@tenderprompt/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,4169 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { validateTenderApp, } from "@tenderprompt/tender-app-validator";
+import { collectTenderAppFiles } from "./local-files.js";
+class TenderCliUsageError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "TenderCliUsageError";
+    }
+}
+const DEFAULT_PROFILE_NAME = "default";
+const DEFAULT_BASE_URL = "https://app.tenderprompt.com";
+const ARTIFACT_SOURCE_EXPORT_MAX_FILES = 1000;
+const ARTIFACT_SOURCE_EXPORT_MAX_FILE_BYTES = 2 * 1024 * 1024;
+function rootHelp() {
+    return `Usage: tender <command> [options]
+
+Commands:
+  tender auth login --device
+                             Authorize this machine with a browser-approved device flow
+  tender auth status         Show whether a Tender API token is available
+  tender artifacts list      List artifacts visible to the current token
+  tender artifacts create --name <name>
+                             Create a new artifact in the current account
+  tender artifacts update <artifact-id> --name <name>
+                             Update artifact metadata
+  tender artifacts init <artifact-id>
+                             Bootstrap a checkout for local agent work
+  tender artifacts validate <artifact-id>
+                             Validate the server-side artifact workspace
+  tender artifacts build <artifact-id>
+                             Build the current artifact workspace
+  tender artifacts preview rebuild <artifact-id>
+                             Rebuild the preview from the current workspace
+  tender artifacts preview status <artifact-id>
+                             Show the latest or commit-pinned preview job
+  tender artifacts preview watch <artifact-id>
+                             Stream or print lifecycle events for a preview job
+  tender artifacts publish <artifact-id>
+                             Publish after explicit confirmation
+  tender artifacts publish status <artifact-id>
+                             Show publish job status by job id
+  tender artifacts publish watch <artifact-id>
+                             Stream or print lifecycle events for a publish job
+  tender artifacts context fetch <artifact-id>
+                             Fetch managed agent context into a checkout
+  tender artifacts context status <artifact-id>
+                             Report whether managed context is stale
+  tender artifacts context refresh <artifact-id>
+                             Refresh managed context files
+  tender artifacts git setup <artifact-id>
+                             Configure a checkout to push to the artifact remote
+  tender artifacts doctor    Validate a local Tender App checkout
+
+Examples:
+  tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
+  tender auth status --json
+  tender artifacts list --json
+  tender artifacts create --name "Exit Intent Widget" --json
+  tender artifacts update artifact_123 --name "Sale Widget" --json
+  tender artifacts init artifact_123 --dir ./widget --json
+  tender artifacts validate artifact_123 --json
+  tender artifacts build artifact_123 --commit $(git rev-parse HEAD) --json
+  tender artifacts preview rebuild artifact_123 --commit $(git rev-parse HEAD) --stream --json
+  tender artifacts preview status artifact_123 --commit $(git rev-parse HEAD) --json
+  tender artifacts preview watch artifact_123 --job job_123 --stream --json
+  tender artifacts publish artifact_123 --commit $(git rev-parse HEAD) --confirm publish --stream --json
+  tender artifacts context fetch artifact_123 --dir ./widget --dry-run --json
+  tender artifacts context status artifact_123 --dir ./widget --json
+  tender artifacts context refresh artifact_123 --dir ./widget --dry-run --json
+  tender artifacts git setup artifact_123 --dir ./widget --json
+  tender artifacts doctor --dir ./widget
+  tender artifacts doctor --dir ./widget --json`;
+}
+function authHelp() {
+    return `Usage: tender auth <command> [options]
+
+Commands:
+  tender auth login --device  Authorize the CLI with a browser-approved device flow
+  tender auth status          Show token source, profile, account, and expiry metadata
+
+Examples:
+  tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
+  tender auth login --device --profile publish --artifact artifact_123 --ttl 7d --save-profile publish
+  tender auth status --json`;
+}
+function authLoginHelp() {
+    return `Usage: tender auth login --device [--base-url <url>] [--profile <edit-preview|publish|create>] [--artifact <artifact-id>] [--ttl <7d|14d|30d>] [--save-profile <name>] [--no-poll] [--json]
+
+Options:
+  --device                 Use the OAuth device-code flow.
+  --base-url <url>         Tender base URL. Defaults to TENDER_BASE_URL or https://app.tenderprompt.com.
+  --profile <value>        Token permission profile: edit-preview, publish, or create. Defaults to edit-preview.
+  --artifact <artifact-id> Scope the token to one artifact. Required for normal edit-preview agent work.
+  --ttl <value>            Token lifetime: 7d, 14d, or 30d. Defaults to 7d.
+  --save-profile <name>    Local config profile name. Defaults to default.
+  --no-poll                Print the verification URL and exit without waiting for approval.
+  --json                   Emit stable JSON for coding agents.
+
+Examples:
+  tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
+  tender auth login --device --profile publish --artifact artifact_123 --ttl 7d --save-profile publish --json
+  tender auth login --device --profile create --ttl 7d --save-profile account`;
+}
+function authStatusHelp() {
+    return `Usage: tender auth status [--profile <name>] [--json]
+
+Options:
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender auth status
+  tender auth status --profile publish --json`;
+}
+function artifactsHelp() {
+    return `Usage: tender artifacts <command> [options]
+
+Commands:
+  tender artifacts list      List artifacts visible to the current token
+  tender artifacts create --name <name>
+                             Create a new artifact in the current account
+  tender artifacts update <artifact-id> --name <name>
+                             Update artifact metadata
+  tender artifacts init <artifact-id>
+                             Bootstrap context files and the tender Git remote
+  tender artifacts validate <artifact-id>
+                             Validate the server-side artifact workspace
+  tender artifacts build <artifact-id>
+                             Build the current artifact workspace
+  tender artifacts preview rebuild <artifact-id>
+                             Rebuild the preview and optionally stream lifecycle events
+  tender artifacts preview status <artifact-id>
+                             Show preview job status by latest, commit, or job id
+  tender artifacts preview watch <artifact-id>
+                             Replay lifecycle events by latest, commit, or job id
+  tender artifacts publish <artifact-id>
+                             Publish after dry-run or explicit confirmation
+  tender artifacts publish status <artifact-id>
+                             Show publish job status by job id
+  tender artifacts publish watch <artifact-id>
+                             Replay lifecycle events for a publish job id
+  tender artifacts context fetch <artifact-id>
+                             Fetch AGENTS.md, skills, and Tender App scaffold files
+  tender artifacts context status <artifact-id>
+                             Show managed context freshness for a checkout
+  tender artifacts context refresh <artifact-id>
+                             Refresh managed context files in a checkout
+  tender artifacts git setup <artifact-id>
+                             Configure the tender Git remote and credential helper
+  tender artifacts doctor    Validate local context, TypeScript scaffold, and Tender App rules
+  tender artifacts git remote <artifact-id>
+                             Show Tender-hosted Git remote metadata
+
+Examples:
+  tender artifacts list --json
+  tender artifacts create --name "Exit Intent Widget" --json
+  tender artifacts update artifact_123 --name "Sale Widget" --json
+  tender artifacts init artifact_123 --dir ./widget --json
+  tender artifacts validate artifact_123 --json
+  tender artifacts build artifact_123 --commit $(git rev-parse HEAD) --json
+  tender artifacts preview rebuild artifact_123 --commit $(git rev-parse HEAD) --stream --json
+  tender artifacts preview status artifact_123 --commit $(git rev-parse HEAD) --json
+  tender artifacts preview watch artifact_123 --job job_123 --stream --json
+  tender artifacts publish artifact_123 --dry-run --json
+  tender artifacts publish status artifact_123 --job job_123 --json
+  tender artifacts publish watch artifact_123 --job job_123 --stream --json
+  tender artifacts context fetch artifact_123 --dir ./widget --dry-run --json
+  tender artifacts context status artifact_123 --dir ./widget --json
+  tender artifacts context refresh artifact_123 --dir ./widget --dry-run --json
+  tender artifacts git setup artifact_123 --dir ./widget --json
+  tender artifacts doctor --dir ./widget
+  tender artifacts doctor --json
+  tender artifacts git remote artifact_123 --ttl 7d --json`;
+}
+function artifactsListHelp() {
+    return `Usage: tender artifacts list [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Options:
+  --base-url <url>   Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>    Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>   Local config profile name. Defaults to the saved default profile.
+  --json             Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts list --json
+  tender artifacts list --profile account --json
+  TENDER_API_TOKEN=tpat_... tender artifacts list --base-url https://app.tenderprompt.com --json`;
+}
+function artifactsCreateHelp() {
+    return `Usage: tender artifacts create --name <name> [--target-pack <id>] [--target-pack-version <version>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Options:
+  --name <name>                  Artifact name.
+  --target-pack <id>             Target pack id. Defaults to the API default.
+  --target-pack-version <value>  Target pack version. Defaults to the API default.
+  --base-url <url>               Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>                Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>               Local config profile name. Defaults to the saved default profile.
+  --json                         Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts create --name "Exit Intent Widget" --json
+  tender artifacts create --name "Exit Intent Widget" --profile account --json`;
+}
+function artifactsUpdateHelp() {
+    return `Usage: tender artifacts update <artifact-id> --name <name> [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Options:
+  --name <name>     New artifact name.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts update artifact_123 --name "Sale Widget" --json`;
+}
+function artifactsInitHelp() {
+    return `Usage: tender artifacts init <artifact-id> [--dir <path>] [--remote <name>] [--base-url <url>] [--token <token>] [--profile <name>] [--ttl <7d|14d|30d>] [--dry-run] [--force] [--json]
+
+Options:
+  --dir <path>      Local checkout directory to create/update. Defaults to current directory.
+  --remote <name>   Git remote name to add or update. Defaults to tender.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --ttl <value>     Deprecated for Tender-hosted Git remotes; accepted for compatibility.
+  --dry-run         Show file and Git actions without writing.
+  --force           Overwrite conflicting managed context files.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts init artifact_123 --dir ./widget --dry-run --json
+  tender artifacts init artifact_123 --dir ./widget --json
+  tender artifacts init artifact_123 --dir ./widget --force --json`;
+}
+function artifactsContextFetchHelp() {
+    return `Usage: tender artifacts context fetch <artifact-id> [--dir <path>] [--base-url <url>] [--token <token>] [--profile <name>] [--dry-run] [--force] [--json]
+
+Options:
+  --dir <path>      Local checkout to update. Defaults to current directory.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --dry-run         Show create/overwrite/conflict actions without writing files.
+  --force           Overwrite conflicting managed context files.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts context fetch artifact_123 --dir ./widget --dry-run --json
+  tender artifacts context fetch artifact_123 --dir ./widget --force
+  tender artifacts context fetch artifact_123 --profile agent --json`;
+}
+function artifactsContextStatusHelp() {
+    return `Usage: tender artifacts context status <artifact-id> [--dir <path>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Options:
+  --dir <path>      Local checkout to inspect. Defaults to current directory.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts context status artifact_123 --dir ./widget --json`;
+}
+function artifactsContextRefreshHelp() {
+    return `Usage: tender artifacts context refresh <artifact-id> [--dir <path>] [--base-url <url>] [--token <token>] [--profile <name>] [--dry-run] [--force] [--json]
+
+Options:
+  --dir <path>      Local checkout to update. Defaults to current directory.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --dry-run         Show create/overwrite/conflict actions without writing files.
+  --force           Overwrite conflicting managed context files.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts context refresh artifact_123 --dir ./widget --dry-run --json
+  tender artifacts context refresh artifact_123 --dir ./widget --force`;
+}
+function doctorHelp() {
+    return `Usage: tender artifacts doctor [--dir <path>] [--json]
+
+Options:
+  --dir <path>    Local Tender App checkout to inspect. Defaults to current directory.
+  --json          Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts doctor --dir ./widget
+  tender artifacts doctor --dir ./widget --json`;
+}
+function gitRemoteHelp() {
+    return `Usage: tender artifacts git remote <artifact-id> [--base-url <url>] [--token <token>] [--profile <name>] [--ttl <7d|14d|30d>] [--json]
+
+Options:
+  --base-url <url>   Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>    Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>   Local config profile name. Defaults to the saved default profile.
+  --ttl <value>      Deprecated for Tender-hosted Git remotes; accepted for compatibility.
+  --json             Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts git remote artifact_123 --ttl 7d --json
+  tender artifacts git remote artifact_123 --profile publish --ttl 7d --json
+  TENDER_API_TOKEN=tp_... tender artifacts git remote artifact_123 --base-url https://app.tenderprompt.com --json`;
+}
+function gitSetupHelp() {
+    return `Usage: tender artifacts git setup <artifact-id> [--dir <path>] [--remote <name>] [--base-url <url>] [--token <token>] [--profile <name>] [--ttl <7d|14d|30d>] [--dry-run] [--json]
+
+Options:
+  --dir <path>      Local Git checkout to configure. Defaults to current directory.
