@tonbo/cli 0.0.6 → 0.1.0

package/dist/bin/tonbo.js

@@ -0,0 +1,2629 @@
+#!/usr/bin/env node
+
+// src/app.ts
+import { Command } from "commander";
+import { readFileSync } from "node:fs";
+
+// src/api.ts
+import { randomUUID } from "node:crypto";
+
+// src/http.ts
+var HttpError = class extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+  }
+};
+async function requestJson(fetcher, url, init = {}) {
+  const response = await fetcher(url, init);
+  const body = await response.json().catch(() => null);
+  if (!response.ok) {
+    const record = body && typeof body === "object" ? body : {};
+    const message = [record.detail, record.message, record.error, record.title].find(
+      (value) => typeof value === "string"
+    );
+    throw new HttpError(
+      typeof message === "string" ? message : `Request failed with HTTP ${response.status}.`,
+      response.status,
+      body
+    );
+  }
+  return body;
+}
+
+// src/api.ts
+var TonboApi = class {
+  constructor(fetcher, accountOrigin = "https://tonbo.dev", managementOrigin = "https://api.tonbo.dev") {
+    this.fetcher = fetcher;
+    this.accountOrigin = accountOrigin;
+    this.managementOrigin = managementOrigin;
+  }
+  machineRequest(oauthToken, path6 = "", method = "GET", body) {
+    return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/machines${path6}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${oauthToken}`,
+        ...body === void 0 ? {} : { "content-type": "application/json" }
+      },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
+    });
+  }
+  listProjects(oauthToken) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/projects`,
+      {
+        headers: { authorization: `Bearer ${oauthToken}` }
+      }
+    ).then((body) => body.projects);
+  }
+  listOrganizations(oauthToken) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/accounts`,
+      {
+        headers: { authorization: `Bearer ${oauthToken}` }
+      }
+    ).then((body) => body.organizations);
+  }
+  createProject(oauthToken, name, organizationId) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/projects`,
+      {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${oauthToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(organizationId ? { name, orgId: organizationId } : { name })
+      }
+    ).then((body) => body.project);
+  }
+  registerSshKey(oauthToken, key) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/ssh-keys`,
+      {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${oauthToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          algorithm: key.algorithm,
+          key_base64: key.keyBase64,
+          label: key.label
+        })
+      }
+    ).then((body) => body.key);
+  }
+  revokeSshKey(oauthToken, fingerprint) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/ssh-keys`,
+      {
+        method: "DELETE",
+        headers: {
+          authorization: `Bearer ${oauthToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({ fingerprint })
+      }
+    ).then((body) => body.key);
+  }
+  exchangeManagementToken(oauthToken, projectId) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/projects/${projectId}/token`,
+      {
+        method: "POST",
+        headers: { authorization: `Bearer ${oauthToken}` }
+      }
+    ).then((body) => body.access_token);
+  }
+  async deploy({
+    bundle,
+    origin,
+    projectId,
+    promote,
+    spec,
+    token
+  }) {
+    const descriptor = {
+      format: bundle.format,
+      sha256: bundle.sha256,
+      size_bytes: bundle.size_bytes
+    };
+    const bundlesPath = `/v1/projects/${projectId}/source-bundles`;
+    const prepared = await this.management("PUT", `${bundlesPath}/${bundle.sha256}`, token, {
+      format: descriptor.format,
+      size_bytes: descriptor.size_bytes
+    });
+    if (prepared.status === "upload") {
+      if (!prepared.upload_url) throw new Error("Tonbo did not return a source upload URL.");
+      const uploaded = await this.fetcher(prepared.upload_url, {
+        method: "PUT",
+        headers: {
+          "content-type": prepared.content_type ?? "application/vnd.tonbo.source+tar",
+          "x-upsert": "false"
+        },
+        body: new Blob([new Uint8Array(bundle.bytes)])
+      });
+      let uploadError = null;
+      if (!uploaded.ok) {
+        uploadError = new Error(`Source upload failed with HTTP ${uploaded.status}.`);
+      }
+      try {
+        await this.management("POST", `${bundlesPath}/${bundle.sha256}/complete`, token, {
+          format: bundle.format,
+          size_bytes: bundle.size_bytes
+        });
+      } catch (error) {
