToolNames.push({ name: named.name, path: path19 });
+      selectedToolNames.push({ name: named.name, path: path20 });
       continue;
     }
     if (runtimeToolNames.has(entry)) {
@@ -20756,7 +20756,7 @@ function collectCodeModeToolNameCheck(toolsConfig, stepIndex, stepRef, pendingCh
     if (customToolIds.length === 0) {
       continue;
     }
-    selectedToolIds.push({ toolId: entry, path: path19 });
+    selectedToolIds.push({ toolId: entry, path: path20 });
   }
   if (selectedToolIds.length > 0 || selectedToolNames.length > 0) {
     pendingChecks.hasAccountScopedReferences = true;
@@ -20806,19 +20806,19 @@ var TEMPLATE_STRING_FIELDS = /* @__PURE__ */ new Set([
   "script"
 ]);
 var NON_FLOW_VARIABLE_SUBTREE_KEYS = /* @__PURE__ */ new Set(["tools"]);
-function extractTemplateStrings(config3, path19 = []) {
+function extractTemplateStrings(config3, path20 = []) {
   const results = [];
   if (typeof config3 === "string") {
-    const fieldName = path19[path19.length - 1];
-    const parentFieldName = path19.length >= 2 ? path19[path19.length - 2] : void 0;
+    const fieldName = path20[path20.length - 1];
+    const parentFieldName = path20.length >= 2 ? path20[path20.length - 2] : void 0;
     if (fieldName && TEMPLATE_STRING_FIELDS.has(fieldName) || parentFieldName && TEMPLATE_STRING_FIELDS.has(parentFieldName)) {
-      results.push({ value: config3, fieldPath: path19.join(".") });
+      results.push({ value: config3, fieldPath: path20.join(".") });
     }
     return results;
   }
   if (Array.isArray(config3)) {
     for (const [index, item] of config3.entries()) {
-      results.push(...extractTemplateStrings(item, [...path19, String(index)]));
+      results.push(...extractTemplateStrings(item, [...path20, String(index)]));
     }
     return results;
   }
@@ -20826,9 +20826,9 @@ function extractTemplateStrings(config3, path19 = []) {
     for (const [key, val] of Object.entries(config3)) {
       if (NON_FLOW_VARIABLE_SUBTREE_KEYS.has(key)) continue;
       if (typeof val === "string" && TEMPLATE_STRING_FIELDS.has(key)) {
-        results.push({ value: val, fieldPath: [...path19, key].join(".") });
+        results.push({ value: val, fieldPath: [...path20, key].join(".") });
       } else if (typeof val === "object" && val !== null) {
-        results.push(...extractTemplateStrings(val, [...path19, key]));
+        results.push(...extractTemplateStrings(val, [...path20, key]));
       }
     }
   }
@@ -20859,8 +20859,8 @@ function extractVariableReferences(config3) {
     while ((match = pattern.exec(value)) !== null) {
       const expr = match[1];
       if (!expr) continue;
-      for (const path19 of extractTemplateExpressionPaths(expr)) {
-        references.push({ variable: path19, fieldPath });
+      for (const path20 of extractTemplateExpressionPaths(expr)) {
+        references.push({ variable: path20, fieldPath });
       }
     }
   }
@@ -21078,7 +21078,7 @@ function validateStoreVectorSource(flowSteps, buckets, declaredFlowInputs) {
     if (outputVar) declaredVariables.add(outputVar);
   }
 }
-function checkConditionExpression(expr, path19, stepRef, buckets) {
+function checkConditionExpression(expr, path20, stepRef, buckets) {
   if (typeof expr !== "string" || !expr.includes("{{")) return;
   const match = UNQUOTED_TEMPLATE_BEFORE_OP.exec(expr) || UNQUOTED_TEMPLATE_AFTER_OP.exec(expr);
   if (!match) return;
@@ -21088,7 +21088,7 @@ function checkConditionExpression(expr, path19, stepRef, buckets) {
     {
       code: "CONDITION_UNQUOTED_TEMPLATE_COMPARISON",
       message: `Expression compares an unquoted {{...}} placeholder against a string literal (\`${snippet}\`). \`condition\` / \`when\` predicates are JavaScript evaluated after template substitution, so a non-numeric value substitutes in as a bare identifier (e.g. \`healthy === 'watch'\`) and throws "ReferenceError: <value> is not defined" at runtime. Quote the placeholder \u2014 e.g. '{{var}}' === '...' \u2014 or compare numerically.`,
-      path: path19,
+      path: path20,
       step: stepRef,
       details: { snippet }
     },
@@ -21294,24 +21294,24 @@ function collectAccountScopedReferences(step, stepIndex, pendingChecks) {
   if (step.type === "execute-agent") {
     const agentId = step.config.agentId;
     if (typeof agentId === "string" && !agentId.includes("{{")) {
-      const path19 = `flowSteps[${stepIndex}].config.agentId`;
-      registerAgentReference(agentId, path19, stepRef, pendingChecks);
+      const path20 = `flowSteps[${stepIndex}].config.agentId`;
+      registerAgentReference(agentId, path20, stepRef, pendingChecks);
     }
     return;
   }
   if (step.type === "tool-call") {
     const toolId = step.config.toolId;
     if (typeof toolId === "string") {
-      const path19 = `flowSteps[${stepIndex}].config.toolId`;
+      const path20 = `flowSteps[${stepIndex}].config.toolId`;
       const named = parseNamedToolRef(toolId);
       if (named) {
         pendingChecks.hasAccountScopedReferences = true;
-        registerReference(pendingChecks.toolReferencesByName, named.name, { path: path19, step: stepRef });
+        registerReference(pendingChecks.toolReferencesByName, named.name, { path: path20, step: stepRef });
       } else {
         const { customToolIds } = separateToolIds([toolId]);
         if (customToolIds.length > 0) {
           pendingChecks.hasAccountScopedReferences = true;
-          registerReference(pendingChecks.toolReferencesById, toolId, { path: path19, step: stepRef });
+          registerReference(pendingChecks.toolReferencesById, toolId, { path: path20, step: stepRef });
         }
       }
     }
@@ -21330,17 +21330,17 @@ function collectAccountScopedReferences(step, stepIndex, pendingChecks) {
       if (typeof toolId !== "string") {
         continue;
       }
-      const path19 = `flowSteps[${stepIndex}].config.tools.toolIds[${toolIdIndex}]`;
+      const path20 = `flowSteps[${stepIndex}].config.tools.toolIds[${toolIdIndex}]`;
       const named = parseNamedToolRef(toolId);
       if (named) {
         pendingChecks.hasAccountScopedReferences = true;
-        registerReference(pendingChecks.toolReferencesByName, named.name, { path: path19, step: stepRef });
+        registerReference(pendingChecks.toolReferencesByName, named.name, { path: path20, step: stepRef });
         continue;
       }
       const { customToolIds } = separateToolIds([toolId]);
       if (customToolIds.length > 0) {
         pendingChecks.hasAccountScopedReferences = true;
-        registerReference(pendingChecks.toolReferencesById, toolId, { path: path19, step: stepRef });
+        registerReference(pendingChecks.toolReferencesById, toolId, { path: path20, step: stepRef });
       }
     }
   }
@@ -21378,22 +21378,22 @@ function collectAccountScopedReferences(step, stepIndex, pendingChecks) {
     }
   }
 }
-function registerAgentReference(agentId, path19, stepRef, pendingChecks) {
+function registerAgentReference(agentId, path20, stepRef, pendingChecks) {
   const named = parseNamedAgentRef(agentId);
   pendingChecks.hasAccountScopedReferences = true;
   if (named) {
-    registerReference(pendingChecks.agentReferencesByName, named.name, { path: path19, step: stepRef });
+    registerReference(pendingChecks.agentReferencesByName, named.name, { path: path20, step: stepRef });
   } else {
-    registerReference(pendingChecks.agentReferencesById, agentId, { path: path19, step: stepRef });
+    registerReference(pendingChecks.agentReferencesById, agentId, { path: path20, step: stepRef });
   }
 }
-function registerFlowReference(flowId, path19, stepRef, pendingChecks) {
+function registerFlowReference(flowId, path20, stepRef, pendingChecks) {
   const named = parseNamedFlowRef(flowId);
   pendingChecks.hasAccountScopedReferences = true;
   if (named) {
-    registerReference(pendingChecks.flowReferencesByName, named.name, { path: path19, step: stepRef });
+    registerReference(pendingChecks.flowReferencesByName, named.name, { path: path20, step: stepRef });
   } else {
-    registerReference(pendingChecks.flowReferencesById, flowId, { path: path19, step: stepRef });
+    registerReference(pendingChecks.flowReferencesById, flowId, { path: path20, step: stepRef });
   }
 }
 function validateSubagentConfig(value, stepTools, stepIndex, stepRef) {
@@ -41354,7 +41354,7 @@ function buildDashboardUrl(opts) {
   while (base.endsWith("/")) {
     base = base.slice(0, -1);
   }
-  const path19 = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
+  const path20 = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
   const params = new URLSearchParams();
   if (isValidAccountId(opts.account)) {
     params.set(ACCOUNT_QUERY_PARAM, opts.account);
@@ -41367,7 +41367,7 @@ function buildDashboardUrl(opts) {
     }
   }
   const qs = params.toString();
-  return qs ? `${base}${path19}?${qs}` : `${base}${path19}`;
+  return qs ? `${base}${path20}?${qs}` : `${base}${path20}`;
 }
 function parseAccountId(value) {
   if (!value) return null;
@@ -41975,6 +41975,14 @@ var mcpToolFulfillmentSchema = external_exports.object({
   rung: external_exports.literal("mcp_tool"),
   tool: external_exports.string(),
   args: external_exports.record(external_exports.string(), external_exports.unknown()),
+  /**
+   * Operator-supplied arguments that MUST be merged into `args` before the
+   * call does anything — executing `args` alone is accepted by the tool but
+   * writes nothing, so a consumer that sees this field non-empty must obtain
+   * these values (from the operator or a secret store) first. Keyed by arg
+   * name; the value describes what to supply.