+  --remote <name>   Git remote name to add or update. Defaults to tender.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --ttl <value>     Deprecated for Tender-hosted Git remotes; accepted for compatibility.
+  --dry-run         Show Git commands without running them.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts git setup artifact_123 --dir ./widget --json
+  tender artifacts git setup artifact_123 --dir ./widget --remote tender --ttl 7d
+  tender artifacts git setup artifact_123 --dir ./widget --dry-run --json`;
+}
+function gitCredentialHelp() {
+    return `Usage: tender artifacts git credential <artifact-id> [get|store|erase] [--base-url <url>] [--token <token>] [--profile <name>] [--ttl <7d|14d|30d>] [--remote-url <url>]
+
+This command is intended for Git's credential.helper protocol. It prints a
+Tender API-token username/password pair only for matching get requests. Do not
+run it manually unless you are debugging Git credential-helper behavior.
+
+Examples:
+  tender artifacts git credential artifact_123 get
+  tender artifacts git credential artifact_123 get --remote-url https://app.tenderprompt.com/git/artifacts/artifact_123.git`;
+}
+function previewRebuildHelp() {
+    return `Usage: tender artifacts preview rebuild <artifact-id> [--commit <sha>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+
+Options:
+  --commit <sha>   Rebuild preview only if the artifact workspace is at this Git commit.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --stream          Request lifecycle events from the API.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts preview rebuild artifact_123 --commit $(git rev-parse HEAD) --stream --json
+  tender artifacts preview rebuild artifact_123 --json`;
+}
+function validateHelp() {
+    return `Usage: tender artifacts validate <artifact-id> [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+
+Options:
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --stream          Request lifecycle events from the API.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts validate artifact_123 --json
+  tender artifacts validate artifact_123 --stream --json`;
+}
+function buildHelp() {
+    return `Usage: tender artifacts build <artifact-id> [--commit <sha>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+
+Options:
+  --commit <sha>   Build only if the artifact workspace is at this Git commit.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --stream          Request lifecycle events from the API.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts build artifact_123 --commit $(git rev-parse HEAD) --json
+  tender artifacts build artifact_123 --stream --json`;
+}
+function previewStatusHelp() {
+    return `Usage: tender artifacts preview status <artifact-id> [--commit <sha> | --job <job-id>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Options:
+  --commit <sha>    Show the latest preview job for one artifact Git commit.
+  --job <job-id>    Show one lifecycle job directly.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts preview status artifact_123 --commit $(git rev-parse HEAD) --json
+  tender artifacts preview status artifact_123 --job job_123 --json`;
+}
+function previewWatchHelp() {
+    return `Usage: tender artifacts preview watch <artifact-id> [--commit <sha> | --job <job-id>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+
+Options:
+  --commit <sha>    Watch the latest preview job for one artifact Git commit.
+  --job <job-id>    Watch one lifecycle job directly.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --stream          Request Server-Sent Events from the API.
+  --json            Emit lifecycle events as JSON lines.
+
+Examples:
+  tender artifacts preview watch artifact_123 --commit $(git rev-parse HEAD) --stream --json
+  tender artifacts preview watch artifact_123 --job job_123 --stream --json`;
+}
+function publishHelp() {
+    return `Usage: tender artifacts publish <artifact-id> (--dry-run | --confirm publish) [--commit <sha>] [--message <text>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+
+Options:
+  --dry-run          Show the publish request without calling the API.
+  --confirm publish  Required to call the production-facing publish API.
+  --commit <sha>     Publish only if the artifact workspace is at this Git commit.
+  --message <text>   Human audit message returned in CLI output.
+  --base-url <url>   Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>    Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>   Local config profile name. Defaults to the saved default profile.
+  --stream           Request lifecycle events from the API.
+  --json             Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts publish artifact_123 --dry-run --json
+  tender artifacts publish artifact_123 --commit $(git rev-parse HEAD) --confirm publish --stream --json`;
+}
+function publishStatusHelp() {
+    return `Usage: tender artifacts publish status <artifact-id> --job <job-id> [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+
+Options:
+  --job <job-id>    Show one publish lifecycle job directly.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --json            Emit stable JSON for coding agents.
+
+Examples:
+  tender artifacts publish status artifact_123 --job job_123 --json`;
+}
+function publishWatchHelp() {
+    return `Usage: tender artifacts publish watch <artifact-id> --job <job-id> [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+
+Options:
+  --job <job-id>    Watch one publish lifecycle job directly.
+  --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
+  --token <token>   Tender API token. Defaults to TENDER_API_TOKEN or the saved profile token.
+  --profile <name>  Local config profile name. Defaults to the saved default profile.
+  --stream          Request Server-Sent Events from the API.
+  --json            Emit lifecycle events as JSON lines.
+
+Examples:
+  tender artifacts publish watch artifact_123 --job job_123 --stream --json`;
+}
+function normalizeBaseUrl(value) {
+    return (value ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+}
+function readDefaultBaseUrl(env) {
+    return normalizeBaseUrl(env.TENDER_BASE_URL ?? DEFAULT_BASE_URL);
+}
+function readConfigPath(env) {
+    return env.TENDER_CONFIG
+        ? path.resolve(env.TENDER_CONFIG)
+        : path.join(os.homedir(), ".tender", "config.json");
+}
+function isMissingFile(error) {
+    return (error instanceof Error &&
+        error.code === "ENOENT");
+}
+function normalizeStoredProfile(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    if (typeof record.token !== "string" || !record.token) {
+        return null;
+    }
+    return {
+        baseUrl: typeof record.baseUrl === "string"
+            ? normalizeBaseUrl(record.baseUrl)
+            : DEFAULT_BASE_URL,
+        token: record.token,
+        tokenPrefix: typeof record.tokenPrefix === "string" ? record.tokenPrefix : undefined,
+        tenantId: typeof record.tenantId === "string" ? record.tenantId : undefined,
+        artifactId: typeof record.artifactId === "string" || record.artifactId === null
+            ? record.artifactId
+            : undefined,
+        expiresAt: typeof record.expiresAt === "number" ? record.expiresAt : undefined,
+        permissions: Array.isArray(record.permissions)
+            ? record.permissions.filter((permission) => typeof permission === "string")
+            : undefined,
+    };
+}
+function normalizeConfig(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return {};
+    }
+    const record = value;
+    const profiles = {};
+    if (record.profiles &&
+        typeof record.profiles === "object" &&
+        !Array.isArray(record.profiles)) {
+        for (const [name, profile] of Object.entries(record.profiles)) {
+            const normalized = normalizeStoredProfile(profile);
+            if (normalized) {
+                profiles[name] = normalized;
+            }
+        }
+    }
+    return {
+        defaultProfile: typeof record.defaultProfile === "string" && record.defaultProfile
+            ? record.defaultProfile
+            : undefined,
+        profiles: Object.keys(profiles).length > 0 ? profiles : undefined,
+    };
+}
+async function readConfig(env) {
+    try {
+        const raw = await readFile(readConfigPath(env), "utf8");
+        return normalizeConfig(JSON.parse(raw));
+    }
+    catch (error) {
+        if (isMissingFile(error)) {
+            return {};
+        }
+        throw error;
+    }
+}
+async function writeConfig(env, config) {
+    const configPath = readConfigPath(env);
+    const tempPath = `${configPath}.tmp`;
+    await mkdir(path.dirname(configPath), { recursive: true, mode: 0o700 });
+    await writeFile(tempPath, `${JSON.stringify(config, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    await rename(tempPath, configPath);
+}
+async function resolveApiCredentials(input) {
+    if (input.flagToken) {
+        return {
+            baseUrl: input.baseUrl ?? readDefaultBaseUrl(input.env),
+            token: input.flagToken,
+            source: "flag",
+            profileName: null,
+        };
+    }
+    if (input.env.TENDER_API_TOKEN) {
+        return {
+            baseUrl: input.baseUrl ?? readDefaultBaseUrl(input.env),
+            token: input.env.TENDER_API_TOKEN,
+            source: "env",
+            profileName: null,
+        };
+    }
+    const config = await readConfig(input.env);
+    const profileName = input.profileName ?? config.defaultProfile ?? DEFAULT_PROFILE_NAME;
+    const profile = config.profiles?.[profileName];
+    if (!profile) {
+        throw new TenderCliUsageError("Tender API token is required. Run `tender auth login --device`, set TENDER_API_TOKEN, or pass --token <token>.");
+    }
+    return {
+        baseUrl: input.baseUrl ?? profile.baseUrl ?? readDefaultBaseUrl(input.env),
+        token: profile.token,
+        source: "config",
+        profileName,
+    };
+}
+function parseProfileName(value, flag) {
+    if (!value || value.startsWith("-")) {
+        throw new TenderCliUsageError(`${flag} requires a profile name.`);
+    }
+    return value;
+}
+function parseBaseUrlFlag(args, index) {
+    const value = args[index + 1];
+    if (!value || value.startsWith("-")) {
+        throw new TenderCliUsageError("--base-url requires a URL.");
+    }
+    return normalizeBaseUrl(value);
+}
+function parseTokenFlag(args, index) {
+    const value = args[index + 1];
+    if (!value || value.startsWith("-")) {
+        throw new TenderCliUsageError("--token requires a token.");
+    }
+    return value;
+}
+function parseTtl(value) {
+    if (value !== "7d" && value !== "14d" && value !== "30d") {
+        throw new TenderCliUsageError("--ttl must be one of 7d, 14d, or 30d.");
+    }
+    return value;
+}
+function parseGitRemoteArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts git remote" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts git remote <artifact-id> --json");
+    }
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let ttl = "7d";
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        if (arg === "--ttl") {
+            ttl = parseTtl(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown git remote option: ${arg}`);
+    }
+    return {
+        command: "artifacts git remote",
+        artifactId,
+        baseUrl,
+        flagToken,
+        profileName,
+        ttl,
+        json,
+    };
+}
+function parseRemoteName(value) {
+    if (!value || value.startsWith("-")) {
+        throw new TenderCliUsageError("--remote requires a remote name.");
+    }
+    if (!/^[A-Za-z0-9._-]+$/.test(value)) {
+        throw new TenderCliUsageError("--remote must contain only letters, numbers, dots, underscores, or dashes.");
+    }
+    return value;
+}
+function parseGitSetupArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts git setup" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts git setup <artifact-id> --dir ./widget --json");
+    }
+    let dir = ".";
+    let remoteName = "tender";
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let ttl = "7d";
+    let dryRun = false;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        if (arg === "--dir") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--dir requires a path.");
+            }
+            dir = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--remote") {
+            remoteName = parseRemoteName(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        if (arg === "--ttl") {
+            ttl = parseTtl(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown git setup option: ${arg}`);
+    }
+    return {
+        command: "artifacts git setup",
+        artifactId,
+        dir,
+        remoteName,
+        baseUrl,
+        flagToken,
+        profileName,
+        ttl,
+        dryRun,
+        json,
+    };
+}
+function parseGitCredentialOperation(value) {
+    if (value === undefined || value.startsWith("-")) {
+        return { operation: "get", consumed: false };
+    }
+    if (value === "get") {
+        return { operation: "get", consumed: true };
+    }
+    if (value === "store") {
+        return { operation: "store", consumed: true };
+    }
+    if (value === "erase") {
+        return { operation: "erase", consumed: true };
+    }
+    throw new TenderCliUsageError("credential operation must be get, store, or erase.");
+}
+function isGitCredentialOperation(value) {
+    return value === "get" || value === "store" || value === "erase";
+}
+function parseGitCredentialArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts git credential" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts git credential <artifact-id> get");
+    }
+    const parsedOperation = parseGitCredentialOperation(args[1]);
+    let operation = parsedOperation.operation;
+    let operationConsumed = parsedOperation.consumed;
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let ttl = "7d";
+    let remoteUrl = null;
+    let json = false;
+    for (let index = parsedOperation.consumed ? 2 : 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (isGitCredentialOperation(arg)) {
+            if (operationConsumed) {
+                throw new TenderCliUsageError("credential operation can only be provided once.");
+            }
+            operation = arg;
+            operationConsumed = true;
+            continue;
+        }
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        if (arg === "--ttl") {
+            ttl = parseTtl(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--remote-url") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--remote-url requires a URL.");
+            }
+            remoteUrl = value;
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown git credential option: ${arg}`);
+    }
+    return {
+        command: "artifacts git credential",
+        artifactId,
+        operation,
+        baseUrl,
+        flagToken,
+        profileName,
+        ttl,
+        remoteUrl,
+        json,
+    };
+}
+function parseValidateArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts validate" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts validate <artifact-id> --json");
+    }
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let stream = false;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--stream") {
+            stream = true;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown validate option: ${arg}`);
+    }
+    return {
+        command: "artifacts validate",
+        artifactId,
+        baseUrl,
+        flagToken,
+        profileName,
+        stream,
+        json,
+    };
+}
+function parseBuildArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts build" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts build <artifact-id> --json");
+    }
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let commitSha = null;
+    let stream = false;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--stream") {
+            stream = true;
+            continue;
+        }
+        if (arg === "--commit") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--commit requires a Git commit SHA.");
+            }
+            commitSha = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown build option: ${arg}`);
+    }
+    return {
+        command: "artifacts build",
+        artifactId,
+        commitSha,
+        baseUrl,
+        flagToken,
+        profileName,
+        stream,
+        json,
+    };
+}
+function parsePreviewRebuildArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts preview rebuild" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts preview rebuild <artifact-id> --stream --json");
+    }
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let commitSha = null;
+    let stream = false;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--stream") {
+            stream = true;
+            continue;
+        }
+        if (arg === "--commit") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--commit requires a Git commit SHA.");
+            }
+            commitSha = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown preview rebuild option: ${arg}`);
+    }
+    return {
+        command: "artifacts preview rebuild",
+        artifactId,
+        commitSha,
+        baseUrl,
+        flagToken,
+        profileName,
+        stream,
+        json,
+    };
+}
+function readPreviewLookupOptions(input) {