+        if (uploadError)
+          throw new AggregateError([uploadError, error], "Source bundle upload did not complete.");
+        throw error;
+      }
+    }
+    let deployment = await this.createDeployment(projectId, { spec, origin }, token);
+    const previous = await this.getProduction(projectId, token);
+    const previousDeployment = previous ? await this.getDeployment(projectId, previous.deployment_id, token) : null;
+    const unchanged = previousDeployment?.spec_sha256 === deployment.spec_sha256;
+    let production = previous;
+    if (promote) {
+      production = await this.putProduction(
+        projectId,
+        {
+          deployment_id: deployment.id,
+          desired_state: "running",
+          expected_generation: previous ? previous.generation : null
+        },
+        token
+      );
+      deployment = await this.getDeployment(projectId, deployment.id, token);
+    }
+    return { deployment, production, unchanged };
+  }
+  createDeployment(projectId, body, token) {
+    return this.management(
+      "POST",
+      `/v1/projects/${projectId}/deployments`,
+      token,
+      body
+    ).then((response) => response.data);
+  }
+  listDeployments(projectId, token) {
+    return this.managementList(`/v1/projects/${projectId}/deployments`, token);
+  }
+  getDeployment(projectId, deploymentId, token) {
+    return this.management(
+      "GET",
+      `/v1/projects/${projectId}/deployments/${deploymentId}`,
+      token
+    ).then((response) => response.data);
+  }
+  getProduction(projectId, token) {
+    return this.management(
+      "GET",
+      `/v1/projects/${projectId}/production`,
+      token
+    ).then(
+      (response) => response.data,
+      (error) => {
+        if (error.status === 404) return null;
+        throw error;
+      }
+    );
+  }
+  putProduction(projectId, body, token) {
+    return this.management(
+      "PUT",
+      `/v1/projects/${projectId}/production`,
+      token,
+      body
+    ).then((response) => response.data);
+  }
+  listRollouts(projectId, token) {
+    return this.managementList(
+      `/v1/projects/${projectId}/production/rollouts`,
+      token
+    );
+  }
+  async run({
+    projectId,
+    prompt,
+    sessionId,
+    token,
+    turnId = randomUUID()
+  }) {
+    const projectPath = `/v1/projects/${projectId}`;
+    const production = await this.getProduction(projectId, token);
+    if (!production)
+      throw new Error("Project has no Production Deployment; run `tonbo deploy` first.");
+    if (production.observed_state !== "running")
+      throw new Error(
+        `Production is ${production.observed_state}${production.last_error ? ` (${production.last_error})` : ""}; wait for it to be running.`
+      );
+    const session = sessionId ? { id: sessionId } : (await this.management(
+      "POST",
+      `${projectPath}/sessions`,
+      token,
+      { deployment_id: production.deployment_id }
+    )).data;
+    const turn = (await this.management(
+      "POST",
+      `${projectPath}/sessions/${session.id}/turns`,
+      token,
+      { prompt },
+      turnId
+    )).data;
+    return { production, session, turn };
+  }
+  turnEvents({
+    after = 0,
+    projectId,
+    sessionId,
+    token,
+    turnId
+  }) {
+    return this.management(
+      "GET",
+      `/v1/projects/${projectId}/sessions/${sessionId}/turns/${turnId}/events?after=${after}`,
+      token
+    );
+  }
+  listProjectSecrets(projectId, token) {
+    return this.management(
+      "GET",
+      `/v1/projects/${projectId}/secrets`,
+      token
+    ).then((body) => body.data);
+  }
+  setProjectSecret(projectId, name, value, token) {
+    return this.management(
+      "PUT",
+      `/v1/projects/${projectId}/secrets/${encodeURIComponent(name)}`,
+      token,
+      { value }
+    );
+  }
+  deleteProjectSecret(projectId, name, token) {
+    return this.management(
+      "DELETE",
+      `/v1/projects/${projectId}/secrets/${encodeURIComponent(name)}`,
+      token
+    );
+  }
+  management(method, path6, token, body, idempotencyKey) {
+    return requestJson(this.fetcher, `${this.managementOrigin}${path6}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...body === void 0 ? {} : {
+          "content-type": "application/json",
+          "idempotency-key": idempotencyKey ?? randomUUID()
+        }
+      },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
+    });
+  }
+  async managementList(path6, token) {
+    const values = [];
+    let cursor = null;
+    do {
+      const separator = path6.includes("?") ? "&" : "?";
+      const page = await this.management(