+   */
+  pendingArgs: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   summary: external_exports.string()
 });
 var restFulfillmentSchema = external_exports.object({
@@ -42050,8 +42058,8 @@ var FLAT_ADVANCED_CONFIG_KEYS = {
 var FLAT_ADVANCED_CONFIG_KEY_LIST = Object.keys(
   FLAT_ADVANCED_CONFIG_KEYS
 );
-function createIssue(severity, code, message, path19, suggestedFix) {
-  return { code, message, path: path19, severity, ...suggestedFix ? { suggestedFix } : {} };
+function createIssue(severity, code, message, path20, suggestedFix) {
+  return { code, message, path: path20, severity, ...suggestedFix ? { suggestedFix } : {} };
 }
 function emptyResult() {
   return { valid: true, errors: [], warnings: [], recommendations: [] };
@@ -42886,16 +42894,16 @@ var FLOW_PREFIX = Object.values(RUNTIME_PREFIXES).find((spec) => spec.namespace
 var SECRET_PREFIX = Object.values(RUNTIME_PREFIXES).find(
   (spec) => spec.namespace === "secret"
 ).prefix;
-function collectStringLeafPaths(value, path19 = []) {
+function collectStringLeafPaths(value, path20 = []) {
   if (typeof value === "string") {
-    return [{ path: path19, value }];
+    return [{ path: path20, value }];
   }
   if (Array.isArray(value)) {
-    return value.flatMap((item, index) => collectStringLeafPaths(item, [...path19, String(index)]));
+    return value.flatMap((item, index) => collectStringLeafPaths(item, [...path20, String(index)]));
   }
   if (value && typeof value === "object") {
     return Object.entries(value).flatMap(
-      ([key, nestedValue]) => collectStringLeafPaths(nestedValue, [...path19, key])
+      ([key, nestedValue]) => collectStringLeafPaths(nestedValue, [...path20, key])
     );
   }
   return [];
@@ -46656,13 +46664,13 @@ function parseJsonObject(raw, label) {
   }
   return parsed;
 }
-function readJsonFile(path19, opts = {}) {
+function readJsonFile(path20, opts = {}) {
   const label = opts.label ?? "file";
   let raw;
   try {
-    raw = readFileSync3(path19, "utf-8");
+    raw = readFileSync3(path20, "utf-8");
   } catch {
-    console.error(chalk2.red(`Failed to read ${label}: ${path19}`));
+    console.error(chalk2.red(`Failed to read ${label}: ${path20}`));
     process.exit(1);
   }
   const obj = parseJsonObject(raw, label);
@@ -61023,7 +61031,7 @@ function mergeMarathonSessionSummaries(existingSessions, nextSessions, offset) {
   }
   return Array.from(byIndex.values()).sort((left, right) => left.index - right.index);
 }
-function buildMarathonSessionSnapshot(liveState, sessionSummary, model, status = "complete", errorMessage2) {
+function buildMarathonSessionSnapshot(liveState, sessionSummary, model, status = "complete", errorMessage3) {
   return {
     sessionIndex: sessionSummary.index,
     status,
@@ -61042,7 +61050,7 @@ function buildMarathonSessionSnapshot(liveState, sessionSummary, model, status =
       ...event,
       data: structuredClone(event.data)
     })),
-    ...errorMessage2 ? { errorMessage: errorMessage2 } : {}
+    ...errorMessage3 ? { errorMessage: errorMessage3 } : {}
   };
 }
 function mapRunTaskStatusToSnapshotStatus(status, fallback) {
@@ -61170,9 +61178,9 @@ function findLatestStateFile(stateDir) {
     const files = fs8.readdirSync(dir).filter((f2) => f2.endsWith(".json"));
     for (const file2 of files) {
       const fullPath = path9.join(dir, file2);
-      const stat = fs8.statSync(fullPath);
-      if (!latest || stat.mtimeMs > latest.mtime) {
-        latest = { name: file2.replace(".json", ""), filePath: fullPath, mtime: stat.mtimeMs };
+      const stat2 = fs8.statSync(fullPath);
+      if (!latest || stat2.mtimeMs > latest.mtime) {
+        latest = { name: file2.replace(".json", ""), filePath: fullPath, mtime: stat2.mtimeMs };
       }
     }
   }
@@ -61504,8 +61512,8 @@ function safeReadTextFile(filePath) {
   try {
     const normalized = normalizeToolPath(filePath).replace(/\\/g, "/");
     if (isSensitivePath(normalized)) return null;
-    const stat = fs9.statSync(filePath);
-    if (!stat.isFile() || stat.size > MAX_FILE_BYTES_TO_SCAN) return null;
+    const stat2 = fs9.statSync(filePath);
+    if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES_TO_SCAN) return null;
     const buffer = fs9.readFileSync(filePath);
     if (buffer.includes(0)) return null;
     return buffer.toString("utf-8");
@@ -61672,14 +61680,14 @@ function resolveToolPath(toolPath, options = {}) {
     }
   }
   if (resolved.exists) {
-    const stat = fs10.statSync(resolved.canonicalPath);
-    if (options.requireFile && !stat.isFile()) {
+    const stat2 = fs10.statSync(resolved.canonicalPath);
+    if (options.requireFile && !stat2.isFile()) {
       return {
         ok: false,
         error: `Path is not a file: ${requestedPath}`
       };
     }
-    if (options.requireDirectory && !stat.isDirectory()) {
+    if (options.requireDirectory && !stat2.isDirectory()) {
       return {
         ok: false,
         error: `Path is not a directory: ${requestedPath}`
@@ -67092,8 +67100,8 @@ apiKeysCommand.command("analytics").description("Show API key usage analytics").
   const client = createCliClient(apiKey);
   if (!isTTY(options) || options.json) {
     try {
-      const path19 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
-      const data = await client.get(path19);
+      const path20 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
+      const data = await client.get(path20);
       printJson(data);
     } catch (error51) {
       const message = error51 instanceof Error ? error51.message : "Unknown error";
@@ -67110,8 +67118,8 @@ apiKeysCommand.command("analytics").description("Show API key usage analytics").
     useEffect32(() => {
       const run2 = async () => {
         try {
-          const path19 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
-          const data = await client.get(path19);
+          const path20 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
+          const data = await client.get(path20);
           printJson(data);
           setSuccess(true);
           setLoading(false);
@@ -71871,6 +71879,7 @@ function isCI() {
 var SKILLS_OFFER_SKIP_COMMANDS = /* @__PURE__ */ new Set([
   "skills",
   "install-mcp",
+  "onboard",
   "init",
   "login",
   "auth"
@@ -72611,8 +72620,6 @@ function getMcpRestartInstruction(agent) {
 function getMcpSkillsAgentId(agent) {
   return MCP_AGENT_DEFINITIONS[agent].skillsAgentId;
 }
-
-// src/commands/install-mcp.ts
 async function selectAgent(options, tty) {
   if (options.agent) {
     const explicit = normalizeMcpAgent(options.agent);
@@ -72648,6 +72655,8 @@ async function selectAgent(options, tty) {
     { promptLabel: "Agent" }
   );
 }
+
+// src/commands/install-mcp.ts
 async function installSkillsForAgent(agent, jsonMode) {
   const rosieId = getMcpSkillsAgentId(agent);
   try {
@@ -72814,13 +72823,378 @@ Setting up Runtype for ${definition.displayName}\u2026`));
   if (partial2) process.exitCode = 1;
 });
 
-// src/commands/apps.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync20, lstatSync, statSync as statSync7, existsSync as existsSync16 } from "fs";
-import { join as join14, relative as relative7 } from "path";
+// src/commands/onboard.ts
+import { existsSync as existsSync16, readFileSync as readFileSync20 } from "fs";
+import { join as join14 } from "path";
 import { Command as Command34 } from "commander";
 import chalk42 from "chalk";
+
+// ../shared/dist/agent-onboarding-content.mjs
+var AGENT_ONBOARDING_MARKDOWN = `# Runtype for Coding Agents
+
+You are reading the setup script served by \`https://runtype.ai\`. Your durable goal is to leave this coding harness connected to Runtype's hosted MCP server with browser OAuth. Use the Runtype CLI as a bridge during this first session; do not treat it as the final integration.
+
+## Golden path \u2014 do exactly this
+
+If the live Runtype MCP tools are already available in this session, skip setup and go to "After MCP is active" below. Otherwise follow every step in order:
+
+### 1. Install and authenticate the CLI
+
+\`\`\`bash
+npm install -g @runtypelabs/cli
+runtype auth login
+\`\`\`
+
+Complete the browser sign-in when it opens. The CLI makes this first session productive even though a running coding harness often cannot discover a newly installed MCP connection until it restarts.
+
+### 2. Install skills and the OAuth MCP connection
+
+\`\`\`bash
+runtype install-mcp
+\`\`\`
+
+This command detects the current coding harness, installs the Runtype agent skills for it, writes the user-level hosted MCP configuration, and starts the harness's own OAuth flow when possible. If it asks which harness to configure, select the harness running this session. If a browser opens, have the user complete OAuth.
+
+Do not manually create an API key, export the CLI key into MCP, or choose a different setup path merely to avoid a restart. CLI authentication and MCP OAuth are separate on purpose: the CLI is the first-session bridge; client-owned OAuth MCP is the durable connection.
+
+### 3. Keep working in this session with the CLI
+
+Do not stop just because the new MCP connection is not visible yet. Use CLI commands for useful first-session work:
+
+\`\`\`bash
+runtype auth whoami
+runtype agents list
+runtype flows list
+runtype products list
+runtype --help
+\`\`\`
+
+The CLI also supports dispatch, records, validation, product setup, and other account operations. Read command help before mutating resources, and report concrete IDs and URLs to the user.
+
+### 4. Tell the user to restart or reload the harness
+
+Before finishing this session, read the final status and next steps from \`runtype install-mcp\`. Complete any OAuth action it requests and retry any failed skill installation. Do not call setup complete while the command reports \`action-required\`, \`partial\`, or an error.
+
+Only after skills and OAuth both succeed, tell the user exactly what changed and ask them to restart or reload the coding harness. Use direct language such as:
+
+> Runtype skills and the OAuth MCP connection are installed. Please restart or reload this coding agent (or start a new session) so it can activate the new MCP tools. I used the CLI to keep this first session productive; after restart I will use MCP by default.
+
+If an action remains, report that exact action instead of using the success wording above. Do not claim the running agent can use MCP until its Runtype tools actually appear.
+
+### 5. Switch to MCP after restart
+
+In the next session, use Runtype MCP first. Do not fall back to the CLI just because it worked previously. Start by calling:
+
+\`\`\`json
+{
+  "task": "build-product",
+  "description": "Describe the user's product goal here"
+}
+\`\`\`
+
+with \`get_build_instructions\`. Then use \`get_platform_documentation\` for exact schemas and catalogs, create or update resources with MCP tools, validate them, and test the result with a real run.
+
+## If the install needs recovery
+
+\`runtype install-mcp\` intentionally changes one confidently selected harness, not every agent config it can find. If detection is ambiguous, re-run it with one explicit id:
+
+\`\`\`bash
+runtype install-mcp --agent claude
+runtype install-mcp --agent codex
+runtype install-mcp --agent cursor
+runtype install-mcp --agent gemini
+runtype install-mcp --agent opencode
+runtype install-mcp --agent vscode
+\`\`\`
+
+Use only the line for the current harness. Follow the command's OAuth and restart instructions. Use \`--force\` only when the command reports that an existing MCP server named \`runtype\` points to a different URL and the user agrees to replace it.
+
+## Headless exception \u2014 not the normal path
+
+Only use an API key when browser OAuth is genuinely impossible in the user's environment, not merely inconvenient. Ask the user before switching authentication modes, then follow the canonical headless registration and claim protocol at \`https://runtype.com/auth.md\`. Never print a secret into the transcript or write a bearer token directly into a committed config file.
+
+The hosted MCP endpoint is \`https://api.runtype.com/v1/mcp/protocol\`. A user-supplied \`RUNTYPE_API_KEY\` can authenticate CLI commands in a headless environment, but return to client-owned OAuth MCP when the harness can support it.
+
+## After MCP is active
+
+- Call \`get_build_instructions\` before building.
+- Use \`get_platform_documentation\` instead of inventing payload shapes.
+- Let the installed Runtype skills route task-specific work: product builds, live account operations, Persona embeds, templates, and SDK/CLI workflows.
+- If the user gives you a \`use.runtype.com/now?...\`, example, or template/FPO link, use the Runtype template skill and MCP tools rather than opening the login-gated dashboard page.
+- Validate before shipping and test with a real execution.
+
+Runtype MCP can create and operate agents, flows, products, records, secrets, evals, and surfaces; attach built-in, HTTP, MCP, flow, and subagent tools; and ship chat, API, webhook, messaging, schedule, MCP, and hosted-page experiences.