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let commitSha = null;
+    let jobId = null;
+    let stream = false;
+    let json = false;
+    for (let index = input.startIndex; index < input.args.length; index += 1) {
+        const arg = input.args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--stream") {
+            stream = true;
+            continue;
+        }
+        if (arg === "--commit") {
+            const value = input.args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--commit requires a commit SHA.");
+            }
+            commitSha = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--job") {
+            const value = input.args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--job requires a lifecycle job id.");
+            }
+            jobId = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(input.args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(input.args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(input.args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown ${input.commandName} option: ${arg}`);
+    }
+    if (commitSha && jobId) {
+        throw new TenderCliUsageError("--commit and --job cannot be used together.");
+    }
+    return {
+        baseUrl,
+        flagToken,
+        profileName,
+        commitSha,
+        jobId,
+        stream,
+        json,
+    };
+}
+function parsePreviewStatusArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts preview status" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts preview status <artifact-id> --commit <sha> --json");
+    }
+    const options = readPreviewLookupOptions({
+        args,
+        startIndex: 1,
+        commandName: "preview status",
+    });
+    if (options.stream) {
+        throw new TenderCliUsageError("preview status does not support --stream. Use tender artifacts preview watch.");
+    }
+    return {
+        command: "artifacts preview status",
+        artifactId,
+        commitSha: options.commitSha,
+        jobId: options.jobId,
+        baseUrl: options.baseUrl,
+        flagToken: options.flagToken,
+        profileName: options.profileName,
+        json: options.json,
+    };
+}
+function parsePreviewWatchArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts preview watch" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts preview watch <artifact-id> --job <job-id> --stream --json");
+    }
+    const options = readPreviewLookupOptions({
+        args,
+        startIndex: 1,
+        commandName: "preview watch",
+    });
+    return {
+        command: "artifacts preview watch",
+        artifactId,
+        commitSha: options.commitSha,
+        jobId: options.jobId,
+        baseUrl: options.baseUrl,
+        flagToken: options.flagToken,
+        profileName: options.profileName,
+        stream: options.stream,
+        json: options.json,
+    };
+}
+function parsePublishArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts publish" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts publish <artifact-id> --dry-run --json");
+    }
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let confirm = null;
+    let dryRun = false;
+    let stream = false;
+    let commitSha = null;
+    let message = null;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        if (arg === "--stream") {
+            stream = true;
+            continue;
+        }
+        if (arg === "--confirm") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--confirm requires the value publish.");
+            }
+            confirm = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--message") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--message requires text.");
+            }
+            message = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--commit") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--commit requires a commit SHA.");
+            }
+            commitSha = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown publish option: ${arg}`);
+    }
+    if (!dryRun && confirm !== "publish") {
+        throw new TenderCliUsageError("publish requires --dry-run or --confirm publish.");
+    }
+    return {
+        command: "artifacts publish",
+        artifactId,
+        commitSha,
+        baseUrl,
+        flagToken,
+        profileName,
+        confirm,
+        dryRun,
+        stream,
+        message,
+        json,
+    };
+}
+function readPublishJobLookupOptions(input) {
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let jobId = null;
+    let stream = false;
+    let json = false;
+    for (let index = input.startIndex; index < input.args.length; index += 1) {
+        const arg = input.args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--stream") {
+            stream = true;
+            continue;
+        }
+        if (arg === "--job") {
+            const value = input.args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--job requires a lifecycle job id.");
+            }
+            jobId = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(input.args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(input.args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(input.args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown ${input.commandName} option: ${arg}`);
+    }
+    if (!jobId) {
+        throw new TenderCliUsageError("--job is required for publish job polling.");
+    }
+    return {
+        baseUrl,
+        flagToken,
+        profileName,
+        jobId,
+        stream,
+        json,
+    };
+}
+function parsePublishStatusArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts publish status" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts publish status <artifact-id> --job <job-id> --json");
+    }
+    const options = readPublishJobLookupOptions({
+        args,
+        startIndex: 1,
+        commandName: "publish status",
+    });
+    if (options.stream) {
+        throw new TenderCliUsageError("publish status does not support --stream. Use tender artifacts publish watch.");
+    }
+    return {
+        command: "artifacts publish status",
+        artifactId,
+        jobId: options.jobId,
+        baseUrl: options.baseUrl,
+        flagToken: options.flagToken,
+        profileName: options.profileName,
+        json: options.json,
+    };
+}
+function parsePublishWatchArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts publish watch" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts publish watch <artifact-id> --job <job-id> --stream --json");
+    }
+    const options = readPublishJobLookupOptions({
+        args,
+        startIndex: 1,
+        commandName: "publish watch",
+    });
+    return {
+        command: "artifacts publish watch",
+        artifactId,
+        jobId: options.jobId,
+        baseUrl: options.baseUrl,
+        flagToken: options.flagToken,
+        profileName: options.profileName,
+        stream: options.stream,
+        json: options.json,
+    };
+}
+function parseArtifactsListArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts list" };
+    }
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let json = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown artifacts list option: ${arg}`);
+    }
+    return {
+        command: "artifacts list",
+        baseUrl,
+        flagToken,
+        profileName,
+        json,
+    };
+}
+function parseArtifactsCreateArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts create" };
+    }
+    let name = "";
+    let targetPackId = null;
+    let targetPackVersion = null;
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let json = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--name") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--name requires an artifact name.");
+            }
+            name = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--target-pack") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--target-pack requires a target pack id.");
+            }
+            targetPackId = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--target-pack-version") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--target-pack-version requires a version.");
+            }
+            targetPackVersion = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown artifacts create option: ${arg}`);
+    }
+    if (!name.trim()) {
+        throw new TenderCliUsageError("--name is required. Example: tender artifacts create --name \"Exit Intent Widget\" --json");
+    }
+    return {
+        command: "artifacts create",
+        name: name.trim(),
+        targetPackId,
+        targetPackVersion,
+        baseUrl,
+        flagToken,
+        profileName,
+        json,
+    };
+}
+function parseArtifactsUpdateArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts update" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts update <artifact-id> --name \"Sale Widget\" --json");
+    }
+    let name = "";
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--name") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--name requires an artifact name.");
+            }
+            name = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown artifacts update option: ${arg}`);
+    }
+    if (!name.trim()) {
+        throw new TenderCliUsageError("--name is required. Example: tender artifacts update artifact_123 --name \"Sale Widget\" --json");
+    }
+    return {
+        command: "artifacts update",
+        artifactId,
+        name: name.trim(),
+        baseUrl,
+        flagToken,
+        profileName,
+        json,
+    };
+}
+function parseArtifactsInitArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts init" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts init <artifact-id> --dir ./widget --json");
+    }
+    let dir = ".";
+    let remoteName = "tender";
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let ttl = "7d";
+    let dryRun = false;
+    let force = false;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        if (arg === "--force") {
+            force = true;
+            continue;
+        }
+        if (arg === "--dir") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--dir requires a path.");
+            }
+            dir = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--remote") {
+            remoteName = parseRemoteName(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        if (arg === "--ttl") {
+            ttl = parseTtl(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown artifacts init option: ${arg}`);
+    }
+    return {
+        command: "artifacts init",
+        artifactId,
+        dir,
+        remoteName,
+        baseUrl,
+        flagToken,
+        profileName,
+        ttl,
+        dryRun,
+        force,
+        json,
+    };
+}
+function parseContextFetchArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts context fetch" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts context fetch <artifact-id> --dir ./widget --json");
+    }
+    let dir = ".";
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let dryRun = false;
+    let force = false;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        if (arg === "--force") {
+            force = true;
+            continue;
+        }
+        if (arg === "--dir") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--dir requires a path.");
+            }
+            dir = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown context fetch option: ${arg}`);
+    }
+    return {
+        command: "artifacts context fetch",
+        artifactId,
+        dir,
+        baseUrl,
+        flagToken,
+        profileName,
+        dryRun,
+        force,
+        json,
+    };
+}
+function parseContextStatusArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts context status" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts context status <artifact-id> --dir ./widget --json");
+    }
+    let dir = ".";
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--dir") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--dir requires a path.");
+            }
+            dir = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown context status option: ${arg}`);
+    }
+    return {
+        command: "artifacts context status",
+        artifactId,
+        dir,
+        baseUrl,
+        flagToken,
+        profileName,
+        json,
+    };
+}
+function parseContextRefreshArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "artifacts context refresh" };
+    }
+    const artifactId = args[0];
+    if (!artifactId || artifactId.startsWith("-")) {
+        throw new TenderCliUsageError("artifact id is required. Example: tender artifacts context refresh <artifact-id> --dir ./widget --dry-run --json");
+    }
+    let dir = ".";
+    let baseUrl = null;
+    let flagToken = null;
+    let profileName = null;
+    let dryRun = false;
+    let force = false;
+    let json = false;
+    for (let index = 1; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--dry-run") {
+            dryRun = true;
+            continue;
+        }
+        if (arg === "--force") {
+            force = true;
+            continue;
+        }
+        if (arg === "--dir") {
+            const value = args[index + 1];
+            if (!value || value.startsWith("-")) {
+                throw new TenderCliUsageError("--dir requires a path.");
+            }
+            dir = value;
+            index += 1;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--token") {
+            flagToken = parseTokenFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown context refresh option: ${arg}`);
+    }
+    return {
+        command: "artifacts context refresh",
+        artifactId,
+        dir,
+        baseUrl,
+        flagToken,
+        profileName,
+        dryRun,
+        force,
+        json,
+    };
+}
+function parseTokenProfile(value) {
+    if (value === "edit-preview" ||
+        value === "publish" ||
+        value === "create") {
+        return value;
+    }
+    throw new TenderCliUsageError("--profile must be one of edit-preview, publish, or create.");
+}
+function parsePositiveIntegerFlag(value, flag) {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+        throw new TenderCliUsageError(`${flag} requires a positive integer.`);
+    }
+    return parsed;
+}
+function parseAuthLoginArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "auth login" };
+    }
+    let device = false;
+    let baseUrl = null;
+    let tokenProfile = "edit-preview";
+    let saveProfile = DEFAULT_PROFILE_NAME;
+    let artifactId = null;
+    let ttl = "7d";
+    let json = false;
+    let noPoll = false;
+    let pollTimeoutSeconds = 600;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--device") {
+            device = true;
+            continue;
+        }
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--no-poll") {
+            noPoll = true;
+            continue;
+        }
+        if (arg === "--base-url") {
+            baseUrl = parseBaseUrlFlag(args, index);
+            index += 1;
+            continue;
+        }
+        if (arg === "--profile") {
+            tokenProfile = parseTokenProfile(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--save-profile") {
+            saveProfile = parseProfileName(args[index + 1], "--save-profile");
+            index += 1;
+            continue;
+        }
+        if (arg === "--artifact") {
+            artifactId = parseProfileName(args[index + 1], "--artifact");
+            index += 1;
+            continue;
+        }
+        if (arg === "--ttl") {
+            ttl = parseTtl(args[index + 1]);
+            index += 1;
+            continue;
+        }
+        if (arg === "--poll-timeout") {
+            pollTimeoutSeconds = parsePositiveIntegerFlag(args[index + 1], "--poll-timeout");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown auth login option: ${arg}`);
+    }
+    if (!device) {
+        throw new TenderCliUsageError("auth login currently requires --device. Example: tender auth login --device --profile edit-preview --artifact artifact_123");
+    }
+    if (tokenProfile === "create" && artifactId) {
+        throw new TenderCliUsageError("--profile create must be account-scoped; remove --artifact.");
+    }
+    return {
+        command: "auth login",
+        baseUrl,
+        device,
+        tokenProfile,
+        saveProfile,
+        artifactId,
+        ttl,
+        json,
+        noPoll,
+        pollTimeoutSeconds,
+    };
+}
+function parseAuthStatusArgs(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        return { command: "help", topic: "auth status" };
+    }
+    let profileName = null;
+    let json = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--profile") {
+            profileName = parseProfileName(args[index + 1], "--profile");
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown auth status option: ${arg}`);
+    }
+    return {
+        command: "auth status",
+        profileName,
+        json,
+    };
+}
+function parseTenderArgs(args) {
+    if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
+        return { command: "help", topic: "root" };
+    }
+    if (args[0] === "auth") {
+        if (args[1] === undefined || args[1] === "--help" || args[1] === "-h") {
+            return { command: "help", topic: "auth" };
+        }
+        if (args[1] === "login") {