+        "GET",
+        `${path6}${separator}limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`,
+        token
+      );
+      values.push(...page.data);
+      cursor = page.next_cursor;
+    } while (cursor);
+    return values;
+  }
+};
+
+// src/agent-source.ts
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+
+// ../../packages/agent-source-inspector/src/index.ts
+var AGENTS_INSTRUCTIONS_PATH = "AGENTS.md";
+var PI_SETTINGS_PATH = ".pi/settings.json";
+var MAX_HARNESS_CONFIG_BYTES = 256 * 1024;
+var supportedHarnesses = [
+  {
+    command: "pi",
+    id: "pi",
+    name: "PI"
+  }
+];
+var supportedExecutionTargets = [
+  { driver: "native", harness: "pi" },
+  { driver: "command", harness: "pi" }
+];
+var AgentSourceInspectionError = class extends Error {
+  constructor(code, path6, message, options) {
+    super(message, options);
+    this.code = code;
+    this.path = path6;
+    this.name = "AgentSourceInspectionError";
+  }
+};
+function parsePiPackageCount(contents) {
+  let settings;
+  try {
+    settings = JSON.parse(contents);
+  } catch (error) {
+    throw new AgentSourceInspectionError(
+      "invalid_pi_settings",
+      PI_SETTINGS_PATH,
+      `${PI_SETTINGS_PATH} must contain valid JSON.`,
+      { cause: error }
+    );
+  }
+  if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+    throw new AgentSourceInspectionError(
+      "invalid_pi_settings",
+      PI_SETTINGS_PATH,
+      `${PI_SETTINGS_PATH} must contain a JSON object.`
+    );
+  }
+  if (!("packages" in settings)) return 0;
+  const packages = settings.packages;
+  if (!Array.isArray(packages)) {
+    throw new AgentSourceInspectionError(
+      "invalid_pi_settings",
+      PI_SETTINGS_PATH,
+      `${PI_SETTINGS_PATH} packages must be an array.`
+    );
+  }
+  return packages.length;
+}
+async function inspectAgentSource(source) {
+  const [agentsMd, piSettings] = await Promise.all([
+    source.has(AGENTS_INSTRUCTIONS_PATH),
+    source.readText(PI_SETTINGS_PATH, MAX_HARNESS_CONFIG_BYTES)
+  ]);
+  if (piSettings !== null) {
+    return {
+      version: 1,
+      instructions: { agentsMd },
+      harness: {
+        id: "pi",
+        reason: "pi_settings_found",
+        state: "identified"
+      },
+      pi: {
+        packageCount: parsePiPackageCount(piSettings),
+        settingsFound: true
+      }
+    };
+  }
+  return {
+    version: 1,
+    instructions: { agentsMd },
+    harness: {
+      candidates: supportedHarnesses.map((harness) => harness.id),
+      reason: "no_harness_specific_config",
+      state: "selection_required"
+    },
+    pi: {
+      packageCount: 0,
+      settingsFound: false
+    }
+  };
+}
+
+// src/agent-source.ts
+var LocalAgentSource = class {
+  constructor(root) {
+    this.root = root;
+  }
+  async has(filename) {
+    const metadata = await this.metadata(filename);
+    return metadata?.isFile() === true;
+  }
+  async readText(filename, maxBytes) {
+    const metadata = await this.metadata(filename);
+    if (!metadata) return null;
+    if (!metadata.isFile() || metadata.isSymbolicLink()) {
+      throw new Error(`${filename} must be a regular file.`);
+    }
+    if (metadata.size > maxBytes) {
+      throw new Error(`${filename} exceeds the ${maxBytes}-byte inspection limit.`);
+    }
+    return readFile(path.join(this.root, filename), "utf8");
+  }
+  async metadata(filename) {
+    try {
+      return await lstat(path.join(this.root, filename));
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    }
+  }
+};
+function inspectLocalAgentSource(root) {
+  return inspectAgentSource(new LocalAgentSource(root));
+}
+
+// src/auth.ts
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+// src/callback-page.ts
+var WORDMARK = [
+  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
+  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
+  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
+].join("\n");
+var OUTCOMES = {
+  complete: {
+    status: 200,
+    title: "You are signed in.",
+    body: "Return to your terminal. This tab can be closed."
+  },
+  denied: {
+    status: 400,
+    title: "Login was not completed.",
+    body: "Nothing was authorized. Return to your terminal to try again."
+  },
+  invalid: {
+    // The state did not match, the code was missing, or the path was wrong.
+    // Say that it could not be verified rather than which check failed: the
+    // person who can read this page is not necessarily the one who started
+    // the login.
+    status: 400,
+    title: "This callback could not be verified.",
+    body: "Return to your terminal and start the login again."