+
+Docs: [runtype.com](https://runtype.com)
+Dashboard: [use.runtype.com](https://use.runtype.com)
+API: [api.runtype.com](https://api.runtype.com)
+`;
+
+// src/commands/onboard.ts
+init_credential_store();
+var AUTH_LOGIN_INSTRUCTION = "Sign in to Runtype: run `runtype auth login` (or set RUNTYPE_API_KEY), then re-run `runtype onboard`.";
+var AFTER_RESTART_STEPS = [
+  "Use the Runtype MCP server first for all Runtype work.",
+  "Start with the get_build_instructions tool before creating or changing resources.",
+  "Do not fall back to the Runtype CLI once the MCP connection is active."
+];
+var EXISTING_PROJECT_ADVICE = "Building AI features into an existing codebase? After restart, decide with the user whether flow/agent config should be hosted (dashboard-editable, called via the dispatch API) or code-first in this repo via the TypeScript SDK. They run on the same platform and can be mixed.";
+function detectExistingProject(cwd = process.cwd()) {
+  const packageJsonPath = join14(cwd, "package.json");
+  const hasPackageJson = existsSync16(packageJsonPath);
+  if (!hasPackageJson && !existsSync16(join14(cwd, ".git"))) return false;
+  if (hasPackageJson) {
+    try {
+      const parsed = JSON.parse(readFileSync20(packageJsonPath, "utf8"));
+      if (parsed.name === "@runtypelabs/cli") return false;
+    } catch {
+    }
+  }
+  return true;
+}
+var defaultDependencies = {
+  getEnvApiKey: () => getRuntimeApiKey(),
+  getStoredCredentials: async () => {
+    const credentials = await new CredentialStore().getCredentials();
+    if (!credentials) return null;
+    return { userId: credentials.userId, orgId: credentials.orgId };
+  },
+  ensureAuth,
+  selectAgent,
+  configureMcp: (agent, options) => configureMcpAgent(agent, options),
+  authenticateMcp: (agent, options) => authenticateMcpAgent(agent, options),
+  installSkills: installSkillsForAgent,
+  isExistingProject: detectExistingProject,
+  setExitCode: (code) => {
+    process.exitCode = code;
+  }
+};
+async function resolveAuth(dependencies, options) {
+  if (dependencies.getEnvApiKey()) {
+    return { authenticated: true, method: "env" };
+  }
+  const stored = await dependencies.getStoredCredentials();
+  if (stored) {
+    return { authenticated: true, method: "stored", userId: stored.userId, orgId: stored.orgId };
+  }
+  if (!options.interactiveLogin) {
+    return { authenticated: false, instruction: AUTH_LOGIN_INSTRUCTION };
+  }
+  const apiKey = await dependencies.ensureAuth({ exitOnFailure: false });
+  if (!apiKey) {
+    return { authenticated: false, instruction: AUTH_LOGIN_INSTRUCTION };
+  }
+  const after = await dependencies.getStoredCredentials();
+  return {
+    authenticated: true,
+    method: "browser-login",
+    userId: after?.userId,
+    orgId: after?.orgId
+  };
+}
+function printAuthLine(auth) {
+  if (!auth.authenticated) {
+    console.log(chalk42.yellow(`! Not signed in. ${auth.instruction}`));
+    return;
+  }
+  if (auth.method === "env") {
+    console.log(chalk42.green("\u2713 Signed in with RUNTYPE_API_KEY from the environment."));
+    return;
+  }
+  const identity = auth.userId ? ` (user ${auth.userId}${auth.orgId ? `, org ${auth.orgId}` : ""})` : "";
+  if (auth.method === "stored") {
+    console.log(chalk42.green(`\u2713 Already signed in${identity}.`));
+  } else {
+    console.log(chalk42.green(`\u2713 Signed in${identity}.`));
+  }
+}
+function createOnboardCommand(overrides = {}) {
+  const dependencies = { ...defaultDependencies, ...overrides };
+  return new Command34("onboard").description("Set up Runtype for this coding agent: sign in, install skills and OAuth MCP").option("--agent <id>", "Coding agent to configure (auto-detected by default)").option("--force", 'Replace a conflicting MCP server named "runtype"').option("--dry-run", "Show the selected agent and planned changes without writing them").option("--no-login", "Skip browser sign-in and MCP OAuth").option("--no-skills", "Skip installing Runtype agent skills").option("--json", "Structured JSON output; implies --no-login").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").option("--print-instructions", "Print the canonical agent onboarding markdown and exit").action(async (options, cmd) => {
+    if (options.printInstructions) {
+      console.log(AGENT_ONBOARDING_MARKDOWN);
+      return;
+    }
+    const globals = cmd.optsWithGlobals();
+    const jsonMode = !!(options.json ?? globals.json);
+    const tty = isTTY(options);
+    const loginAllowed = !jsonMode && tty && options.login !== false;
+    if (!jsonMode) {
+      console.log(chalk42.cyan("\nRuntype onboarding"));
+      console.log(
+        "Runtype is a platform for building AI products: agents, flows, evals, and surfaces your team ships to its own users."
+      );
+      console.log(
+        chalk42.dim(
+          "This command signs you in, installs Runtype skills and the hosted OAuth MCP server, then prints next steps.\n"
+        )
+      );
+    }
+    let auth;
+    try {
+      auth = await resolveAuth(dependencies, {
+        interactiveLogin: loginAllowed && !options.dryRun
+      });
+    } catch (error51) {
+      const message = error51 instanceof Error ? error51.message : String(error51);
+      if (jsonMode) {
+        printJson({ status: "error", code: "AUTH_RESOLUTION_FAILED", error: message });
+      } else {
+        console.error(chalk42.red(`Could not read Runtype credentials: ${message}`));
+      }
+      dependencies.setExitCode(1);
+      return;
+    }
+    if (!jsonMode) printAuthLine(auth);
+    let agent;
+    try {
+      agent = await dependencies.selectAgent({ agent: options.agent, json: jsonMode }, tty);
+    } catch (error51) {
+      const message = error51 instanceof Error ? error51.message : String(error51);
+      if (jsonMode) {
+        printJson({ status: "error", code: "AGENT_DETECTION_FAILED", auth, error: message });
+      } else {
+        console.error(chalk42.red(message));
+      }
+      dependencies.setExitCode(1);
+      return;
+    }
+    const definition = MCP_AGENT_DEFINITIONS[agent];
+    if (!jsonMode) {
+      console.log(chalk42.cyan(`
+Setting up Runtype for ${definition.displayName}\u2026`));
+    }
+    const configuration = await dependencies.configureMcp(agent, {
+      force: options.force,
+      dryRun: options.dryRun
+    });
+    if (!configuration.configured) {
+      if (jsonMode) {
+        printJson({ status: "error", code: "MCP_CONFIG_FAILED", agent, auth, configuration });
+      } else {
+        console.error(chalk42.red(configuration.error ?? "Could not configure Runtype MCP."));
+      }
+      dependencies.setExitCode(1);
+      return;
+    }
+    if (!jsonMode) {
+      if (options.dryRun) {
+        console.log(chalk42.green("\u2713 Would install the user-level Runtype MCP connection."));
+      } else if (configuration.changed) {
+        console.log(chalk42.green("\u2713 Installed the user-level Runtype MCP connection."));
+      } else {
+        console.log(chalk42.green("\u2713 Runtype MCP is already configured at the correct URL."));
+      }
+      if (configuration.configPath) {
+        console.log(chalk42.dim(`  ${configuration.configPath}`));
+      }
+      if (configuration.backupPath) {
+        console.log(chalk42.dim(`  Backup: ${configuration.backupPath}`));
+      }
+    }
+    const authentication = await dependencies.authenticateMcp(agent, {
+      login: loginAllowed,
+      dryRun: options.dryRun
+    });
+    if (!jsonMode && !options.dryRun) {
+      if (authentication.authenticated) {
+        console.log(chalk42.green("\u2713 MCP OAuth completed."));
+      } else if (authentication.error) {
+        console.log(chalk42.yellow(`! ${authentication.error}`));
+      } else if (authentication.instruction) {
+        console.log(chalk42.yellow(`! OAuth action required: ${authentication.instruction}`));
+      }
+    }
+    const skills = options.skills === false || options.dryRun ? {
+      status: options.dryRun ? "planned" : "skipped",
+      installedAgents: [],
+      failedAgents: []
+    } : await dependencies.installSkills(agent, jsonMode);
+    if (!jsonMode && !options.dryRun && skills.status === "error") {
+      console.log(
+        chalk42.yellow(
+          `! Runtype MCP is configured, but skill installation failed: ${skills.error ?? "unknown error"}`
+        )
+      );
+    }
+    const restartInstruction = getMcpRestartInstruction(agent);
+    const existingProject = dependencies.isExistingProject();
+    const nextSteps = [];
+    if (options.dryRun) {
+      nextSteps.push(
+        `Re-run \`runtype onboard --agent ${agent}\` without --dry-run to sign in, install skills, and configure MCP.`
+      );
+    } else {
+      if (!auth.authenticated && auth.instruction) nextSteps.push(auth.instruction);
+      if (authentication.instruction) nextSteps.push(authentication.instruction);
+      if (authentication.error && !authentication.instruction) {
+        nextSteps.push("Resolve the OAuth blocker reported above, then re-run `runtype onboard`.");
+      }
+      if (skills.status === "error") {
+        nextSteps.push(
+          `Retry skill installation with \`runtype skills install --agent ${getMcpSkillsAgentId(agent)}\`.`
+        );
+      } else if (skills.status === "skipped") {
+        nextSteps.push(
+          `Install the Runtype skills with \`runtype skills install --agent ${getMcpSkillsAgentId(agent)}\`.`
+        );
+      }
+      nextSteps.push(
+        "Continue this first session with the Runtype CLI; this running agent may not see the new MCP connection yet."
+      );
+      if (auth.authenticated && authentication.authenticated && skills.status !== "error") {
+        nextSteps.push(
+          `Tell the user that Runtype is set up, then ask them to restart or reload ${definition.displayName}.`
+        );
+      } else {
+        nextSteps.push(
+          "Tell the user that setup still has the action(s) above; do not call onboarding complete yet."