+            return parseAuthLoginArgs(args.slice(2));
+        }
+        if (args[1] === "status") {
+            return parseAuthStatusArgs(args.slice(2));
+        }
+        throw new TenderCliUsageError(`Unknown auth command: ${args[1]}`);
+    }
+    if (args[0] !== "artifacts") {
+        throw new TenderCliUsageError(`Unknown command: ${args[0]}`);
+    }
+    if (args[1] === undefined || args[1] === "--help" || args[1] === "-h") {
+        return { command: "help", topic: "artifacts" };
+    }
+    if (args[1] !== "doctor") {
+        if (args[1] === "list") {
+            return parseArtifactsListArgs(args.slice(2));
+        }
+        if (args[1] === "create") {
+            return parseArtifactsCreateArgs(args.slice(2));
+        }
+        if (args[1] === "update") {
+            return parseArtifactsUpdateArgs(args.slice(2));
+        }
+        if (args[1] === "init") {
+            return parseArtifactsInitArgs(args.slice(2));
+        }
+        if (args[1] === "context" && args[2] === "fetch") {
+            return parseContextFetchArgs(args.slice(3));
+        }
+        if (args[1] === "context" && args[2] === "status") {
+            return parseContextStatusArgs(args.slice(3));
+        }
+        if (args[1] === "context" && args[2] === "refresh") {
+            return parseContextRefreshArgs(args.slice(3));
+        }
+        if (args[1] === "context" &&
+            (args[2] === undefined || args[2] === "--help" || args[2] === "-h")) {
+            return { command: "help", topic: "artifacts" };
+        }
+        if (args[1] === "git" && args[2] === "remote") {
+            return parseGitRemoteArgs(args.slice(3));
+        }
+        if (args[1] === "git" && args[2] === "setup") {
+            return parseGitSetupArgs(args.slice(3));
+        }
+        if (args[1] === "git" && args[2] === "credential") {
+            return parseGitCredentialArgs(args.slice(3));
+        }
+        if (args[1] === "validate") {
+            return parseValidateArgs(args.slice(2));
+        }
+        if (args[1] === "build") {
+            return parseBuildArgs(args.slice(2));
+        }
+        if (args[1] === "preview" && args[2] === "rebuild") {
+            return parsePreviewRebuildArgs(args.slice(3));
+        }
+        if (args[1] === "preview" && args[2] === "status") {
+            return parsePreviewStatusArgs(args.slice(3));
+        }
+        if (args[1] === "preview" && args[2] === "watch") {
+            return parsePreviewWatchArgs(args.slice(3));
+        }
+        if (args[1] === "preview" &&
+            (args[2] === undefined || args[2] === "--help" || args[2] === "-h")) {
+            return { command: "help", topic: "artifacts" };
+        }
+        if (args[1] === "publish" && args[2] === "status") {
+            return parsePublishStatusArgs(args.slice(3));
+        }
+        if (args[1] === "publish" && args[2] === "watch") {
+            return parsePublishWatchArgs(args.slice(3));
+        }
+        if (args[1] === "publish") {
+            return parsePublishArgs(args.slice(2));
+        }
+        if (args[1] === "git" && (args[2] === undefined || args[2] === "--help" || args[2] === "-h")) {
+            return { command: "help", topic: "artifacts" };
+        }
+        throw new TenderCliUsageError(`Unknown artifacts command: ${args[1]}`);
+    }
+    const rest = args.slice(2);
+    if (rest.includes("--help") || rest.includes("-h")) {
+        return { command: "help", topic: "artifacts doctor" };
+    }
+    let dir = ".";
+    let json = false;
+    for (let index = 0; index < rest.length; index += 1) {
+        const arg = rest[index];
+        if (arg === "--json") {
+            json = true;
+            continue;
+        }
+        if (arg === "--dir") {
+            const value = rest[index + 1];
+            if (!value) {
+                throw new TenderCliUsageError("--dir requires a path.");
+            }
+            dir = value;
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown doctor option: ${arg}`);
+    }
+    return {
+        command: "artifacts doctor",
+        dir,
+        json,
+    };
+}
+function formatDoctorHuman(result) {
+    if (result.diagnostics.length === 0) {
+        return result.ok
+            ? "Tender artifacts doctor passed."
+            : "Tender artifacts doctor failed.";
+    }
+    return result.diagnostics
+        .map((diagnostic) => {
+        const location = [
+            diagnostic.path,
+            diagnostic.line !== undefined ? diagnostic.line : null,
+            diagnostic.column !== undefined ? diagnostic.column : null,
+        ]
+            .filter((part) => part !== null && part !== undefined)
+            .join(":");
+        return [
+            diagnostic.severity.toUpperCase(),
+            diagnostic.code,
+            location,
+            diagnostic.message,
+            diagnostic.suggestion,
+        ]
+            .filter(Boolean)
+            .join(" - ");
+    })
+        .join("\n");
+}
+async function runDoctor(command, io) {
+    const root = path.resolve(command.dir);
+    const files = await collectTenderAppFiles({ root, current: root });
+    const result = validateTenderApp({
+        files,
+        mode: "local",
+    });
+    if (command.json) {
+        io.stdout(JSON.stringify({
+            ok: result.ok,
+            command: command.command,
+            dir: root,
+            diagnostics: result.diagnostics,
+        }, null, 2));
+    }
+    else {
+        io.stdout(formatDoctorHuman(result));
+    }
+    return result.ok ? 0 : 1;
+}
+async function parseJsonResponse(response) {
+    return (await response.json().catch(() => null));
+}
+function splitScope(scope) {
+    return scope
+        ? scope.split(/\s+/).filter((permission) => permission.length > 0)
+        : [];
+}
+function formatExpiry(value) {
+    return value ? new Date(value).toISOString() : null;
+}
+function parseSseLifecycleEvents(text) {
+    const events = [];
+    for (const block of text.split(/\n\n+/)) {
+        const event = parseSseLifecycleBlock(block);
+        if (event === null) {
+            continue;
+        }
+        events.push(event);
+    }
+    return events;
+}
+function parseSseLifecycleBlock(block) {
+    const dataLines = block
+        .split(/\r?\n/)
+        .filter((line) => line.startsWith("data:"))
+        .map((line) => line.slice("data:".length).trim());
+    if (dataLines.length === 0) {
+        return null;
+    }
+    try {
+        return JSON.parse(dataLines.join("\n"));
+    }
+    catch {
+        return { raw: dataLines.join("\n") };
+    }
+}
+function findSseBlockSeparator(buffer) {
+    const unixIndex = buffer.indexOf("\n\n");
+    const windowsIndex = buffer.indexOf("\r\n\r\n");
+    if (unixIndex === -1 && windowsIndex === -1) {
+        return null;
+    }
+    if (windowsIndex !== -1 && (unixIndex === -1 || windowsIndex < unixIndex)) {
+        return { index: windowsIndex, length: 4 };
+    }
+    return { index: unixIndex, length: 2 };
+}
+function emitParsedSseBlock(input) {
+    const event = parseSseLifecycleBlock(input.block);
+    if (event === null) {
+        return;
+    }
+    if (input.json) {
+        input.io.stdout(JSON.stringify(event));
+    }
+    else {
+        input.io.stdout(input.block.trim());
+    }
+}
+async function emitSseLifecycleStream(input) {
+    if (!input.response.body) {
+        const text = await input.response.text();
+        const events = parseSseLifecycleEvents(text);
+        if (input.json) {
+            for (const event of events) {
+                input.io.stdout(JSON.stringify(event));
+            }
+        }
+        else {
+            input.io.stdout(text.trim());
+        }
+        return;
+    }
+    const reader = input.response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    while (true) {
+        const result = await reader.read();
+        if (result.done) {
+            break;
+        }
+        buffer += decoder.decode(result.value, { stream: true });
+        let separator = findSseBlockSeparator(buffer);
+        while (separator !== null) {
+            const block = buffer.slice(0, separator.index);
+            buffer = buffer.slice(separator.index + separator.length);
+            emitParsedSseBlock({
+                block,
+                io: input.io,
+                json: input.json,
+            });
+            separator = findSseBlockSeparator(buffer);
+        }
+    }
+    buffer += decoder.decode();
+    const remaining = buffer.trim();
+    if (remaining) {
+        emitParsedSseBlock({
+            block: remaining,
+            io: input.io,
+            json: input.json,
+        });
+    }
+}
+function readObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function readObjectString(value, key) {
+    const record = readObject(value);
+    const field = record?.[key];
+    return typeof field === "string" && field.trim() ? field : null;
+}
+function readPreviewUrlFromJob(job) {
+    return readObjectString(job?.result, "previewUrl");
+}
+function readPublishedUrlFromJob(job) {
+    return readObjectString(job?.result, "publishedUrl");
+}
+function normalizeContextFilePath(filePath) {
+    const normalized = path.posix
+        .normalize(filePath.replaceAll("\\", "/"))
+        .replace(/^\/+/, "");
+    if (!normalized ||
+        normalized === "." ||
+        normalized.startsWith("../") ||
+        normalized.includes("/../")) {
+        return null;
+    }
+    return normalized;
+}
+function resolveContextOutputPath(root, relativePath) {
+    const absolutePath = path.resolve(root, relativePath);
+    const relativeFromRoot = path.relative(root, absolutePath);
+    if (relativeFromRoot === "" ||
+        relativeFromRoot.startsWith("..") ||
+        path.isAbsolute(relativeFromRoot)) {
+        return null;
+    }
+    return absolutePath;
+}
+async function readExistingFile(pathname) {
+    try {
+        return await readFile(pathname, "utf8");
+    }
+    catch (error) {
+        if (isMissingFile(error)) {
+            return null;
+        }
+        throw error;
+    }
+}
+async function planContextFiles(input) {
+    const planned = [];
+    for (const file of input.files) {
+        const relativePath = normalizeContextFilePath(file.path);
+        if (!relativePath) {
+            throw new Error(`Context file path is unsafe: ${file.path}`);
+        }
+        const absolutePath = resolveContextOutputPath(input.root, relativePath);
+        if (!absolutePath) {
+            throw new Error(`Context file path escapes the target directory: ${file.path}`);
+        }
+        const existing = await readExistingFile(absolutePath);
+        let action;
+        if (existing === null) {
+            action = "create";
+        }
+        else if (existing === file.content) {
+            action = "unchanged";
+        }
+        else {
+            action = input.force ? "overwrite" : "conflict";
+        }
+        planned.push({
+            path: relativePath,
+            absolutePath,
+            sha256: file.sha256,
+            action,
+            content: file.content,
+        });
+    }
+    return planned.sort((left, right) => left.path.localeCompare(right.path));
+}
+async function requestArtifactWorkspaceFileList(input) {
+    const params = new URLSearchParams({ path: input.pathname });
+    const response = await input.fetcher(`${input.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.artifactId)}/files?${params.toString()}`, {
+        headers: {
+            authorization: `Bearer ${input.token}`,
+        },
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !Array.isArray(payload.files)) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Artifact file list request failed with HTTP ${response.status}.`);
+    }
+    return payload.files;
+}
+async function requestArtifactWorkspaceFileContent(input) {
+    const params = new URLSearchParams({ path: input.pathname });
+    const response = await input.fetcher(`${input.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.artifactId)}/file-content?${params.toString()}`, {
+        headers: {
+            authorization: `Bearer ${input.token}`,
+        },
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !payload.file) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Artifact file content request failed with HTTP ${response.status}.`);
+    }
+    return payload.file.content;
+}
+async function collectArtifactWorkspaceSourceFiles(input) {
+    const files = [];
+    const queue = ["/"];
+    const visited = new Set();
+    while (queue.length > 0) {
+        const current = queue.shift() ?? "/";
+        if (visited.has(current)) {
+            continue;
+        }
+        visited.add(current);
+        const entries = await requestArtifactWorkspaceFileList({
+            ...input,
+            pathname: current,
+        });
+        for (const entry of entries) {
+            if (files.length >= ARTIFACT_SOURCE_EXPORT_MAX_FILES) {
+                throw new Error("artifact_source_export_file_limit_exceeded");
+            }
+            const normalizedPath = normalizeContextFilePath(entry.path);
+            if (!normalizedPath) {
+                continue;
+            }
+            if (entry.type === "directory") {
+                queue.push(entry.path);
+                continue;
+            }
+            if (entry.type !== "file") {
+                continue;
+            }
+            if (typeof entry.size === "number" &&
+                entry.size > ARTIFACT_SOURCE_EXPORT_MAX_FILE_BYTES) {
+                throw new Error(`artifact_source_file_too_large:${normalizedPath}`);
+            }
+            const content = await requestArtifactWorkspaceFileContent({
+                ...input,
+                pathname: entry.path,
+            });
+            files.push({
+                path: normalizedPath,
+                content,
+            });
+        }
+    }
+    return files.sort((left, right) => left.path.localeCompare(right.path));
+}
+async function planSourceFiles(input) {
+    const planned = [];
+    for (const file of input.files) {
+        const absolutePath = resolveContextOutputPath(input.root, file.path);
+        if (!absolutePath) {
+            throw new Error(`Source file path escapes the target directory: ${file.path}`);
+        }
+        const existing = await readExistingFile(absolutePath);
+        let action;
+        if (existing === null) {
+            action = "create";
+        }
+        else if (existing === file.content) {
+            action = "unchanged";
+        }
+        else {
+            action = input.force ? "overwrite" : "conflict";
+        }
+        planned.push({
+            path: file.path,
+            absolutePath,
+            action,
+            content: file.content,
+        });
+    }
+    return planned.sort((left, right) => left.path.localeCompare(right.path));
+}
+async function runAuthStatus(command, io, runtime) {
+    const env = runtime.env ?? process.env;
+    if (env.TENDER_API_TOKEN) {
+        const result = {
+            ok: true,
+            command: command.command,
+            source: "env",
+            profile: null,
+            baseUrl: readDefaultBaseUrl(env),
+            tokenAvailable: true,
+        };
+        if (command.json) {
+            io.stdout(JSON.stringify(result, null, 2));
+        }
+        else {
+            io.stdout([
+                "authenticated: true",
+                "source: TENDER_API_TOKEN",
+                `base_url: ${result.baseUrl}`,
+            ].join("\n"));
+        }
+        return 0;
+    }
+    const config = await readConfig(env);
+    const profileName = command.profileName ?? config.defaultProfile ?? DEFAULT_PROFILE_NAME;
+    const profile = config.profiles?.[profileName] ?? null;
+    const result = {
+        ok: Boolean(profile),
+        command: command.command,
+        source: profile ? "config" : null,
+        profile: profileName,
+        configPath: readConfigPath(env),
+        baseUrl: profile?.baseUrl ?? null,
+        tokenAvailable: Boolean(profile?.token),
+        tokenPrefix: profile?.tokenPrefix ?? null,
+        tenantId: profile?.tenantId ?? null,
+        artifactId: profile?.artifactId ?? null,
+        permissions: profile?.permissions ?? [],
+        expiresAt: formatExpiry(profile?.expiresAt),
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else if (profile) {
+        io.stdout([
+            "authenticated: true",
+            `source: config:${profileName}`,
+            `base_url: ${profile.baseUrl}`,
+            `token_prefix: ${profile.tokenPrefix ?? "(unknown)"}`,
+            `tenant_id: ${profile.tenantId ?? "(unknown)"}`,
+            `artifact_id: ${profile.artifactId ?? "(account)"}`,
+            `permissions: ${(profile.permissions ?? []).join(" ") || "(unknown)"}`,
+            `expires_at: ${formatExpiry(profile.expiresAt) ?? "(unknown)"}`,
+        ].join("\n"));
+    }
+    else {
+        io.stdout([
+            "authenticated: false",
+            `profile: ${profileName}`,
+            "next: tender auth login --device --profile edit-preview --artifact <artifact-id>",
+        ].join("\n"));
+    }
+    return profile ? 0 : 1;
+}
+async function runAuthLogin(command, io, runtime) {
+    const env = runtime.env ?? process.env;
+    const fetcher = runtime.fetcher ?? fetch;
+    const sleeper = runtime.sleeper ??
+        ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+    const now = runtime.now ?? Date.now;
+    const baseUrl = command.baseUrl ?? readDefaultBaseUrl(env);
+    const deviceResponse = await fetcher(`${baseUrl}/oauth/device/code`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({
+            profile: command.tokenProfile,
+            ttl: command.ttl,
+            artifactId: command.artifactId,
+        }),
+    });
+    const devicePayload = await parseJsonResponse(deviceResponse);
+    if (!deviceResponse.ok ||
+        !devicePayload?.device_code ||
+        !devicePayload.user_code ||
+        !devicePayload.verification_uri_complete) {
+        throw new Error(devicePayload?.error_description ??
+            devicePayload?.error ??
+            `Device authorization failed with HTTP ${deviceResponse.status}.`);
+    }
+    const pendingResult = {
+        ok: true,
+        command: command.command,
+        baseUrl,
+        profile: command.tokenProfile,
+        saveProfile: command.saveProfile,
+        userCode: devicePayload.user_code,
+        verificationUri: devicePayload.verification_uri,
+        verificationUriComplete: devicePayload.verification_uri_complete,
+        expiresIn: devicePayload.expires_in ?? null,
+        interval: devicePayload.interval ?? null,
+    };
+    if (command.noPoll) {
+        if (command.json) {
+            io.stdout(JSON.stringify(pendingResult, null, 2));
+        }
+        else {
+            io.stdout([
+                `verification_url: ${devicePayload.verification_uri_complete}`,
+                `user_code: ${devicePayload.user_code}`,
+            ].join("\n"));
+        }
+        return 0;
+    }
+    if (!command.json) {
+        io.stdout([
+            `Open this URL to approve Tender CLI access: ${devicePayload.verification_uri_complete}`,
+            `User code: ${devicePayload.user_code}`,
+        ].join("\n"));
+    }
+    let intervalSeconds = Math.max(1, devicePayload.interval ?? 5);
+    const expiresAtMs = now() + Math.max(1, devicePayload.expires_in ?? 600) * 1000;
+    let attemptsRemaining = Math.max(1, Math.ceil(command.pollTimeoutSeconds / intervalSeconds));
+    while (attemptsRemaining > 0 && now() < expiresAtMs) {
+        attemptsRemaining -= 1;
+        const tokenResponse = await fetcher(`${baseUrl}/oauth/token`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                device_code: devicePayload.device_code,
+            }),
+        });
+        const tokenPayload = await parseJsonResponse(tokenResponse);
+        if (tokenResponse.ok && tokenPayload?.access_token) {
+            const config = await readConfig(env);
+            const profiles = config.profiles ?? {};
+            profiles[command.saveProfile] = {
+                baseUrl,
+                token: tokenPayload.access_token,
+                tokenPrefix: tokenPayload.token_prefix,
+                tenantId: tokenPayload.tenant_id,
+                artifactId: tokenPayload.artifact_id,
+                expiresAt: tokenPayload.expires_at,
+                permissions: splitScope(tokenPayload.scope),
+            };
+            await writeConfig(env, {
+                ...config,
+                defaultProfile: config.defaultProfile ?? command.saveProfile,
+                profiles,
+            });
+            const result = {
+                ok: true,
+                command: command.command,
+                baseUrl,
+                profile: command.tokenProfile,
+                savedProfile: command.saveProfile,
+                tokenPrefix: tokenPayload.token_prefix ?? null,
+                tenantId: tokenPayload.tenant_id ?? null,
+                artifactId: tokenPayload.artifact_id ?? null,
+                permissions: splitScope(tokenPayload.scope),
+                expiresAt: formatExpiry(tokenPayload.expires_at),
+                configPath: readConfigPath(env),
+            };
+            if (command.json) {
+                io.stdout(JSON.stringify(result, null, 2));
+            }
+            else {
+                io.stdout([
+                    "authenticated: true",
+                    `profile: ${command.saveProfile}`,
+                    `tenant_id: ${result.tenantId ?? "(unknown)"}`,
+                    `artifact_id: ${result.artifactId ?? "(account)"}`,
+                    `permissions: ${result.permissions.join(" ") || "(unknown)"}`,
+                    `expires_at: ${result.expiresAt ?? "(unknown)"}`,
+                ].join("\n"));
+            }
+            return 0;
+        }
+        if (tokenPayload?.error === "authorization_pending") {
+            await sleeper(intervalSeconds * 1000);
+            continue;
+        }
+        if (tokenPayload?.error === "slow_down") {
+            intervalSeconds += 5;
+            await sleeper(intervalSeconds * 1000);
+            continue;
+        }
+        throw new Error(tokenPayload?.error_description ??
+            tokenPayload?.error ??
+            `Token exchange failed with HTTP ${tokenResponse.status}.`);
+    }
+    throw new Error("Timed out waiting for device approval.");
+}
+async function requestAgentContext(input) {
+    const response = await input.fetcher(`${input.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.artifactId)}/agent-context`, {
+        headers: {
+            authorization: `Bearer ${input.token}`,
+        },
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !payload.files || !payload.revision) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Artifact context request failed with HTTP ${response.status}.`);
+    }
+    return {
+        ...payload,
+        artifactId: payload.artifactId ?? input.artifactId,
+        revision: payload.revision,
+        files: payload.files,
+    };
+}
+async function runContextFetch(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const fetcher = runtime.fetcher ?? fetch;
+    const payload = await requestAgentContext({
+        artifactId: command.artifactId,
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher,
+    });
+    const root = path.resolve(command.dir);
+    const plannedFiles = await planContextFiles({
+        root,
+        files: payload.files,
+        force: command.force,
+    });
+    const conflicts = plannedFiles.filter((file) => file.action === "conflict");
+    const writableFiles = plannedFiles.filter((file) => file.action === "create" || file.action === "overwrite");
+    if (conflicts.length === 0 && !command.dryRun) {
+        for (const file of writableFiles) {
+            await mkdir(path.dirname(file.absolutePath), { recursive: true });
+            await writeFile(file.absolutePath, file.content);
+        }
+    }
+    const result = {
+        ok: conflicts.length === 0,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: payload.artifactId ?? command.artifactId,
+        revision: payload.revision,
+        dir: root,
+        dryRun: command.dryRun,
+        force: command.force,
+        summary: {
+            create: plannedFiles.filter((file) => file.action === "create").length,
+            overwrite: plannedFiles.filter((file) => file.action === "overwrite").length,
+            unchanged: plannedFiles.filter((file) => file.action === "unchanged").length,
+            conflict: conflicts.length,
+        },
+        files: plannedFiles.map((file) => ({
+            path: file.path,
+            sha256: file.sha256,
+            action: file.action,
+        })),
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else if (conflicts.length > 0) {
+        io.stdout([
+            `context_revision: ${payload.revision}`,
+            `conflicts: ${conflicts.length}`,
+            ...conflicts.map((file) => `conflict: ${file.path}`),
+            "next: rerun with --force to overwrite managed context files.",
+        ].join("\n"));
+    }
+    else {
+        io.stdout([
+            `context_revision: ${payload.revision}`,
+            `created: ${result.summary.create}`,
+            `overwritten: ${result.summary.overwrite}`,
+            `unchanged: ${result.summary.unchanged}`,
+            command.dryRun ? "dry_run: true" : `dir: ${root}`,
+        ].join("\n"));
+    }
+    return conflicts.length === 0 ? 0 : 1;
+}
+async function runContextStatus(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const payload = await requestAgentContext({
+        artifactId: command.artifactId,
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const root = path.resolve(command.dir);
+    const plannedFiles = await planContextFiles({
+        root,
+        files: payload.files,
+        force: false,
+    });
+    const summary = {
+        create: plannedFiles.filter((file) => file.action === "create").length,
+        overwrite: 0,
+        unchanged: plannedFiles.filter((file) => file.action === "unchanged").length,
+        conflict: plannedFiles.filter((file) => file.action === "conflict").length,
+    };
+    const stale = summary.create > 0 || summary.conflict > 0;
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: payload.artifactId ?? command.artifactId,
+        revision: payload.revision,
+        dir: root,
+        status: stale ? "stale" : "up_to_date",
+        stale,
+        summary,
+        files: plannedFiles.map((file) => ({
+            path: file.path,
+            sha256: file.sha256,
+            action: file.action,
+        })),
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `context_revision: ${payload.revision}`,
+            `status: ${result.status}`,
+            `missing: ${summary.create}`,
+            `conflicts: ${summary.conflict}`,
+        ].join("\n"));
+    }
+    return stale ? 1 : 0;
+}
+async function runArtifactsList(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const fetcher = runtime.fetcher ?? fetch;
+    const response = await fetcher(`${credentials.baseUrl}/api/v1/artifacts`, {
+        headers: {
+            authorization: `Bearer ${credentials.token}`,
+        },
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !payload.artifacts) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Artifact list request failed with HTTP ${response.status}.`);
+    }
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        tenantId: payload.tenantId ?? null,
+        artifactBoundary: payload.artifactBoundary ?? null,
+        artifacts: payload.artifacts,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else if (payload.artifacts.length === 0) {
+        io.stdout("No artifacts found.");
+    }
+    else {
+        io.stdout(payload.artifacts
+            .map((artifact) => [
+            artifact.artifactId,
+            artifact.name,
+            artifact.status,
+            artifact.previewUrl ?? "",
+        ].join("\t"))
+            .join("\n"));
+    }
+    return 0;
+}
+async function runArtifactsCreate(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const fetcher = runtime.fetcher ?? fetch;
+    const body = {
+        name: command.name,
+    };
+    if (command.targetPackId) {
+        body.targetPackId = command.targetPackId;
+    }
+    if (command.targetPackVersion) {
+        body.targetPackVersion = command.targetPackVersion;
+    }
+    const response = await fetcher(`${credentials.baseUrl}/api/v1/artifacts`, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${credentials.token}`,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify(body),
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !payload.artifact) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Artifact create request failed with HTTP ${response.status}.`);
+    }
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        tenantId: payload.tenantId ?? null,
+        artifact: payload.artifact,
+        next: {
+            contextFetch: `tender artifacts context fetch ${payload.artifact.artifactId} --dir .`,
+            gitSetup: `tender artifacts git setup ${payload.artifact.artifactId} --dir .`,
+        },
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `artifact_id: ${payload.artifact.artifactId}`,
+            `name: ${payload.artifact.name}`,
+            `preview_url: ${payload.artifact.previewUrl ?? ""}`,
+            `next: ${result.next.contextFetch}`,
+        ].join("\n"));
+    }
+    return 0;
+}
+async function runArtifactsUpdate(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const fetcher = runtime.fetcher ?? fetch;
+    const response = await fetcher(`${credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(command.artifactId)}`, {
+        method: "PATCH",
+        headers: {
+            authorization: `Bearer ${credentials.token}`,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({ name: command.name }),