+        );
+      }
+      nextSteps.push(`After completing any action above, ${restartInstruction}`);
+    }
+    const partial2 = !options.dryRun && (Boolean(authentication.error) || skills.status === "error");
+    const status = options.dryRun ? "planned" : partial2 ? "partial" : auth.authenticated && authentication.authenticated ? "ok" : "action-required";
+    if (jsonMode) {
+      printJson({
+        status,
+        agent,
+        auth,
+        configuration,
+        authentication,
+        skills,
+        activation: options.dryRun ? "not-configured" : "restart-required",
+        restartInstruction,
+        afterRestart: AFTER_RESTART_STEPS,
+        ...existingProject ? { existingProjectAdvice: EXISTING_PROJECT_ADVICE } : {},
+        nextSteps
+      });
+    } else {
+      console.log(chalk42.bold(`
+Onboarding status: ${status}`));
+      console.log(chalk42.bold("\nDo exactly this next:"));
+      nextSteps.forEach((step, index) => console.log(`  ${index + 1}. ${step}`));
+      console.log(chalk42.bold(`
+After restarting ${definition.displayName}:`));
+      AFTER_RESTART_STEPS.forEach((step) => console.log(`  - ${step}`));
+      if (existingProject) {
+        console.log(`
+${EXISTING_PROJECT_ADVICE}`);
+      }
+      console.log("");
+    }
+    if (partial2) dependencies.setExitCode(1);
+  });
+}
+var onboardCommand = createOnboardCommand();
+
+// src/commands/apps.ts
+import { readdirSync as readdirSync7, readFileSync as readFileSync21, lstatSync, statSync as statSync7, existsSync as existsSync17 } from "fs";
+import { join as join15, relative as relative7 } from "path";
+import { Command as Command35 } from "commander";
+import chalk43 from "chalk";
 import { zipSync } from "fflate";
-var appsCommand = new Command34("apps").description(
+var appsCommand = new Command35("apps").description(
   "Manage Runtype Apps (hosted AI apps on *.runtype.run)"
 );
 var MANIFEST_FILENAME = "runtype.app.json";
@@ -72829,14 +73203,14 @@ function collectBundleFiles(dir) {
   const walk = (current) => {
     for (const entry of readdirSync7(current)) {
       if (entry.startsWith(".")) continue;
-      const full = join14(current, entry);
-      const stat = lstatSync(full);
-      if (stat.isSymbolicLink()) continue;
-      if (stat.isDirectory()) {
+      const full = join15(current, entry);
+      const stat2 = lstatSync(full);
+      if (stat2.isSymbolicLink()) continue;
+      if (stat2.isDirectory()) {
         if (entry === "node_modules") continue;
         walk(full);
       } else {
-        zippable[relative7(dir, full).split("\\").join("/")] = readFileSync20(full);
+        zippable[relative7(dir, full).split("\\").join("/")] = readFileSync21(full);
       }
     }
   };
@@ -72847,7 +73221,7 @@ function fail(message, jsonMode, code) {
   if (jsonMode) {
     printJson({ status: "error", error: message, code });
   } else {
-    console.error(chalk42.red(message));
+    console.error(chalk43.red(message));
   }
   process.exit(1);
 }
@@ -72872,13 +73246,13 @@ appsCommand.command("list").description("List your apps").option("--json", "Stru
       return;
     }
     if (data.length === 0) {
-      console.log(chalk42.yellow("No apps yet. Create one with `runtype apps create`."));
+      console.log(chalk43.yellow("No apps yet. Create one with `runtype apps create`."));
       return;
     }
     for (const app of data) {
-      const status = app.status === "suspended" ? chalk42.red("suspended") : chalk42.green("active");
-      const serving = app.activeVersionId ? "" : chalk42.dim(" (no active version)");
-      console.log(`${chalk42.bold(app.name)} ${chalk42.dim(app.id)}`);
+      const status = app.status === "suspended" ? chalk43.red("suspended") : chalk43.green("active");
+      const serving = app.activeVersionId ? "" : chalk43.dim(" (no active version)");
+      console.log(`${chalk43.bold(app.name)} ${chalk43.dim(app.id)}`);
       console.log(`  ${app.url}  ${status}  ${app.visibility}${serving}`);
     }
   } catch (error51) {
@@ -72907,9 +73281,9 @@ appsCommand.command("create").description("Create an app (the hostname is {slug}
         printJson(app);
         return;
       }
-      console.log(chalk42.green(`Created ${app.name} (${app.id})`));
+      console.log(chalk43.green(`Created ${app.name} (${app.id})`));
       console.log(`  ${app.url}`);
-      console.log(chalk42.dim("  Deploy a bundle with `runtype apps deploy <dir> --app " + app.id + "`"));
+      console.log(chalk43.dim("  Deploy a bundle with `runtype apps deploy <dir> --app " + app.id + "`"));
     } catch (error51) {
       fail(
         `Failed to create app: ${error51 instanceof Error ? error51.message : String(error51)}`,
@@ -72925,7 +73299,7 @@ appsCommand.command("deploy <dir>").description("Zip a bundle directory, upload
     const jsonMode = !!(options.json ?? globals.json);
     const apiKey = await ensureAuth();
     if (!apiKey) return;
-    if (!existsSync16(dir) || !statSync7(dir).isDirectory()) {
+    if (!existsSync17(dir) || !statSync7(dir).isDirectory()) {
       fail(`Not a directory: ${dir}`, jsonMode, "INVALID_DIR");
     }
     let bundleFiles = {};
@@ -72955,7 +73329,7 @@ appsCommand.command("deploy <dir>").description("Zip a bundle directory, upload
     const client = createCliClient(apiKey);
     try {
       const zipBytes = zipSync(bundleFiles);
-      if (!jsonMode) console.log(chalk42.dim(`Uploading ${(zipBytes.byteLength / 1024).toFixed(1)} KB bundle...`));
+      if (!jsonMode) console.log(chalk43.dim(`Uploading ${(zipBytes.byteLength / 1024).toFixed(1)} KB bundle...`));
       const version2 = await appsApi.uploadVersion(client, options.app, zipBytes);
       let app;
       if (options.activate) {
@@ -72973,8 +73347,8 @@ appsCommand.command("deploy <dir>").description("Zip a bundle directory, upload
               activated: false
             });
           } else {
-            console.error(chalk42.red(`Uploaded version ${version2.versionNumber}, but activation failed: ${message}`));
-            console.error(chalk42.dim(`  Retry with \`runtype apps activate ${options.app} ${version2.id}\` (no re-upload needed).`));
+            console.error(chalk43.red(`Uploaded version ${version2.versionNumber}, but activation failed: ${message}`));
+            console.error(chalk43.dim(`  Retry with \`runtype apps activate ${options.app} ${version2.id}\` (no re-upload needed).`));
           }
           process.exit(1);
         }
@@ -72984,14 +73358,14 @@ appsCommand.command("deploy <dir>").description("Zip a bundle directory, upload
         return;
       }
       console.log(
-        chalk42.green(
+        chalk43.green(
           `Deployed version ${version2.versionNumber} (${version2.fileCount} files, ${(version2.sizeBytes / 1024).toFixed(1)} KB)`
         )
       );
       if (app) {
-        console.log(`  Live at ${chalk42.bold(app.url)}`);
+        console.log(`  Live at ${chalk43.bold(app.url)}`);
       } else {
-        console.log(chalk42.dim(`  Uploaded but not activated. Activate with \`runtype apps activate ${options.app} ${version2.id}\``));
+        console.log(chalk43.dim(`  Uploaded but not activated. Activate with \`runtype apps activate ${options.app} ${version2.id}\``));
       }
     } catch (error51) {
       fail(
@@ -73015,13 +73389,13 @@ appsCommand.command("versions <appId>").description("List an app's versions, new
       return;
     }
     if (data.length === 0) {
-      console.log(chalk42.yellow("No versions uploaded yet."));
+      console.log(chalk43.yellow("No versions uploaded yet."));
       return;
     }
     for (const version2 of data) {
-      const marker = version2.status === "active" ? chalk42.green(" (active)") : "";
+      const marker = version2.status === "active" ? chalk43.green(" (active)") : "";
       console.log(
-        `v${version2.versionNumber} ${chalk42.dim(version2.id)} ${version2.fileCount} files, ${(version2.sizeBytes / 1024).toFixed(1)} KB${marker}`
+        `v${version2.versionNumber} ${chalk43.dim(version2.id)} ${version2.fileCount} files, ${(version2.sizeBytes / 1024).toFixed(1)} KB${marker}`
       );
     }
   } catch (error51) {
@@ -73044,8 +73418,8 @@ appsCommand.command("activate <appId> <versionId>").description("Activate an upl
       printJson({ app, version: version2 });
       return;
     }
-    console.log(chalk42.green(`Activated version ${version2.versionNumber}`));
-    console.log(`  Live at ${chalk42.bold(app.url)}`);
+    console.log(chalk43.green(`Activated version ${version2.versionNumber}`));
+    console.log(`  Live at ${chalk43.bold(app.url)}`);
   } catch (error51) {
     fail(
       `Activation failed: ${error51 instanceof Error ? error51.message : String(error51)}`,
@@ -73066,7 +73440,7 @@ appsCommand.command("delete <appId>").description("Permanently delete an app, it
       printJson({ status: "deleted", appId });
       return;
     }
-    console.log(chalk42.green(`Deleted ${appId}`));
+    console.log(chalk43.green(`Deleted ${appId}`));
   } catch (error51) {
     fail(
       `Delete failed: ${error51 instanceof Error ? error51.message : String(error51)}`,
@@ -73077,17 +73451,17 @@ appsCommand.command("delete <appId>").description("Permanently delete an app, it
 });
 
 // src/commands/update.ts
-import chalk44 from "chalk";
-import { Command as Command35 } from "commander";
+import chalk45 from "chalk";
+import { Command as Command36 } from "commander";
 
 // src/lib/auto-update.ts
 import { spawn as spawn2 } from "child_process";
 import {
   closeSync,
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   mkdirSync as mkdirSync12,
   openSync,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   readdirSync as readdirSync8,
   realpathSync as realpathSync3,
   renameSync,
@@ -73096,10 +73470,10 @@ import {
   writeFileSync as writeFileSync10
 } from "fs";
 import { constants as osConstants } from "os";
-import { dirname as dirname10, isAbsolute as isAbsolute4, join as join15, relative as relative8, resolve as resolve12, sep as sep6 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute4, join as join16, relative as relative8, resolve as resolve12, sep as sep6 } from "path";
 
 // src/lib/update-check.ts
-import chalk43 from "chalk";
+import chalk44 from "chalk";
 import Conf3 from "conf";
 var UPDATE_CHECK_INTERVAL_MS = 60 * 60 * 1e3;
 var UPDATE_NOTIFY_INTERVAL_MS = 24 * 60 * 60 * 1e3;
@@ -73193,7 +73567,7 @@ function notifyFromCachedCliUpdate(args, options = {}) {
     console.error(message);
   });
   notify(
-    `${chalk43.yellow("Update available:")} ${chalk43.red(currentVersion)} ${chalk43.gray("->")} ${chalk43.green(latestVersion)}  ${chalk43.gray(`(${getUpgradeCommand()})`)}`
+    `${chalk44.yellow("Update available:")} ${chalk44.red(currentVersion)} ${chalk44.gray("->")} ${chalk44.green(latestVersion)}  ${chalk44.gray(`(${getUpgradeCommand()})`)}`
   );
   store.set("lastNotifiedAt", now.toISOString());
   store.set("lastNotifiedVersion", latestVersion);
@@ -73252,32 +73626,32 @@ function isStableCliVersion(version2) {
   return Boolean(version2 && /^\d+\.\d+\.\d+$/.test(version2));
 }
 function getManagedCliPaths(homeDir = getRuntypeHomeDir()) {
-  const root = join15(homeDir, "cli");
+  const root = join16(homeDir, "cli");
   return {
     home: homeDir,
     root,
-    versions: join15(root, "versions"),
-    state: join15(root, "current.json"),
-    lock: join15(root, "update.lock"),
-    log: join15(root, "update.log")
+    versions: join16(root, "versions"),
+    state: join16(root, "current.json"),
+    lock: join16(root, "update.lock"),
+    log: join16(root, "update.log")
   };
 }
 function getVersionRoot(paths, version2) {
   if (!isStableCliVersion(version2)) {
     throw new Error(`Invalid CLI version: ${version2}`);
   }
-  return join15(paths.versions, version2);
+  return join16(paths.versions, version2);
 }
 function getVersionPackageRoot(paths, version2) {