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !payload.artifact) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Artifact update request failed with HTTP ${response.status}.`);
+    }
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        tenantId: payload.tenantId ?? null,
+        artifact: payload.artifact,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `artifact_id: ${payload.artifact.artifactId}`,
+            `name: ${payload.artifact.name}`,
+        ].join("\n"));
+    }
+    return 0;
+}
+function defaultCommandRunner(command, args, options) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, {
+            cwd: options.cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", reject);
+        child.on("close", (exitCode) => {
+            resolve({
+                exitCode: exitCode ?? 1,
+                stdout: Buffer.concat(stdout).toString("utf8"),
+                stderr: Buffer.concat(stderr).toString("utf8"),
+            });
+        });
+    });
+}
+async function runGitCommand(input) {
+    const runner = input.runtime.commandRunner ?? defaultCommandRunner;
+    const result = await runner("git", input.args, { cwd: input.cwd });
+    if (!input.allowFailure && result.exitCode !== 0) {
+        throw new Error([
+            `git ${input.args.join(" ")} failed with exit code ${result.exitCode}.`,
+            result.stderr.trim() || result.stdout.trim(),
+        ]
+            .filter(Boolean)
+            .join("\n"));
+    }
+    return result;
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function createCredentialHelperCommand(input) {
+    const parts = [
+        "tender",
+        "artifacts",
+        "git",
+        "credential",
+        shellQuote(input.artifactId),
+        "--base-url",
+        shellQuote(input.baseUrl),
+        "--ttl",
+        shellQuote(input.ttl),
+        "--remote-url",
+        shellQuote(input.remoteUrl),
+    ];
+    if (input.profileName) {
+        parts.push("--profile", shellQuote(input.profileName));
+    }
+    return `!${parts.join(" ")}`;
+}
+function createGitSetupCommandPlan(input) {
+    return [
+        ["git", "rev-parse", "--is-inside-work-tree"],
+        ["git", "remote", "get-url", input.remoteName],
+        ["git", "remote", "add-or-set-url", input.remoteName, input.remoteUrl],
+        [
+            "git",
+            "config",
+            "--local",
+            "--unset-all",
+            "credential.helper",
+        ],
+        [
+            "git",
+            "config",
+            "--local",
+            "--add",
+            "credential.helper",
+            "",
+        ],
+        [
+            "git",
+            "config",
+            "--local",
+            "--add",
+            "credential.helper",
+            input.credentialHelper,
+        ],
+        ["git", "config", "--local", "credential.useHttpPath", "true"],
+    ];
+}
+async function applyGitSetup(input) {
+    await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["rev-parse", "--is-inside-work-tree"],
+    });
+    const existingRemote = await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["remote", "get-url", input.remoteName],
+        allowFailure: true,
+    });
+    if (existingRemote.exitCode === 0) {
+        await runGitCommand({
+            runtime: input.runtime,
+            cwd: input.root,
+            args: ["remote", "set-url", input.remoteName, input.remoteUrl],
+        });
+    }
+    else {
+        await runGitCommand({
+            runtime: input.runtime,
+            cwd: input.root,
+            args: ["remote", "add", input.remoteName, input.remoteUrl],
+        });
+    }
+    await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["config", "--local", "--unset-all", "credential.helper"],
+        allowFailure: true,
+    });
+    await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["config", "--local", "--add", "credential.helper", ""],
+    });
+    await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: [
+            "config",
+            "--local",
+            "--add",
+            "credential.helper",
+            input.credentialHelper,
+        ],
+    });
+    await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["config", "--local", "credential.useHttpPath", "true"],
+    });
+}
+async function maybeCheckoutInitialArtifactSource(input) {
+    const localHead = await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["rev-parse", "--verify", "HEAD"],
+        allowFailure: true,
+    });
+    if (localHead.exitCode === 0) {
+        return {
+            attempted: false,
+            checkedOut: false,
+            skippedReason: "local_head_exists",
+            fetchExitCode: null,
+        };
+    }
+    const fetchResult = await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["fetch", input.remoteName, input.defaultBranch],
+        allowFailure: true,
+    });
+    if (fetchResult.exitCode !== 0) {
+        const missingDefaultBranch = isMissingRemoteBranchFetchFailure(fetchResult);
+        return {
+            attempted: true,
+            checkedOut: false,
+            skippedReason: missingDefaultBranch
+                ? "remote_default_branch_missing"
+                : "remote_unavailable",
+            fetchExitCode: fetchResult.exitCode,
+        };
+    }
+    await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["checkout", "-B", input.defaultBranch, "FETCH_HEAD"],
+    });
+    return {
+        attempted: true,
+        checkedOut: true,
+        skippedReason: null,
+        fetchExitCode: fetchResult.exitCode,
+    };
+}
+function isMissingRemoteBranchFetchFailure(result) {
+    const output = `${result.stdout}\n${result.stderr}`.toLowerCase();
+    return (output.includes("couldn't find remote ref") ||
+        output.includes("could not find remote ref") ||
+        (output.includes("remote ref") && output.includes("not found")) ||
+        output.includes("repository is empty"));
+}
+async function maybeSeedInitialArtifactGitCommit(input) {
+    if (input.sourceCheckout.skippedReason === "local_head_exists") {
+        return {
+            attempted: false,
+            committed: false,
+            pushed: false,
+            skippedReason: "local_head_exists",
+            commitExitCode: null,
+            pushExitCode: null,
+        };
+    }
+    if (input.sourceCheckout.checkedOut) {
+        return {
+            attempted: false,
+            committed: false,
+            pushed: false,
+            skippedReason: "source_checked_out",
+            commitExitCode: null,
+            pushExitCode: null,
+        };
+    }
+    if (input.sourceCheckout.skippedReason !== "remote_default_branch_missing") {
+        return {
+            attempted: false,
+            committed: false,
+            pushed: false,
+            skippedReason: "remote_unavailable",
+            commitExitCode: null,
+            pushExitCode: null,
+        };
+    }
+    const paths = [...new Set(input.paths)].sort();
+    if (paths.length === 0) {
+        return {
+            attempted: false,
+            committed: false,
+            pushed: false,
+            skippedReason: "no_files_to_seed",
+            commitExitCode: null,
+            pushExitCode: null,
+        };
+    }
+    await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["add", "--", ...paths],
+    });
+    const commitResult = await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["commit", "-m", "Seed Tender App scaffold"],
+    });
+    const pushResult = await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.root,
+        args: ["push", input.remoteName, input.defaultBranch],
+    });
+    return {
+        attempted: true,
+        committed: true,
+        pushed: true,
+        skippedReason: null,
+        commitExitCode: commitResult.exitCode,
+        pushExitCode: pushResult.exitCode,
+    };
+}
+async function requestGitRemoteLease(input) {
+    const url = `${input.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.artifactId)}/git/remote?ttl=${encodeURIComponent(input.ttl)}`;
+    const response = await input.fetcher(url, {
+        headers: {
+            authorization: `Bearer ${input.token}`,
+        },
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !payload.git) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Artifact Git remote request failed with HTTP ${response.status}.`);
+    }
+    return payload.git;
+}
+function parseCredentialInput(stdin) {
+    const values = new Map();
+    for (const line of stdin.split(/\r?\n/)) {
+        const separator = line.indexOf("=");
+        if (separator <= 0) {
+            continue;
+        }
+        values.set(line.slice(0, separator), line.slice(separator + 1));
+    }
+    return values;
+}
+function credentialRequestMatchesRemote(input) {
+    if (!input.remoteUrl) {
+        return true;
+    }
+    let expected;
+    try {
+        expected = new URL(input.remoteUrl);
+    }
+    catch {
+        return false;
+    }
+    const credential = parseCredentialInput(input.stdin);
+    const protocol = credential.get("protocol");
+    const host = credential.get("host");
+    const credentialPath = credential.get("path")?.replace(/^\/+/, "");
+    const expectedPath = expected.pathname.replace(/^\/+/, "");
+    if (protocol && protocol !== expected.protocol.replace(/:$/, "")) {
+        return false;
+    }
+    if (host && host !== expected.host) {
+        return false;
+    }
+    if (credentialPath && credentialPath !== expectedPath) {
+        return false;
+    }
+    return Boolean(protocol || host || credentialPath);
+}
+async function runGitSetup(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const git = await requestGitRemoteLease({
+        artifactId: command.artifactId,
+        ttl: command.ttl,
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const root = path.resolve(command.dir);
+    const helper = createCredentialHelperCommand({
+        artifactId: command.artifactId,
+        baseUrl: credentials.baseUrl,
+        profileName: credentials.profileName,
+        ttl: command.ttl,
+        remoteUrl: git.remoteUrl,
+    });
+    const plannedCommands = createGitSetupCommandPlan({
+        remoteName: command.remoteName,
+        remoteUrl: git.remoteUrl,
+        credentialHelper: helper,
+    });
+    if (!command.dryRun) {
+        await applyGitSetup({
+            runtime,
+            root,
+            remoteName: command.remoteName,
+            remoteUrl: git.remoteUrl,
+            credentialHelper: helper,
+        });
+    }
+    const result = {
+        ok: true,
+        command: command.command,
+        artifactId: command.artifactId,
+        dir: root,
+        remoteName: command.remoteName,
+        remoteUrl: git.remoteUrl,
+        defaultBranch: git.defaultBranch,
+        scope: git.scope,
+        ttl: command.ttl,
+        dryRun: command.dryRun,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        credentialHelper: helper,
+        commands: plannedCommands.map((parts) => parts.join(" ")),
+        next: `git push ${command.remoteName} ${git.defaultBranch}`,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `remote: ${command.remoteName}`,
+            `remote_url: ${git.remoteUrl}`,
+            `default_branch: ${git.defaultBranch}`,
+            `next: ${result.next}`,
+        ].join("\n"));
+    }
+    return 0;
+}
+async function runGitCredential(command, io, runtime) {
+    if (command.operation !== "get") {
+        return 0;
+    }
+    if (!credentialRequestMatchesRemote({
+        stdin: runtime.stdin ?? "",
+        remoteUrl: command.remoteUrl,
+    })) {
+        if (command.json) {
+            io.stdout(JSON.stringify({ ok: false, reasonCode: "remote_mismatch" }));
+        }
+        return 0;
+    }
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const git = await requestGitRemoteLease({
+        artifactId: command.artifactId,
+        ttl: command.ttl,
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    if (command.json) {
+        io.stdout(JSON.stringify({
+            ok: true,
+            command: command.command,
+            artifactId: command.artifactId,
+            remoteUrl: git.remoteUrl,
+            username: git.token?.username ?? git.authentication?.username ?? "tender",
+            password: git.token?.password ??
+                (git.authentication?.mode === "tender-api-token"
+                    ? credentials.token
+                    : ""),
+            expiresAt: git.token?.expiresAt ?? null,
+        }, null, 2));
+    }
+    else {
+        io.stdout([
+            `username=${git.token?.username ?? git.authentication?.username ?? "tender"}`,
+            `password=${git.token?.password ??