-  return join15(getVersionRoot(paths, version2), "node_modules", "@runtypelabs", "cli");
+  return join16(getVersionRoot(paths, version2), "node_modules", "@runtypelabs", "cli");
 }
 function getVersionEntrypoint(paths, version2) {
-  return join15(getVersionPackageRoot(paths, version2), "dist", "index.js");
+  return join16(getVersionPackageRoot(paths, version2), "dist", "index.js");
 }
 function getManagedCliState(homeDir = getRuntypeHomeDir()) {
   const { state } = getManagedCliPaths(homeDir);
   try {
-    const parsed = JSON.parse(readFileSync21(state, "utf8"));
+    const parsed = JSON.parse(readFileSync22(state, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -73296,7 +73670,7 @@ function writeManagedCliState(paths, state) {
 }
 function readInstalledPackageVersion(packageRoot) {
   try {
-    const pkg = JSON.parse(readFileSync21(join15(packageRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync22(join16(packageRoot, "package.json"), "utf8"));
     if (pkg.name === CLI_PACKAGE_NAME && isStableCliVersion(pkg.version)) {
       return pkg.version;
     }
@@ -73307,14 +73681,14 @@ function readInstalledPackageVersion(packageRoot) {
 function isHealthyManagedVersion(paths, version2) {
   if (!isStableCliVersion(version2)) return false;
   const packageRoot = getVersionPackageRoot(paths, version2);
-  return readInstalledPackageVersion(packageRoot) === version2 && existsSync17(getVersionEntrypoint(paths, version2));
+  return readInstalledPackageVersion(packageRoot) === version2 && existsSync18(getVersionEntrypoint(paths, version2));
 }
 function isPathInside(parent, child) {
-  const canonicalize = (path19) => {
+  const canonicalize = (path20) => {
     try {
-      return realpathSync3(path19);
+      return realpathSync3(path20);
     } catch {
-      return resolve12(path19);
+      return resolve12(path20);
     }
   };
   const relativePath = relative8(canonicalize(parent), canonicalize(child));
@@ -73323,7 +73697,7 @@ function isPathInside(parent, child) {
 function isSourceCheckout(entrypoint) {
   let current = dirname10(entrypoint);
   for (let depth = 0; depth < 8; depth += 1) {
-    if (existsSync17(join15(current, ".git")) || existsSync17(join15(current, "pnpm-workspace.yaml"))) {
+    if (existsSync18(join16(current, ".git")) || existsSync18(join16(current, "pnpm-workspace.yaml"))) {
       return true;
     }
     const parent = dirname10(current);
@@ -73335,7 +73709,7 @@ function isSourceCheckout(entrypoint) {
 function findProjectRoot(cwd) {
   let current = resolve12(cwd);
   while (true) {
-    if (existsSync17(join15(current, "package.json")) || existsSync17(join15(current, "pnpm-workspace.yaml"))) {
+    if (existsSync18(join16(current, "package.json")) || existsSync18(join16(current, "pnpm-workspace.yaml"))) {
       return current;
     }
     const parent = dirname10(current);
@@ -73353,7 +73727,7 @@ function shouldManageInstalledCli(context = {}) {
   const env = context.env ?? process.env;
   const entrypoint = context.entrypoint ?? process.argv[1];
   const cwd = context.cwd ?? process.cwd();
-  if (!entrypoint || !existsSync17(entrypoint)) return false;
+  if (!entrypoint || !existsSync18(entrypoint)) return false;
   if (env.NODE_ENV === "test" || Boolean(env.CI)) return false;
   if (env.RUNTYPE_DISABLE_AUTO_UPDATE === "true") return false;
   if (isEphemeralPackageRun(entrypoint, env)) return false;
@@ -73553,7 +73927,7 @@ async function installAndActivateCliVersion(version2, options = {}) {
   if (!releaseLock) return "busy";
   const commandRunner = options.commandRunner ?? defaultCommandRunner;
   const finalRoot = getVersionRoot(paths, version2);
-  const temporaryRoot = join15(paths.versions, `.${version2}-${process.pid}-${now.getTime()}`);
+  const temporaryRoot = join16(paths.versions, `.${version2}-${process.pid}-${now.getTime()}`);
   let installed = false;
   try {
     mkdirSync12(paths.versions, { recursive: true });
@@ -73583,9 +73957,9 @@ async function installAndActivateCliVersion(version2, options = {}) {
       if (installResult.status !== 0) {
         throw installResult.error ?? new Error(`npm install exited with ${installResult.status}`);
       }
-      const temporaryPackageRoot = join15(temporaryRoot, "node_modules", "@runtypelabs", "cli");
-      const temporaryEntrypoint = join15(temporaryPackageRoot, "dist", "index.js");
-      if (readInstalledPackageVersion(temporaryPackageRoot) !== version2 || !existsSync17(temporaryEntrypoint)) {
+      const temporaryPackageRoot = join16(temporaryRoot, "node_modules", "@runtypelabs", "cli");
+      const temporaryEntrypoint = join16(temporaryPackageRoot, "dist", "index.js");
+      if (readInstalledPackageVersion(temporaryPackageRoot) !== version2 || !existsSync18(temporaryEntrypoint)) {
         throw new Error(
           `Installed package did not contain a healthy ${CLI_PACKAGE_NAME}@${version2}`
         );
@@ -73610,7 +73984,7 @@ async function installAndActivateCliVersion(version2, options = {}) {
           `Installed CLI verification failed (expected ${version2}, got ${verifyResult.stdout.trim() || "no version"})`
         );
       }
-      if (existsSync17(finalRoot)) {
+      if (existsSync18(finalRoot)) {
         const corruptRoot = `${finalRoot}.replaced-${now.getTime()}`;
         renameSync(finalRoot, corruptRoot);
         try {
@@ -73657,7 +74031,7 @@ function isAutoUpdateWorkerInvocation(args, env = process.env) {
 function spawnAutoUpdateWorker(version2, context = {}) {
   if (!isStableCliVersion(version2)) return false;
   const entrypoint = context.entrypoint ?? process.argv[1];
-  if (!entrypoint || !existsSync17(entrypoint)) return false;
+  if (!entrypoint || !existsSync18(entrypoint)) return false;
   const paths = getManagedCliPaths();
   mkdirSync12(paths.root, { recursive: true });
   const logDescriptor = openSync(paths.log, "a", 384);
@@ -73749,9 +74123,9 @@ function rollbackManagedCli(homeDir = getRuntypeHomeDir()) {
 }
 
 // src/commands/update.ts
-var updateCommand = new Command35("update").description("Check for, install, or roll back CLI updates").option("--check", "Check for an update without installing it").option("--rollback", "Roll back the most recent managed update").action(async (options) => {
+var updateCommand = new Command36("update").description("Check for, install, or roll back CLI updates").option("--check", "Check for an update without installing it").option("--rollback", "Roll back the most recent managed update").action(async (options) => {
   if (options.check && options.rollback) {
-    console.error(chalk44.red("Use either --check or --rollback, not both"));
+    console.error(chalk45.red("Use either --check or --rollback, not both"));
     process.exitCode = 1;
     return;
   }
@@ -73759,10 +74133,10 @@ var updateCommand = new Command35("update").description("Check for, install, or
     try {
       const result = rollbackManagedCli();
       const target = result.to ?? "the package-manager-installed version";
-      console.log(chalk44.green(`Rolled back ${result.from} -> ${target}`));
-      console.log(chalk44.gray("The rollback will be used on the next invocation."));
+      console.log(chalk45.green(`Rolled back ${result.from} -> ${target}`));
+      console.log(chalk45.gray("The rollback will be used on the next invocation."));
     } catch (error51) {
-      console.error(chalk44.red(error51 instanceof Error ? error51.message : String(error51)));
+      console.error(chalk45.red(error51 instanceof Error ? error51.message : String(error51)));
       process.exitCode = 1;
     }
     return;
@@ -73770,19 +74144,19 @@ var updateCommand = new Command35("update").description("Check for, install, or
   const currentVersion = getCliVersion();
   const latestVersion = await refreshCliUpdateMetadata({ force: true });
   if (!latestVersion) {
-    console.error(chalk44.red("Unable to determine the latest CLI version from npm"));
+    console.error(chalk45.red("Unable to determine the latest CLI version from npm"));
     process.exitCode = 1;
     return;
   }
   const comparison = compareVersions(latestVersion, currentVersion);
   if (comparison <= 0) {
     const status = comparison === 0 ? "up to date" : "newer than the latest published version";
-    console.log(chalk44.green(`Runtype CLI ${currentVersion} is ${status}.`));
+    console.log(chalk45.green(`Runtype CLI ${currentVersion} is ${status}.`));
     return;
   }
   if (options.check) {
     console.log(
-      `${chalk44.yellow("Update available:")} ${chalk44.red(currentVersion)} ${chalk44.gray("->")} ${chalk44.green(latestVersion)}`
+      `${chalk45.yellow("Update available:")} ${chalk45.red(currentVersion)} ${chalk45.gray("->")} ${chalk45.green(latestVersion)}`
     );
     return;
   }
@@ -73790,22 +74164,22 @@ var updateCommand = new Command35("update").description("Check for, install, or
   try {
     const result = await installAndActivateCliVersion(latestVersion);
     if (result === "busy") {
-      console.log(chalk44.yellow("Another CLI update is already in progress."));
+      console.log(chalk45.yellow("Another CLI update is already in progress."));
       return;
     }
-    console.log(chalk44.green(`Runtype CLI ${latestVersion} is ready.`));
-    console.log(chalk44.gray("It will be used on the next invocation."));
+    console.log(chalk45.green(`Runtype CLI ${latestVersion} is ready.`));
+    console.log(chalk45.gray("It will be used on the next invocation."));
   } catch (error51) {
     console.error(
-      chalk44.red(`CLI update failed: ${error51 instanceof Error ? error51.message : error51}`)
+      chalk45.red(`CLI update failed: ${error51 instanceof Error ? error51.message : error51}`)
     );
     process.exitCode = 1;
   }
 });
 
 // src/commands/mcp.ts
-import { Command as Command36, InvalidArgumentError } from "commander";
-import chalk45 from "chalk";
+import { Command as Command37, InvalidArgumentError } from "commander";
+import chalk46 from "chalk";
 
 // src/lib/mcp-client.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -74012,9 +74386,9 @@ async function resolveMcpArguments(options, dependencies = {}) {
   for (const typedField of typedFields) {
     const [key, rawValue] = splitField(typedField, "-F");
     if (rawValue.startsWith("@")) {
-      const path19 = rawValue.slice(1);
-      if (!path19) throw new Error("-F file references require @<path> or @-");
-      const fileValue = path19 === "-" ? await deps.readStdin() : await deps.readFile(path19, "utf8");
+      const path20 = rawValue.slice(1);
+      if (!path20) throw new Error("-F file references require @<path> or @-");
+      const fileValue = path20 === "-" ? await deps.readStdin() : await deps.readFile(path20, "utf8");
       setField(key, parseTypedValue(fileValue));
     } else {
       setField(key, parseTypedValue(rawValue));
@@ -74024,7 +74398,7 @@ async function resolveMcpArguments(options, dependencies = {}) {
 }
 
 // src/commands/mcp.ts
-var defaultDependencies = {
+var defaultDependencies2 = {
   ensureAuth,
   connect: connectMcpClient,
   resolveArguments: resolveMcpArguments,
@@ -74073,16 +74447,16 @@ async function withMcpClient(options, dependencies, operation, authOptions) {
 }
 function printTools(tools, target) {
   if (tools.length === 0) {
-    console.log(chalk45.gray("No MCP tools found"));
+    console.log(chalk46.gray("No MCP tools found"));
     return;
   }
   const label = target === "code" ? "Code Mode MCP Tools" : "MCP Tools";
-  console.log(chalk45.cyan(`${label}:`));
+  console.log(chalk46.cyan(`${label}:`));
   for (const tool of tools) {
     const description = tool.description?.split("\n", 1)[0];
-    console.log(`  ${chalk45.green(tool.name)}${description ? chalk45.gray(` \u2014 ${description}`) : ""}`);
+    console.log(`  ${chalk46.green(tool.name)}${description ? chalk46.gray(` \u2014 ${description}`) : ""}`);
   }
-  console.log(chalk45.dim(`
+  console.log(chalk46.dim(`
   Total: ${tools.length} tools`));