+                (git.authentication?.mode === "tender-api-token"
+                    ? credentials.token
+                    : "")}`,
+        ].join("\n"));
+    }
+    return 0;
+}
+async function runArtifactsInit(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const fetcher = runtime.fetcher ?? fetch;
+    const context = await requestAgentContext({
+        artifactId: command.artifactId,
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher,
+    });
+    const root = path.resolve(command.dir);
+    const git = await requestGitRemoteLease({
+        artifactId: command.artifactId,
+        ttl: command.ttl,
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher,
+    });
+    const helper = createCredentialHelperCommand({
+        artifactId: command.artifactId,
+        baseUrl: credentials.baseUrl,
+        profileName: credentials.profileName,
+        ttl: command.ttl,
+        remoteUrl: git.remoteUrl,
+    });
+    const gitCommands = createGitSetupCommandPlan({
+        remoteName: command.remoteName,
+        remoteUrl: git.remoteUrl,
+        credentialHelper: helper,
+    });
+    let sourceCheckout = {
+        attempted: false,
+        checkedOut: false,
+        skippedReason: command.dryRun ? "dry_run" : null,
+        fetchExitCode: null,
+    };
+    let seedCommit = {
+        attempted: false,
+        committed: false,
+        pushed: false,
+        skippedReason: command.dryRun ? "dry_run" : null,
+        commitExitCode: null,
+        pushExitCode: null,
+    };
+    let sourceExport = {
+        attempted: false,
+        filesWritten: 0,
+        skippedReason: command.dryRun ? "dry_run" : null,
+        files: [],
+    };
+    let seedPaths = [];
+    let plannedFiles = await planContextFiles({
+        root,
+        files: context.files,
+        force: command.force,
+    });
+    if (!command.dryRun) {
+        await mkdir(root, { recursive: true });
+        const gitState = await runGitCommand({
+            runtime,
+            cwd: root,
+            args: ["rev-parse", "--is-inside-work-tree"],
+            allowFailure: true,
+        });
+        if (gitState.exitCode !== 0) {
+            await runGitCommand({
+                runtime,
+                cwd: root,
+                args: ["init", "-b", git.defaultBranch],
+            });
+        }
+        await applyGitSetup({
+            runtime,
+            root,
+            remoteName: command.remoteName,
+            remoteUrl: git.remoteUrl,
+            credentialHelper: helper,
+        });
+        sourceCheckout = await maybeCheckoutInitialArtifactSource({
+            runtime,
+            root,
+            remoteName: command.remoteName,
+            defaultBranch: git.defaultBranch,
+        });
+        if (sourceCheckout.skippedReason === "remote_default_branch_missing") {
+            const sourceFiles = await collectArtifactWorkspaceSourceFiles({
+                artifactId: command.artifactId,
+                baseUrl: credentials.baseUrl,
+                token: credentials.token,
+                fetcher,
+            });
+            const plannedSourceFiles = await planSourceFiles({
+                root,
+                files: sourceFiles,
+                force: command.force,
+            });
+            const sourceConflicts = plannedSourceFiles.filter((file) => file.action === "conflict");
+            sourceExport = {
+                attempted: true,
+                filesWritten: 0,
+                skippedReason: plannedSourceFiles.length === 0 ? "empty_workspace" : null,
+                files: plannedSourceFiles.map((file) => ({
+                    path: file.path,
+                    action: file.action,
+                })),
+            };
+            if (sourceConflicts.length > 0) {
+                const result = {
+                    ok: false,
+                    command: command.command,
+                    artifactId: command.artifactId,
+                    revision: context.revision,
+                    dir: root,
+                    remoteName: command.remoteName,
+                    remoteUrl: git.remoteUrl,
+                    defaultBranch: git.defaultBranch,
+                    dryRun: command.dryRun,
+                    force: command.force,
+                    authSource: credentials.source,
+                    profile: credentials.profileName,
+                    sourceCheckout,
+                    sourceExport,
+                    seedCommit,
+                    summary: {
+                        create: plannedFiles.filter((file) => file.action === "create")
+                            .length,
+                        overwrite: plannedFiles.filter((file) => file.action === "overwrite").length,
+                        unchanged: plannedFiles.filter((file) => file.action === "unchanged").length,
+                        conflict: 0,
+                        sourceConflict: sourceConflicts.length,
+                    },
+                    files: plannedFiles.map((file) => ({
+                        path: file.path,
+                        sha256: file.sha256,
+                        action: file.action,
+                    })),
+                };
+                if (command.json) {
+                    io.stdout(JSON.stringify(result, null, 2));
+                }
+                else {
+                    io.stdout([
+                        `context_revision: ${context.revision}`,
+                        `source_conflicts: ${sourceConflicts.length}`,
+                        ...sourceConflicts.map((file) => `conflict: ${file.path}`),
+                        "next: rerun with --force to overwrite local source files.",
+                    ].join("\n"));
+                }
+                return 1;
+            }
+            for (const file of plannedSourceFiles) {
+                if (file.action !== "create" && file.action !== "overwrite") {
+                    continue;
+                }
+                await mkdir(path.dirname(file.absolutePath), { recursive: true });
+                await writeFile(file.absolutePath, file.content);
+                seedPaths.push(file.path);
+            }
+            sourceExport = {
+                ...sourceExport,
+                filesWritten: seedPaths.length,
+            };
+        }
+        else if (sourceCheckout.checkedOut) {
+            sourceExport = {
+                attempted: false,
+                filesWritten: 0,
+                skippedReason: "source_checked_out",
+                files: [],
+            };
+        }
+        else if (sourceCheckout.skippedReason === "local_head_exists") {
+            sourceExport = {
+                attempted: false,
+                filesWritten: 0,
+                skippedReason: "local_head_exists",
+                files: [],
+            };
+        }
+        else if (sourceCheckout.skippedReason === "remote_unavailable") {
+            sourceExport = {
+                attempted: false,
+                filesWritten: 0,
+                skippedReason: "remote_unavailable",
+                files: [],
+            };
+        }
+        plannedFiles = await planContextFiles({
+            root,
+            files: context.files,
+            force: command.force,
+        });
+    }
+    const conflicts = plannedFiles.filter((file) => file.action === "conflict");
+    if (conflicts.length > 0) {
+        const result = {
+            ok: false,
+            command: command.command,
+            artifactId: command.artifactId,
+            revision: context.revision,
+            dir: root,
+            remoteName: command.remoteName,
+            remoteUrl: git.remoteUrl,
+            defaultBranch: git.defaultBranch,
+            dryRun: command.dryRun,
+            force: command.force,
+            authSource: credentials.source,
+            profile: credentials.profileName,
+            sourceCheckout,
+            sourceExport,
+            seedCommit,
+            summary: {
+                create: plannedFiles.filter((file) => file.action === "create").length,
+                overwrite: plannedFiles.filter((file) => file.action === "overwrite").length,
+                unchanged: plannedFiles.filter((file) => file.action === "unchanged").length,
+                conflict: conflicts.length,
+            },
+            files: plannedFiles.map((file) => ({
+                path: file.path,
+                sha256: file.sha256,
+                action: file.action,
+            })),
+        };
+        if (command.json) {
+            io.stdout(JSON.stringify(result, null, 2));
+        }
+        else {
+            io.stdout([
+                `context_revision: ${context.revision}`,
+                `conflicts: ${conflicts.length}`,
+                ...conflicts.map((file) => `conflict: ${file.path}`),
+                "next: rerun with --force to overwrite managed context files.",
+            ].join("\n"));
+        }
+        return 1;
+    }
+    if (!command.dryRun) {
+        for (const file of plannedFiles) {
+            if (file.action !== "create" && file.action !== "overwrite") {
+                continue;
+            }
+            await mkdir(path.dirname(file.absolutePath), { recursive: true });
+            await writeFile(file.absolutePath, file.content);
+            seedPaths.push(file.path);
+        }
+        seedCommit = await maybeSeedInitialArtifactGitCommit({
+            runtime,
+            root,
+            remoteName: command.remoteName,
+            defaultBranch: git.defaultBranch,
+            sourceCheckout,
+            paths: seedPaths,
+        });
+    }
+    const result = {
+        ok: true,
+        command: command.command,
+        artifactId: command.artifactId,
+        revision: context.revision,
+        dir: root,
+        remoteName: command.remoteName,
+        remoteUrl: git.remoteUrl,
+        defaultBranch: git.defaultBranch,
+        dryRun: command.dryRun,
+        force: command.force,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        sourceCheckout,
+        sourceExport,
+        seedCommit,
+        summary: {
+            create: plannedFiles.filter((file) => file.action === "create").length,
+            overwrite: plannedFiles.filter((file) => file.action === "overwrite").length,
+            unchanged: plannedFiles.filter((file) => file.action === "unchanged").length,
+            conflict: 0,
+        },
+        files: plannedFiles.map((file) => ({
+            path: file.path,
+            sha256: file.sha256,
+            action: file.action,
+        })),
+        commands: [
+            `mkdir -p ${root}`,
+            `git init -b ${git.defaultBranch} # if needed`,
+            ...gitCommands.map((parts) => parts.join(" ")),
+            `git fetch ${command.remoteName} ${git.defaultBranch} # if no local commits`,
+            `git checkout -B ${git.defaultBranch} FETCH_HEAD # if fetch succeeds`,
+        ],
+        next: `git -C ${root} push ${command.remoteName} ${git.defaultBranch}`,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `artifact_id: ${command.artifactId}`,
+            `context_revision: ${context.revision}`,
+            `dir: ${root}`,
+            `remote: ${command.remoteName}`,
+            `next: ${result.next}`,
+        ].join("\n"));
+    }
+    return 0;
+}
+async function postLifecycle(input) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: input.command.baseUrl,
+        flagToken: input.command.flagToken,
+        profileName: input.command.profileName,
+        env: input.runtime.env ?? process.env,
+    });
+    const fetcher = input.runtime.fetcher ?? fetch;
+    const stream = input.command.stream;
+    const url = `${credentials.baseUrl}${input.path}${stream ? "?stream=1" : ""}`;
+    const requestBody = {};
+    if ("commitSha" in input.command && input.command.commitSha) {
+        requestBody.commitSha = input.command.commitSha;
+    }
+    if ("message" in input.command && input.command.message) {
+        requestBody.message = input.command.message;
+    }
+    const response = await fetcher(url, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${credentials.token}`,
+            accept: stream ? "text/event-stream" : "application/json",
+            ...(Object.keys(requestBody).length > 0
+                ? { "content-type": "application/json" }
+                : {}),
+        },
+        body: Object.keys(requestBody).length > 0
+            ? JSON.stringify(requestBody)
+            : undefined,
+    });
+    if (stream) {
+        if (!response.ok) {
+            throw new Error(`Artifact ${input.operation} request failed with HTTP ${response.status}.`);
+        }
+        await emitSseLifecycleStream({
+            response,
+            io: input.io,
+            json: input.command.json,
+        });
+        return 0;
+    }
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Artifact ${input.operation} request failed with HTTP ${response.status}.`);
+    }
+    const result = {
+        ok: true,
+        command: input.command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: input.command.artifactId,
+        operation: payload.operation ?? input.operation,
+        job: payload.job ?? null,
+        result: payload.result ?? null,
+    };
+    if (input.command.json) {
+        input.io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        input.io.stdout([
+            `artifact_id: ${input.command.artifactId}`,
+            `operation: ${result.operation}`,
+            "status: completed",
+        ].join("\n"));
+    }
+    return 0;
+}
+async function runValidate(command, io, runtime) {
+    return await postLifecycle({
+        command,
+        operation: "validate",
+        path: `/api/v1/artifacts/${encodeURIComponent(command.artifactId)}/validate`,
+        io,
+        runtime,
+    });
+}
+async function runBuild(command, io, runtime) {
+    return await postLifecycle({
+        command,
+        operation: "build",
+        path: `/api/v1/artifacts/${encodeURIComponent(command.artifactId)}/build`,
+        io,
+        runtime,
+    });
+}
+async function runPreviewRebuild(command, io, runtime) {
+    return await postLifecycle({
+        command,
+        operation: "preview",
+        path: `/api/v1/artifacts/${encodeURIComponent(command.artifactId)}/preview/rebuild`,
+        io,
+        runtime,
+    });
+}
+async function requestPreviewStatus(input) {
+    if (input.command.jobId) {
+        const response = await input.fetcher(`${input.credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.command.artifactId)}/jobs/${encodeURIComponent(input.command.jobId)}`, {
+            headers: {
+                authorization: `Bearer ${input.credentials.token}`,
+            },
+        });
+        const payload = await parseJsonResponse(response);
+        if (!response.ok || !payload?.ok || !payload.job) {
+            throw new Error(payload?.message ??
+                payload?.reasonCode ??