 }
 function printTool(tool) {
@@ -74112,8 +74486,8 @@ function printCallResult(result, json2) {
   printJson(result);
 }
 function createMcpCommand(overrides = {}) {
-  const dependencies = { ...defaultDependencies, ...overrides };
-  const command = new Command36("mcp").description(
+  const dependencies = { ...defaultDependencies2, ...overrides };
+  const command = new Command37("mcp").description(
     "Discover and call tools on the Runtype MCP servers"
   );
   addCommonOptions(
@@ -74126,7 +74500,7 @@ function createMcpCommand(overrides = {}) {
         else printTools(tools, options.server);
       });
     } catch (error51) {
-      console.error(chalk45.red(`Failed to list MCP tools: ${errorMessage(error51)}`));
+      console.error(chalk46.red(`Failed to list MCP tools: ${errorMessage(error51)}`));
       dependencies.setExitCode(1);
     }
   });
@@ -74144,7 +74518,7 @@ function createMcpCommand(overrides = {}) {
         else printTool(tool);
       });
     } catch (error51) {
-      console.error(chalk45.red(`Failed to inspect MCP tool: ${errorMessage(error51)}`));
+      console.error(chalk46.red(`Failed to inspect MCP tool: ${errorMessage(error51)}`));
       dependencies.setExitCode(1);
     }
   });
@@ -74182,7 +74556,7 @@ function createMcpCommand(overrides = {}) {
         usesMcpStdin(options) ? { interactive: false, exitOnFailure: false } : void 0
       );
     } catch (error51) {
-      console.error(chalk45.red(`MCP tool call failed: ${errorMessage(error51)}`));
+      console.error(chalk46.red(`MCP tool call failed: ${errorMessage(error51)}`));
       dependencies.setExitCode(1);
     }
   });
@@ -74190,6 +74564,828 @@ function createMcpCommand(overrides = {}) {
 }
 var mcpCommand = createMcpCommand();
 
+// src/commands/devices.ts
+import { spawn as spawn4 } from "child_process";
+import { readFile as readFile2 } from "fs/promises";
+import { Command as Command38 } from "commander";
+import chalk47 from "chalk";
+
+// src/lib/device-provider.ts
+var DEVICE_SIDECAR_PROTOCOL_VERSION = 1;
+var DeviceProviderError = class extends Error {
+  constructor(message, code, retryable = false, options) {
+    super(message, options);
+    this.code = code;
+    this.retryable = retryable;
+    this.name = "DeviceProviderError";
+  }
+  code;
+  retryable;
+};
+
+// src/lib/macos-device-provider.ts
+import { spawn as spawn3 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { constants as fsConstants } from "fs";
+import { access, chmod, copyFile, mkdir, realpath, rename, rm, stat } from "fs/promises";
+import os6 from "os";
+import path19 from "path";
+var MAX_SIDECAR_OUTPUT_BYTES = 1048576;
+var MAX_HELPER_BYTES = 100 * 1048576;
+var DEFAULT_SIDECAR_TIMEOUT_MS = 3e4;
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseHello(value) {
+  if (!isRecord3(value) || typeof value.providerId !== "string" || typeof value.protocolVersion !== "number" || typeof value.helperVersion !== "string" || typeof value.platform !== "string" || !Array.isArray(value.capabilities) || !value.capabilities.every((capability) => typeof capability === "string")) {
+    throw new DeviceProviderError(
+      "The native helper returned an invalid hello response",
+      "INVALID_RESPONSE"
+    );
+  }
+  return value;
+}
+async function isExecutable(filePath) {
+  try {
+    await access(filePath, fsConstants.X_OK);
+    const details = await stat(filePath);
+    return details.isFile();
+  } catch {
+    return false;
+  }
+}
+var MacOSDeviceProvider = class {
+  id = "com.runtype.device.macos";
+  platform;
+  architecture;
+  operatingSystemRelease;
+  homeDirectory;
+  workingDirectory;
+  environment;
+  sidecarTimeoutMs;
+  constructor(options = {}) {
+    this.platform = options.platform ?? process.platform;
+    this.architecture = options.architecture ?? process.arch;
+    this.operatingSystemRelease = options.operatingSystemRelease ?? os6.release();
+    this.homeDirectory = options.homeDirectory ?? os6.homedir();
+    this.workingDirectory = options.workingDirectory ?? process.cwd();
+    this.environment = options.environment ?? process.env;
+    this.sidecarTimeoutMs = options.sidecarTimeoutMs ?? DEFAULT_SIDECAR_TIMEOUT_MS;
+  }
+  async probe() {
+    const unsupportedReason = this.unsupportedReason();
+    if (unsupportedReason) {
+      return {
+        providerId: this.id,
+        supported: false,
+        installed: false,
+        reason: unsupportedReason
+      };
+    }
+    const binaryPath = await this.resolveBinary();
+    if (!binaryPath) {
+      return {
+        providerId: this.id,
+        supported: true,
+        installed: false,
+        reason: "The Runtype macOS device helper is not installed"
+      };
+    }
+    try {
+      const hello = parseHello(await this.invokeAt(binaryPath, "hello"));
+      this.assertCompatible(hello);
+      return {
+        providerId: this.id,
+        supported: true,
+        installed: true,
+        binaryPath,
+        helperVersion: hello.helperVersion,
+        protocolVersion: hello.protocolVersion
+      };
+    } catch (error51) {
+      return {
+        providerId: this.id,
+        supported: true,
+        installed: true,
+        binaryPath,
+        reason: error51 instanceof Error ? error51.message : String(error51)
+      };
+    }
+  }
+  async ensureInstalled(options = {}) {
+    this.assertPlatform();
+    if (!options.helperPath) {
+      const installedPath = await this.resolveInstalledBinary();
+      if (installedPath) {
+        return this.describeInstallation(installedPath, false);
+      }
+    }
+    const sourcePath = options.helperPath ? path19.resolve(options.helperPath) : await this.resolveDevelopmentSource();
+    if (!sourcePath) {
+      throw new DeviceProviderError(
+        [
+          "The Runtype macOS device helper is not installed.",
+          "For this internal-alpha build, compile it from the core repository and pass:",
+          "  runtype devices setup --helper-path apps/device-daemon-macos/.build/release/runtype-device"
+        ].join("\n"),
+        "HELPER_NOT_INSTALLED"
+      );
+    }
+    const resolvedSource = await realpath(sourcePath).catch(() => sourcePath);
+    const sourceDetails = await stat(resolvedSource).catch(() => null);
+    if (!sourceDetails?.isFile() || sourceDetails.size > MAX_HELPER_BYTES) {
+      throw new DeviceProviderError(
+        `Device helper is not a valid executable file: ${sourcePath}`,
+        "INVALID_HELPER"
+      );
+    }
+    await access(resolvedSource, fsConstants.X_OK).catch((error51) => {
+      throw new DeviceProviderError(
+        `Device helper is not executable: ${sourcePath}`,
+        "INVALID_HELPER",
+        false,
+        { cause: error51 }
+      );
+    });
+    const sourceHello = parseHello(await this.invokeAt(resolvedSource, "hello"));
+    this.assertCompatible(sourceHello);
+    const targetPath = this.stableBinaryPath;
+    const resolvedTarget = await realpath(targetPath).catch(() => targetPath);
+    if (resolvedSource !== resolvedTarget) {
+      const targetDirectory = path19.dirname(targetPath);
+      await mkdir(targetDirectory, { recursive: true, mode: 448 });
+      await chmod(targetDirectory, 448);
+      const temporaryPath = path19.join(targetDirectory, `.runtype-device-${randomUUID2()}.tmp`);
+      try {
+        await copyFile(resolvedSource, temporaryPath, fsConstants.COPYFILE_EXCL);
+        await chmod(temporaryPath, 448);
+        await rename(temporaryPath, targetPath);
+      } finally {
+        await rm(temporaryPath, { force: true });
+      }
+    }
+    return this.describeInstallation(targetPath, true);
+  }
+  async invoke(method, params = {}) {
+    this.assertPlatform();
+    const binaryPath = await this.resolveBinary();
+    if (!binaryPath) {
+      throw new DeviceProviderError(
+        "The Runtype macOS device helper is not installed. Run `runtype devices setup` first.",
+        "HELPER_NOT_INSTALLED"
+      );
+    }
+    const result = await this.invokeAt(binaryPath, method, params);
+    if (!isRecord3(result)) {
+      throw new DeviceProviderError(
+        "The native helper returned a non-object result",
+        "INVALID_RESPONSE"
+      );
+    }
+    return result;
+  }
+  async removeInstalledBinary() {
+    const installed = await isExecutable(this.stableBinaryPath);
+    if (!installed) return false;
+    await rm(this.stableBinaryPath, { force: true });
+    return true;
+  }
+  get stableBinaryPath() {
+    return path19.join(this.homeDirectory, ".runtype", "device", "bin", "runtype-device");
+  }
+  installedCandidates() {
+    return [
+      this.stableBinaryPath,
+      path19.join(
+        this.homeDirectory,
+        "Applications",
+        "Runtype Device.app",
+        "Contents",
+        "MacOS",
+        "runtype-device"
+      ),
+      "/Applications/Runtype Device.app/Contents/MacOS/runtype-device"
+    ];
+  }
+  developmentCandidates() {
+    return [
+      ...this.environment.RUNTYPE_DEVICE_HELPER_PATH ? [path19.resolve(this.environment.RUNTYPE_DEVICE_HELPER_PATH)] : [],
+      path19.join(
+        this.workingDirectory,
+        "apps",
+        "device-daemon-macos",
+        ".build",
+        "release",
+        "runtype-device"
+      ),
+      path19.join(
+        this.workingDirectory,
+        "apps",
+        "device-daemon-macos",
+        ".build",
+        "debug",
+        "runtype-device"
+      )
+    ];
+  }
+  async firstExecutable(candidates) {
+    for (const candidate of candidates) {
+      if (await isExecutable(candidate)) return candidate;
+    }
+    return null;
+  }
+  resolveInstalledBinary() {
+    return this.firstExecutable(this.installedCandidates());
+  }
+  resolveDevelopmentSource() {
+    return this.firstExecutable(this.developmentCandidates());
+  }
+  async resolveBinary() {
+    return await this.resolveInstalledBinary() ?? await this.firstExecutable(this.developmentCandidates());
+  }
+  assertPlatform() {
+    const reason = this.unsupportedReason();
+    if (!reason) return;
+    throw new DeviceProviderError(
+      reason,
+      this.platform === "darwin" ? "UNSUPPORTED_OS_VERSION" : "UNSUPPORTED_PLATFORM"
+    );
+  }
+  unsupportedReason() {
+    if (this.platform !== "darwin") {
+      return `Runtype Device currently supports macOS only (detected ${this.platform}/${this.architecture})`;
+    }
+    const darwinMajor = Number.parseInt(this.operatingSystemRelease.split(".")[0] ?? "", 10);
+    if (!Number.isInteger(darwinMajor) || darwinMajor < 23) {
+      return `Runtype Device requires macOS 14 or newer (detected Darwin ${this.operatingSystemRelease})`;
+    }
+    return null;
+  }
+  assertCompatible(hello) {
+    if (hello.providerId !== this.id || hello.platform !== "macos") {
+      throw new DeviceProviderError(
+        `Unexpected native provider identity: ${hello.providerId}/${hello.platform}`,
+        "PROVIDER_MISMATCH"
+      );
+    }
+    if (hello.protocolVersion !== DEVICE_SIDECAR_PROTOCOL_VERSION) {
+      throw new DeviceProviderError(
+        `Native helper protocol ${hello.protocolVersion} is incompatible with CLI protocol ${DEVICE_SIDECAR_PROTOCOL_VERSION}`,
+        "PROTOCOL_MISMATCH"
+      );
+    }
+  }
+  async describeInstallation(binaryPath, installed) {
+    const hello = parseHello(await this.invokeAt(binaryPath, "hello"));
+    this.assertCompatible(hello);
+    return {
+      providerId: this.id,
+      binaryPath,
+      helperVersion: hello.helperVersion,
+      protocolVersion: hello.protocolVersion,
+      installed
+    };
+  }
+  async invokeAt(binaryPath, method, params = {}) {
+    const id = randomUUID2();
+    const request = JSON.stringify({
+      protocolVersion: DEVICE_SIDECAR_PROTOCOL_VERSION,
+      id,
+      method,
+      params
+    });
+    const child = spawn3(binaryPath, ["control"], {
+      env: this.environment,
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: false