+                `Preview job lookup failed with HTTP ${response.status}.`);
+        }
+        return {
+            job: payload.job,
+            preview: {
+                artifactId: input.command.artifactId,
+                commitSha: null,
+                status: payload.job.status,
+                previewUrl: readPreviewUrlFromJob(payload.job),
+                diagnostics: [],
+                job: payload.job,
+            },
+        };
+    }
+    const params = new URLSearchParams({ limit: "1" });
+    if (input.command.commitSha) {
+        params.set("commit", input.command.commitSha);
+    }
+    const response = await input.fetcher(`${input.credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.command.artifactId)}/previews?${params.toString()}`, {
+        headers: {
+            authorization: `Bearer ${input.credentials.token}`,
+        },
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Preview status lookup failed with HTTP ${response.status}.`);
+    }
+    const preview = payload.previews?.[0] ?? null;
+    if (!preview?.job) {
+        throw new Error(input.command.commitSha
+            ? `No preview job found for commit ${input.command.commitSha}.`
+            : "No preview job found for this artifact.");
+    }
+    return {
+        job: preview.job,
+        preview,
+    };
+}
+async function runPreviewStatus(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const { job, preview } = await requestPreviewStatus({
+        command,
+        credentials,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: command.artifactId,
+        commitSha: preview.commitSha ?? command.commitSha,
+        status: preview.status ?? job.status ?? null,
+        previewUrl: preview.previewUrl ?? readPreviewUrlFromJob(job),
+        job,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `artifact_id: ${command.artifactId}`,
+            `job_id: ${job.jobId}`,
+            `status: ${result.status ?? "unknown"}`,
+            ...(result.previewUrl ? [`preview_url: ${result.previewUrl}`] : []),
+        ].join("\n"));
+    }
+    return 0;
+}
+async function runPreviewWatch(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const { job } = await requestPreviewStatus({
+        command,
+        credentials,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const stream = command.stream;
+    const response = await (runtime.fetcher ?? fetch)(`${credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(command.artifactId)}/jobs/${encodeURIComponent(job.jobId)}/events${stream ? "?stream=1" : ""}`, {
+        headers: {
+            authorization: `Bearer ${credentials.token}`,
+            accept: stream ? "text/event-stream" : "application/json",
+        },
+    });
+    if (stream) {
+        if (!response.ok) {
+            throw new Error(`Preview event stream failed with HTTP ${response.status}.`);
+        }
+        await emitSseLifecycleStream({
+            response,
+            io,
+            json: command.json,
+        });
+        return 0;
+    }
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Preview events lookup failed with HTTP ${response.status}.`);
+    }
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: command.artifactId,
+        job: payload.job ?? job,
+        events: payload.events ?? [],
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout((result.events.length > 0
+            ? result.events.map((event) => event.phase ?? "event")
+            : ["no events"]).join("\n"));
+    }
+    return 0;
+}
+async function runPublish(command, io, runtime) {
+    if (command.dryRun) {
+        const result = {
+            ok: true,
+            command: command.command,
+            artifactId: command.artifactId,
+            commitSha: command.commitSha,
+            dryRun: true,
+            confirmed: false,
+            message: command.message,
+            wouldRequest: {
+                method: "POST",
+                path: `/api/v1/artifacts/${command.artifactId}/publish`,
+                stream: command.stream,
+                body: {
+                    ...(command.commitSha ? { commitSha: command.commitSha } : {}),
+                    ...(command.message ? { message: command.message } : {}),
+                },
+            },
+        };
+        if (command.json) {
+            io.stdout(JSON.stringify(result, null, 2));
+        }
+        else {
+            io.stdout([
+                `artifact_id: ${command.artifactId}`,
+                "dry_run: true",
+                "next: rerun with --confirm publish to publish.",
+            ].join("\n"));
+        }
+        return 0;
+    }
+    return await postLifecycle({
+        command,
+        operation: "publish",
+        path: `/api/v1/artifacts/${encodeURIComponent(command.artifactId)}/publish`,
+        io,
+        runtime,
+    });
+}
+async function requestPublishJob(input) {
+    const response = await input.fetcher(`${input.credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(input.command.artifactId)}/jobs/${encodeURIComponent(input.command.jobId)}`, {
+        headers: {
+            authorization: `Bearer ${input.credentials.token}`,
+        },
+    });
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok || !payload.job) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Publish job lookup failed with HTTP ${response.status}.`);
+    }
+    if (payload.job.operation && payload.job.operation !== "publish") {
+        throw new Error(`Lifecycle job ${payload.job.jobId} is ${payload.job.operation}, not publish.`);
+    }
+    return payload.job;
+}
+async function runPublishStatus(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const job = await requestPublishJob({
+        command,
+        credentials,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: command.artifactId,
+        status: job.status ?? null,
+        publishedUrl: readPublishedUrlFromJob(job),
+        job,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout([
+            `artifact_id: ${command.artifactId}`,
+            `job_id: ${job.jobId}`,
+            `status: ${result.status ?? "unknown"}`,
+            ...(result.publishedUrl
+                ? [`published_url: ${result.publishedUrl}`]
+                : []),
+        ].join("\n"));
+    }
+    return 0;
+}
+async function runPublishWatch(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const job = await requestPublishJob({
+        command,
+        credentials,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const stream = command.stream;
+    const response = await (runtime.fetcher ?? fetch)(`${credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(command.artifactId)}/jobs/${encodeURIComponent(job.jobId)}/events${stream ? "?stream=1" : ""}`, {
+        headers: {
+            authorization: `Bearer ${credentials.token}`,
+            accept: stream ? "text/event-stream" : "application/json",
+        },
+    });
+    if (stream) {
+        if (!response.ok) {
+            throw new Error(`Publish event stream failed with HTTP ${response.status}.`);
+        }
+        await emitSseLifecycleStream({
+            response,
+            io,
+            json: command.json,
+        });
+        return 0;
+    }
+    const payload = await parseJsonResponse(response);
+    if (!response.ok || !payload?.ok) {
+        throw new Error(payload?.message ??
+            payload?.reasonCode ??
+            `Publish events lookup failed with HTTP ${response.status}.`);
+    }
+    const result = {
+        ok: true,
+        command: command.command,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        artifactId: command.artifactId,
+        job: payload.job ?? job,
+        events: payload.events ?? [],
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        io.stdout((result.events.length > 0
+            ? result.events.map((event) => event.phase ?? "event")
+            : ["no events"]).join("\n"));
+    }
+    return 0;
+}
+async function runGitRemote(command, io, runtime) {
+    const credentials = await resolveApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
+        env: runtime.env ?? process.env,
+    });
+    const git = await requestGitRemoteLease({
+        artifactId: command.artifactId,
+        ttl: command.ttl,
+        baseUrl: credentials.baseUrl,
+        token: credentials.token,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const result = {
+        ok: true,
+        command: command.command,
+        artifactId: command.artifactId,
+        baseUrl: credentials.baseUrl,
+        authSource: credentials.source,
+        profile: credentials.profileName,
+        remoteUrl: git.remoteUrl,
+        defaultBranch: git.defaultBranch,
+        scope: git.scope,
+        authentication: git.authentication?.mode ?? "artifacts-token",
+        username: git.token?.username ?? git.authentication?.username ?? "tender",
+        password: git.token?.password ?? null,
+        expiresAt: git.token?.expiresAt ?? null,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(result, null, 2));
+    }
+    else {
+        const lines = [
+            `remote_url: ${result.remoteUrl}`,
+            `default_branch: ${result.defaultBranch}`,
+            `authentication: ${result.authentication}`,
+            `username: ${result.username}`,
+        ];
+        if (result.password) {
+            lines.push(`password: ${result.password}`);
+        }
+        if (result.expiresAt) {
+            lines.push(`expires_at: ${result.expiresAt}`);
+        }
+        io.stdout(lines.join("\n"));
+    }
+    return 0;
+}
+export async function runTenderCli(args, io = {
+    stdout: (message) => console.log(message),
+    stderr: (message) => console.error(message),
+}, runtime = {}) {
+    try {
+        const command = parseTenderArgs(args);
+        if (command.command === "help") {
+            if (command.topic === "auth login") {
+                io.stdout(authLoginHelp());
+            }
+            else if (command.topic === "auth status") {
+                io.stdout(authStatusHelp());
+            }
+            else if (command.topic === "auth") {
+                io.stdout(authHelp());
+            }
+            else if (command.topic === "artifacts create") {
+                io.stdout(artifactsCreateHelp());
+            }
+            else if (command.topic === "artifacts update") {
+                io.stdout(artifactsUpdateHelp());
+            }
+            else if (command.topic === "artifacts init") {
+                io.stdout(artifactsInitHelp());
+            }
+            else if (command.topic === "artifacts doctor") {
+                io.stdout(doctorHelp());
+            }
+            else if (command.topic === "artifacts list") {
+                io.stdout(artifactsListHelp());
+            }
+            else if (command.topic === "artifacts context fetch") {
+                io.stdout(artifactsContextFetchHelp());
+            }
+            else if (command.topic === "artifacts context status") {
+                io.stdout(artifactsContextStatusHelp());
+            }
+            else if (command.topic === "artifacts context refresh") {
+                io.stdout(artifactsContextRefreshHelp());
+            }
+            else if (command.topic === "artifacts git setup") {
+                io.stdout(gitSetupHelp());
+            }
+            else if (command.topic === "artifacts git credential") {
+                io.stdout(gitCredentialHelp());
+            }
+            else if (command.topic === "artifacts git remote") {
+                io.stdout(gitRemoteHelp());
+            }
+            else if (command.topic === "artifacts validate") {
+                io.stdout(validateHelp());
+            }
+            else if (command.topic === "artifacts build") {
+                io.stdout(buildHelp());
+            }
+            else if (command.topic === "artifacts preview rebuild") {
+                io.stdout(previewRebuildHelp());
+            }
+            else if (command.topic === "artifacts preview status") {
+                io.stdout(previewStatusHelp());
+            }
+            else if (command.topic === "artifacts preview watch") {
+                io.stdout(previewWatchHelp());
+            }
+            else if (command.topic === "artifacts publish") {
+                io.stdout(publishHelp());
+            }
+            else if (command.topic === "artifacts publish status") {
+                io.stdout(publishStatusHelp());
+            }
+            else if (command.topic === "artifacts publish watch") {
+                io.stdout(publishWatchHelp());
+            }
+            else if (command.topic === "artifacts") {
+                io.stdout(artifactsHelp());
+            }
+            else {
+                io.stdout(rootHelp());
+            }
+            return 0;
+        }
+        if (command.command === "auth login") {
+            return await runAuthLogin(command, io, runtime);
+        }
+        if (command.command === "auth status") {
+            return await runAuthStatus(command, io, runtime);
+        }
+        if (command.command === "artifacts list") {
+            return await runArtifactsList(command, io, runtime);
+        }
+        if (command.command === "artifacts create") {
+            return await runArtifactsCreate(command, io, runtime);
+        }
+        if (command.command === "artifacts update") {
+            return await runArtifactsUpdate(command, io, runtime);
+        }
+        if (command.command === "artifacts init") {
+            return await runArtifactsInit(command, io, runtime);
+        }
+        if (command.command === "artifacts context fetch") {
+            return await runContextFetch(command, io, runtime);
+        }
+        if (command.command === "artifacts context status") {
+            return await runContextStatus(command, io, runtime);
+        }
+        if (command.command === "artifacts context refresh") {
+            return await runContextFetch(command, io, runtime);
+        }
+        if (command.command === "artifacts git setup") {
+            return await runGitSetup(command, io, runtime);
+        }
+        if (command.command === "artifacts git credential") {
+            return await runGitCredential(command, io, runtime);
+        }
+        if (command.command === "artifacts validate") {
+            return await runValidate(command, io, runtime);
+        }
+        if (command.command === "artifacts build") {
+            return await runBuild(command, io, runtime);
+        }
+        if (command.command === "artifacts preview rebuild") {
+            return await runPreviewRebuild(command, io, runtime);
+        }
+        if (command.command === "artifacts preview status") {
+            return await runPreviewStatus(command, io, runtime);
+        }
+        if (command.command === "artifacts preview watch") {
+            return await runPreviewWatch(command, io, runtime);
+        }
+        if (command.command === "artifacts publish") {
+            return await runPublish(command, io, runtime);
+        }
+        if (command.command === "artifacts publish status") {
+            return await runPublishStatus(command, io, runtime);
+        }
+        if (command.command === "artifacts publish watch") {
+            return await runPublishWatch(command, io, runtime);
+        }
+        if (command.command === "artifacts git remote") {
+            return await runGitRemote(command, io, runtime);
+        }
+        return await runDoctor(command, io);
+    }
+    catch (error) {
+        io.stderr(error instanceof Error ? error.message : String(error));
+        io.stderr("Run `tender --help` for examples.");
+        return error instanceof TenderCliUsageError ? 2 : 1;
+    }
+}
+const currentFile = fileURLToPath(import.meta.url);
+function shouldReadEntrypointStdin(args) {
+    return (args[0] === "artifacts" &&
+        args[1] === "git" &&
+        args[2] === "credential");
+}
+async function readEntrypointStdin() {
+    if (process.stdin.isTTY) {
+        return undefined;
+    }
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === currentFile) {
+    const args = process.argv.slice(2);
+    const exitCode = await runTenderCli(args, undefined, shouldReadEntrypointStdin(args)
+        ? { stdin: await readEntrypointStdin() }
+        : undefined);
+    process.exit(exitCode);
+}