+    });
+    const stdout = [];
+    const stderr = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let outputExceeded = false;
+    let timedOut = false;
+    child.stdout.on("data", (chunk) => {
+      stdoutBytes += chunk.length;
+      if (stdoutBytes > MAX_SIDECAR_OUTPUT_BYTES) {
+        outputExceeded = true;
+        child.kill("SIGKILL");
+        return;
+      }
+      stdout.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (stderrBytes >= MAX_SIDECAR_OUTPUT_BYTES) return;
+      stderrBytes += chunk.length;
+      stderr.push(chunk.subarray(0, MAX_SIDECAR_OUTPUT_BYTES - (stderrBytes - chunk.length)));
+    });
+    const completion = new Promise(
+      (resolve13, reject) => {
+        child.once("error", reject);
+        child.once("close", (code, signal) => resolve13({ code, signal }));
+      }
+    );
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, this.sidecarTimeoutMs);
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(`${request}
+`);
+    let completionResult;
+    try {
+      completionResult = await completion;
+    } catch (error51) {
+      throw new DeviceProviderError(
+        `Unable to start the native device helper at ${binaryPath}`,
+        "HELPER_START_FAILED",
+        false,
+        { cause: error51 }
+      );
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (timedOut) {
+      throw new DeviceProviderError(
+        `Native device helper timed out after ${this.sidecarTimeoutMs}ms`,
+        "HELPER_TIMEOUT",
+        true
+      );
+    }
+    if (outputExceeded) {
+      throw new DeviceProviderError(
+        `Native device helper output exceeded ${MAX_SIDECAR_OUTPUT_BYTES} bytes`,
+        "OUTPUT_TOO_LARGE"
+      );
+    }
+    const output = Buffer.concat(stdout).toString("utf8").trim();
+    let response;
+    try {
+      response = JSON.parse(output);
+    } catch (error51) {
+      const detail = Buffer.concat(stderr).toString("utf8").trim();
+      throw new DeviceProviderError(
+        `Native device helper returned invalid JSON${detail ? `: ${detail}` : ""}`,
+        "INVALID_RESPONSE",
+        false,
+        { cause: error51 }
+      );
+    }
+    if (response.protocolVersion !== DEVICE_SIDECAR_PROTOCOL_VERSION || response.id !== id || typeof response.ok !== "boolean") {
+      throw new DeviceProviderError(
+        "Native device helper returned a mismatched response envelope",
+        "INVALID_RESPONSE"
+      );
+    }
+    if (!response.ok) {
+      throw new DeviceProviderError(
+        response.error?.message || "Native device operation failed",
+        response.error?.code || "OPERATION_FAILED",
+        response.error?.retryable === true
+      );
+    }
+    if (completionResult.code !== 0) {
+      throw new DeviceProviderError(
+        `Native device helper exited with status ${completionResult.code ?? completionResult.signal ?? "unknown"}`,
+        "HELPER_EXITED"
+      );
+    }
+    return response.result;
+  }
+};
+
+// src/commands/devices.ts
+var defaultDependencies3 = {
+  ensureAuth,
+  createClient: (apiKey) => createCliClient(apiKey),
+  createProvider: () => new MacOSDeviceProvider(),
+  getApiUrl,
+  sleep: (milliseconds) => new Promise((resolve13) => setTimeout(resolve13, milliseconds)),
+  setExitCode: (code) => {
+    process.exitCode = code;
+  }
+};
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function unwrapData(response) {
+  if (!isRecord4(response) || !("data" in response)) {
+    throw new Error("Runtype API returned an invalid device response");
+  }
+  return response.data;
+}
+function errorMessage2(error51) {
+  return error51 instanceof Error ? error51.message : String(error51);
+}
+function apiStatusCode(error51) {
+  return isRecord4(error51) && typeof error51.statusCode === "number" ? error51.statusCode : null;
+}
+function isRecordedRevocationError(error51) {
+  if (apiStatusCode(error51) !== 503) return false;
+  const data = isRecord4(error51) && isRecord4(error51.data) ? error51.data : null;
+  const detail = typeof data?.error === "string" ? data.error : errorMessage2(error51);
+  return detail.toLowerCase().includes("revocation was recorded");
+}
+function printCommandError(label, error51) {
+  console.error(chalk47.red(label));
+  console.error(chalk47.red(errorMessage2(error51)));
+}
+function printDevice(device) {
+  printDetail("Runtype Device", [
+    { label: "ID", value: device.id },
+    { label: "Name", value: device.name },
+    { label: "Platform", value: device.platform },
+    { label: "Online", value: device.status?.online },
+    { label: "Last seen", value: device.status?.lastSeenAt },
+    { label: "Available tools", value: device.status?.availableTools.join(", ") },
+    { label: "MCP URL", value: device.mcpUrl },
+    { label: "Revoked", value: device.revokedAt }
+  ]);
+}
+function localDeviceId(status) {
+  return typeof status.deviceId === "string" && status.deviceId.length > 0 ? status.deviceId : null;
+}
+async function authenticatedClient(dependencies) {
+  const apiKey = await dependencies.ensureAuth({ exitOnFailure: false });
+  if (!apiKey) {
+    dependencies.setExitCode(1);
+    return null;
+  }
+  return dependencies.createClient(apiKey);
+}
+async function waitForDevice(client, deviceId, dependencies) {
+  let latest = null;
+  for (let attempt = 0; attempt < 8; attempt += 1) {
+    try {
+      latest = unwrapData(
+        await client.get(`/devices/${encodeURIComponent(deviceId)}`)
+      );
+      if (latest.status?.online) return latest;
+    } catch {
+    }
+    if (attempt < 7) await dependencies.sleep(750);
+  }
+  return latest;
+}
+async function runTail2(logPath, lines) {
+  const child = spawn4("/usr/bin/tail", ["-n", String(lines), "-f", logPath], {
+    stdio: "inherit",
+    shell: false
+  });
+  return new Promise((resolve13, reject) => {
+    child.once("error", reject);
+    child.once("close", (code) => resolve13(code ?? 1));
+  });
+}
+function createDevicesCommand(overrides = {}) {
+  const dependencies = { ...defaultDependencies3, ...overrides };
+  const command = new Command38("devices").description(
+    "Manage local computers connected to Runtype agents"
+  );
+  command.command("setup").description("Install, pair, and start Runtype Device on this Mac").option("--name <name>", "Device name shown in Runtype").option("--helper-path <path>", "Install a locally built native helper (internal alpha)").option("--json", "Output as JSON").action(async (options) => {
+    const provider = dependencies.createProvider();
+    let pairedDeviceId = null;
+    try {
+      const installation = await provider.ensureInstalled({ helperPath: options.helperPath });
+      const before = await provider.invoke("status");
+      const existingDeviceId = localDeviceId(before);
+      if (existingDeviceId) {
+        throw new DeviceProviderError(
+          `This Mac is already paired as ${existingDeviceId}. Run \`runtype devices status\` instead.`,
+          "ALREADY_PAIRED"
+        );
+      }
+      const client = await authenticatedClient(dependencies);
+      if (!client) return;
+      const pairing = unwrapData(
+        await client.post("/devices/pairing-sessions", {})
+      );
+      const pairParams = {
+        pairingUri: pairing.pairingUri,
+        apiUrl: dependencies.getApiUrl()
+      };
+      if (options.name) pairParams.name = options.name;
+      const paired = await provider.invoke("pair", pairParams);
+      pairedDeviceId = paired.deviceId;
+      const service = await provider.invoke("install");
+      const local = await provider.invoke("status");
+      const device = await waitForDevice(client, paired.deviceId, dependencies);
+      const result = {
+        deviceId: paired.deviceId,
+        name: paired.name,
+        online: device?.status?.online ?? false,
+        mcpUrl: device?.mcpUrl ?? null,
+        installation,
+        service,
+        local
+      };
+      if (options.json) {
+        printJson(result);
+        return;
+      }
+      console.log(chalk47.green(`Paired and started ${paired.name}`));
+      console.log(`  Device ID: ${chalk47.green(paired.deviceId)}`);
+      console.log(
+        `  Relay: ${device?.status?.online ? chalk47.green("online") : chalk47.yellow("connecting")}`
+      );
+      if (device?.mcpUrl) console.log(`  MCP URL: ${device.mcpUrl}`);
+      if (local.messagesDatabaseReadable !== true) {
+        console.log(
+          chalk47.yellow(
+            `
+Grant Full Disk Access to ${String(local.executablePath)} to enable iMessage reads.`
+          )
+        );
+      }
+      console.log(chalk47.gray("iMessage sending remains disabled by local policy."));
+    } catch (error51) {
+      printCommandError("Failed to set up Runtype Device", error51);
+      if (pairedDeviceId) {
+        console.error(
+          chalk47.yellow(
+            `Pairing completed as ${pairedDeviceId}, but startup did not finish. Run \`runtype devices install\` after correcting the error.`
+          )
+        );
+      }
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("install").description("Install or restart the local Runtype Device background service").option("--helper-path <path>", "Install a locally built native helper (internal alpha)").option("--json", "Output as JSON").action(async (options) => {
+    const provider = dependencies.createProvider();
+    try {
+      const installation = await provider.ensureInstalled({ helperPath: options.helperPath });
+      const service = await provider.invoke("install");
+      if (options.json) {
+        printJson({ installation, service });
+      } else {
+        console.log(chalk47.green("Runtype Device is installed and running"));
+        console.log(`  Helper: ${installation.binaryPath}`);
+        if (typeof service.logPath === "string") console.log(`  Logs: ${service.logPath}`);
+      }
+    } catch (error51) {
+      printCommandError("Failed to install Runtype Device", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("list").description("List paired devices and relay status").option("--json", "Output as JSON").action(async (options) => {
+    try {
+      const client = await authenticatedClient(dependencies);
+      if (!client) return;
+      const devices = unwrapData(await client.get("/devices"));
+      if (options.json) {
+        printJson({ data: devices });
+        return;
+      }
+      if (devices.length === 0) {
+        console.log(chalk47.gray("No paired devices"));
+        return;
+      }
+      console.log(chalk47.cyan("Runtype Devices:"));
+      for (const device of devices) {
+        const state = device.revokedAt ? "revoked" : device.status?.online ? "online" : "offline";
+        console.log(`  ${chalk47.green(device.id)}  ${device.name}  ${state}`);
+      }
+    } catch (error51) {
+      printCommandError("Failed to list Runtype devices", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("status [id]").description("Show local status, or cloud relay status for a device ID").option("--json", "Output as JSON").action(async (id, options) => {
+    try {
+      if (id) {
+        const client = await authenticatedClient(dependencies);
+        if (!client) return;
+        const device = unwrapData(
+          await client.get(`/devices/${encodeURIComponent(id)}`)
+        );
+        if (options.json) printJson(device);
+        else printDevice(device);
+        return;
+      }
+      const local = await dependencies.createProvider().invoke("status");
+      if (options.json) {
+        printJson(local);
+      } else {
+        printDetail("Local Runtype Device", [
+          { label: "Device ID", value: local.deviceId ?? "not paired" },
+          { label: "API URL", value: local.apiUrl },
+          { label: "Helper version", value: local.helperVersion },
+          { label: "Service installed", value: local.serviceInstalled },
+          { label: "Service running", value: local.serviceRunning },
+          { label: "Messages readable", value: local.messagesDatabaseReadable },
+          { label: "Sending enabled", value: local.allowSend },
+          { label: "Executable", value: local.executablePath },
+          { label: "Logs", value: local.logPath }
+        ]);
+      }
+    } catch (error51) {
+      printCommandError("Failed to read Runtype Device status", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("doctor").description("Check native helper, background service, and Messages permissions").option("--json", "Output as JSON").action(async (options) => {
+    const provider = dependencies.createProvider();
+    try {
+      const probe = await provider.probe();
+      const local = probe.installed && !probe.reason ? await provider.invoke("doctor") : null;
+      const healthy = probe.supported && probe.installed && local?.serviceRunning === true && local.messagesDatabaseReadable === true;
+      const result = { healthy, probe, local };
+      if (options.json) {
+        printJson(result);
+      } else {
+        console.log(
+          healthy ? chalk47.green("Runtype Device is healthy") : chalk47.yellow("Runtype Device needs attention")
+        );
+        console.log(`  Platform supported: ${probe.supported ? "yes" : "no"}`);
+        console.log(`  Helper installed: ${probe.installed ? "yes" : "no"}`);
+        if (probe.reason) console.log(`  Helper: ${probe.reason}`);
+        if (local) {
+          console.log(`  Service running: ${local.serviceRunning === true ? "yes" : "no"}`);
+          console.log(
+            `  Messages readable: ${local.messagesDatabaseReadable === true ? "yes" : "no"}`
+          );
+          if (local.messagesDatabaseReadable !== true) {
+            console.log(
+              chalk47.yellow(`  Grant Full Disk Access to ${String(local.executablePath)}`)
+            );
+          }
+        }
+      }
+      if (!healthy) dependencies.setExitCode(1);
+    } catch (error51) {
+      printCommandError("Runtype Device diagnostics failed", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("policy <mode>").description("Set local iMessage send policy (allow-send or deny-send)").option("--json", "Output as JSON").action(async (mode, options) => {
+    if (mode !== "allow-send" && mode !== "deny-send") {
+      console.error(chalk47.red("Policy must be allow-send or deny-send"));
+      dependencies.setExitCode(1);
+      return;
+    }
+    const provider = dependencies.createProvider();
+    let policyUpdated = false;
+    try {
+      const policy = await provider.invoke("policy", {
+        allowSend: mode === "allow-send"
+      });
+      policyUpdated = true;
+      const status = await provider.invoke("status");
+      const service = status.serviceInstalled === true ? await provider.invoke("install") : null;
+      const result = {
+        ...policy,
+        capabilitiesRepublished: service !== null,
+        service
+      };
+      if (options.json) printJson(result);
+      else {
+        console.log(
+          chalk47.green(
+            `Local iMessage sending is ${mode === "allow-send" ? "enabled" : "disabled"}`
+          )
+        );
+        if (service)
+          console.log(chalk47.gray("Restarted the device service to publish capabilities."));
+        else {
+          console.log(
+            chalk47.yellow(
+              "The device service is not installed; run `runtype devices install` to publish this policy."
+            )
+          );
+        }
+      }
+    } catch (error51) {
+      printCommandError(
+        policyUpdated ? "Local policy was updated, but the device service could not publish it" : "Failed to update local device policy",
+        error51
+      );
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("mcp-url <id>").description("Print the managed MCP endpoint for a paired device").option("--json", "Output as JSON").action(async (id, options) => {
+    try {
+      const client = await authenticatedClient(dependencies);
+      if (!client) return;
+      const device = unwrapData(
+        await client.get(`/devices/${encodeURIComponent(id)}`)
+      );
+      if (options.json) printJson({ deviceId: id, mcpUrl: device.mcpUrl ?? null });
+      else if (device.mcpUrl) console.log(device.mcpUrl);
+      else throw new Error("The API did not return an MCP URL for this device");
+    } catch (error51) {
+      printCommandError("Failed to get device MCP URL", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("revoke <id>").description("Revoke a paired device in Runtype").option("--yes", "Confirm irreversible device revocation").option("--json", "Output as JSON").action(async (id, options) => {
+    if (!options.yes) {
+      console.error(chalk47.red("Pass --yes to confirm irreversible device revocation"));
+      dependencies.setExitCode(1);
+      return;
+    }
+    try {
+      const client = await authenticatedClient(dependencies);
+      if (!client) return;
+      const device = unwrapData(
+        await client.post(`/devices/${encodeURIComponent(id)}/revoke`, {})
+      );
+      if (options.json) printJson(device);
+      else {
+        console.log(chalk47.green(`Revoked ${device.name} (${device.id})`));
+        console.log(chalk47.gray("If this is the local Mac, run `runtype devices reset --yes`."));
+      }
+    } catch (error51) {
+      if (isRecordedRevocationError(error51)) {
+        const result = {
+          deviceId: id,
+          revoked: true,
+          relayDisconnectConfirmed: false,
+          message: errorMessage2(error51)
+        };
+        if (options.json) printJson(result);
+        else {
+          console.error(
+            chalk47.yellow(
+              `Revocation was recorded for ${id}, but relay disconnection was not confirmed.`
+            )
+          );
+          console.error(
+            chalk47.yellow("Retry this command, and reset the local Mac if applicable.")
+          );
+        }
+        dependencies.setExitCode(1);
+        return;
+      }
+      printCommandError("Failed to revoke Runtype device", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("logs").description("Read local Runtype Device logs").option("-n, --lines <count>", "Number of lines", "100").option("-f, --follow", "Follow the log file").action(async (options) => {
+    try {
+      const lines = Number.parseInt(options.lines, 10);
+      if (!Number.isInteger(lines) || lines < 1 || lines > 1e4) {
+        throw new Error("--lines must be an integer between 1 and 10000");
+      }
+      const status = await dependencies.createProvider().invoke("status");
+      if (typeof status.logPath !== "string")
+        throw new Error("The helper did not return a log path");
+      if (options.follow) {
+        const code = await runTail2(status.logPath, lines);
+        if (code !== 0) dependencies.setExitCode(code);
+        return;
+      }
+      const content = await readFile2(status.logPath, "utf8").catch((error51) => {
+        const code = isRecord4(error51) ? error51.code : void 0;
+        if (code === "ENOENT") return "";
+        throw error51;
+      });
+      const entries = content.split(/\r?\n/u);
+      if (entries.at(-1) === "") entries.pop();
+      const selected = entries.slice(-lines).join("\n");
+      if (selected) console.log(selected);
+      else console.log(chalk47.gray("No local device logs yet"));
+    } catch (error51) {
+      printCommandError("Failed to read Runtype Device logs", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("uninstall").description("Stop the local background service while preserving pairing state").option("--remove-binary", "Also remove the CLI-managed helper binary").option("--json", "Output as JSON").action(async (options) => {
+    const provider = dependencies.createProvider();
+    try {
+      const service = await provider.invoke("uninstall");
+      const removedBinary = options.removeBinary ? await provider.removeInstalledBinary() : false;
+      if (options.json) printJson({ service, removedBinary });
+      else console.log(chalk47.green("Stopped and uninstalled the local Runtype Device service"));
+    } catch (error51) {
+      printCommandError("Failed to uninstall Runtype Device", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  command.command("reset").description("Clear local pairing state and rotate the native signing identity").option("--yes", "Confirm destructive local reset").option("--json", "Output as JSON").action(async (options) => {
+    if (!options.yes) {
+      console.error(chalk47.red("Pass --yes to confirm destructive local reset"));
+      dependencies.setExitCode(1);
+      return;
+    }
+    try {
+      const result = await dependencies.createProvider().invoke("reset", { rotateIdentity: true });
+      if (options.json) printJson(result);
+      else {
+        console.log(chalk47.green("Cleared local device state and rotated the signing identity"));
+        console.log(
+          chalk47.gray("Revoke the old device in Runtype if it has not already been revoked.")
+        );
+      }
+    } catch (error51) {
+      printCommandError("Failed to reset local Runtype Device state", error51);
+      dependencies.setExitCode(1);
+    }
+  });
+  return command;
+}
+var devicesCommand = createDevicesCommand();
+
 // src/index.ts
 init_credential_store();
 
@@ -74209,7 +75405,7 @@ function registerGlobalOptionForwarding(program2) {
 // src/index.ts
 loadEnv();
 setCliTitle();
-var program = new Command37();
+var program = new Command39();
 program.name("runtype").description("CLI for Runtype AI Platform").version(getCliVersion()).option("-v, --verbose", "Enable verbose output").option("--api-url <url>", "Override API URL").option("--json", "Output as JSON");
 program.addCommand(initCommand);
 program.addCommand(loginCommand);
@@ -74246,7 +75442,9 @@ program.addCommand(deployCommand);
 program.addCommand(skillsCommand);
 program.addCommand(updateCommand);
 program.addCommand(installMcpCommand);
+program.addCommand(onboardCommand);
 program.addCommand(mcpCommand);
+program.addCommand(devicesCommand);
 program.addCommand(appsCommand, { hidden: process.env.RUNTYPE_APPS_CLI !== "1" });
 registerGlobalOptionForwarding(program);
 program.exitOverride();
@@ -74279,17 +75477,17 @@ async function run() {
 run().catch((error51) => {
   const commanderError = error51;
   if (commanderError.code === "commander.missingArgument") {
-    console.error(chalk46.red(`Error: ${commanderError.message}`));
+    console.error(chalk48.red(`Error: ${commanderError.message}`));
     process.exit(1);
   } else if (commanderError.code === "commander.unknownOption") {
-    console.error(chalk46.red(`Error: ${commanderError.message}`));
+    console.error(chalk48.red(`Error: ${commanderError.message}`));
     process.exit(1);
   } else if (commanderError.code === "commander.unknownCommand") {
     process.exit(1);
   } else if (commanderError.code === "commander.help" || commanderError.code === "commander.helpDisplayed" || commanderError.code === "commander.version") {
     process.exit(0);
   } else {
-    console.error(chalk46.red("An unexpected error occurred:"));
+    console.error(chalk48.red("An unexpected error occurred:"));
     console.error(error51);
     process.exit(1);
   }
@@ -74298,12 +75496,12 @@ async function handleNoCommand() {
   const store = new CredentialStore();
   const hasCredentials = await store.hasCredentials();
   if (!hasCredentials) {
-    console.log(chalk46.cyan("\nWelcome to Runtype CLI!\n"));
+    console.log(chalk48.cyan("\nWelcome to Runtype CLI!\n"));
     console.log("It looks like this is your first time. Run the setup wizard:");
-    console.log(`  ${chalk46.green("runtype init")}
+    console.log(`  ${chalk48.green("runtype init")}
 `);
     console.log("Or see all available commands:");
-    console.log(`  ${chalk46.green("runtype --help")}
+    console.log(`  ${chalk48.green("runtype --help")}
 `);
   } else {
     try {