+  }
+};
+function renderCallbackPage(outcome) {
+  const { title, body } = OUTCOMES[outcome];
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Tonbo CLI</title>
+<style>
+  :root {
+    --paper: #f3f2ee;
+    --ink: #1d1b17;
+    --rule: #c9c5ba;
+    --quiet: #5c564a;
+    --signal: #d64a03;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --paper: #1d1b17;
+      --ink: #f3f2ee;
+      --rule: #3a362e;
+      --quiet: #a49e8f;
+      --signal: #f08b4b;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: grid;
+    grid-template-rows: auto 1fr;
+    padding: 0 clamp(20px, 5vw, 72px);
+    background: var(--paper);
+    color: var(--ink);
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  header { padding: 28px 0; }
+  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
+     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
+     what makes the rows meet without seams. Iosevka is not available here,
+     so it falls back to the platform monospace. */
+  pre.wordmark {
+    margin: 0;
+    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
+    font-size: 8px;
+    font-weight: 400;
+    line-height: 10px;
+    letter-spacing: 0;
+    white-space: pre;
+    color: var(--signal);
+    transform: scaleY(0.8);
+    transform-origin: left top;
+  }
+  main {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    max-width: 46ch;
+    padding-bottom: 12vh;
+  }
+  h1 {
+    margin: 0;
+    font-size: 26px;
+    font-weight: 300;
+    line-height: 1.16;
+    letter-spacing: -0.018em;
+  }
+  p {
+    margin: 14px 0 0;
+    font-size: 16px;
+    line-height: 1.55;
+    color: var(--quiet);
+  }
+  hr {
+    width: 40px;
+    margin: 28px 0 0;
+    border: 0;
+    border-top: 1px solid var(--rule);
+  }
+</style>
+</head>
+<body>
+<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
+<main>
+  <h1>${title}</h1>
+  <p>${body}</p>
+  <hr>
+</main>
+</body>
+</html>
+`;
+}
+function callbackResponse(outcome) {
+  return {
+    status: OUTCOMES[outcome].status,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
+    },
+    body: renderCallbackPage(outcome)
+  };
+}
+
+// src/auth.ts
+var exec = promisify(execFile);
+var LOOPBACK_REDIRECT = "http://localhost:17655/callback";
+function base64url(value) {
+  return value.toString("base64url");
+}
+function withAbsoluteExpiry(tokens) {
+  if (tokens.expires_at || !Number.isInteger(tokens.expires_in) || (tokens.expires_in ?? 0) <= 0)
+    return tokens;
+  return {
+    ...tokens,
+    expires_at: Math.floor(Date.now() / 1e3) + (tokens.expires_in ?? 0)
+  };
+}
+var AuthClient = class {
+  constructor(credentials, fetcher, accountOrigin = "https://tonbo.dev", browserOpener = openBrowser) {
+    this.credentials = credentials;
+    this.fetcher = fetcher;
+    this.accountOrigin = accountOrigin;
+    this.browserOpener = browserOpener;
+  }
+  async accessToken() {
+    const injected = process.env.TONBO_ACCESS_TOKEN?.trim();
+    if (injected) return injected;
+    const tokens = await this.credentials.load();
+    if (!tokens) throw new Error("Not logged in. Run `tonbo login`.");
+    const legacyRelativeExpiry = !tokens.expires_at && tokens.expires_in;
+    if (!legacyRelativeExpiry && (!tokens.expires_at || tokens.expires_at > Math.floor(Date.now() / 1e3) + 30))
+      return tokens.access_token;
+    if (!tokens.refresh_token) throw new Error("Tonbo login expired. Run `tonbo login` again.");
+    const config = await this.config();
+    const refreshed = withAbsoluteExpiry(
+      await this.exchange(
+        config.token_endpoint,
+        new URLSearchParams({
+          client_id: config.client_id,
+          grant_type: "refresh_token",
+          refresh_token: tokens.refresh_token
+        })
+      )
+    );
+    if (!refreshed.refresh_token) refreshed.refresh_token = tokens.refresh_token;
+    await this.credentials.save(refreshed);
+    return refreshed.access_token;
+  }
+  async login(progress = () => {
+  }) {
+    progress({ status: "started", step: "account-config" });
+    const config = await this.config();
+    progress({ status: "completed", step: "account-config" });
+    if (config.redirect_uri !== LOOPBACK_REDIRECT)
+      throw new Error(`Unsupported OAuth redirect URI: ${config.redirect_uri}`);
+    const verifier = base64url(randomBytes(48));
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    const state = base64url(randomBytes(24));
+    const authorization = new URL(config.authorization_endpoint);
+    authorization.search = new URLSearchParams({
+      client_id: config.client_id,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      redirect_uri: config.redirect_uri,
+      response_type: "code",
+      scope: "openid profile email",
+      state
+    }).toString();
+    const code = await this.listenForCode(
+      state,
+      () => this.browserOpener(authorization.toString()),
+      progress
+    );
+    progress({ status: "started", step: "token-exchange" });
+    const tokens = withAbsoluteExpiry(
+      await this.exchange(
+        config.token_endpoint,
+        new URLSearchParams({
+          client_id: config.client_id,
+          code,
+          code_verifier: verifier,
+          grant_type: "authorization_code",
+          redirect_uri: config.redirect_uri
+        })
+      )
+    );
+    progress({ status: "completed", step: "token-exchange" });
+    progress({ status: "started", step: "credential-store" });
+    await this.credentials.save(tokens);
+    progress({ status: "completed", step: "credential-store" });
+    return tokens;
+  }
+  config() {
+    return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/config`);
+  }
+  exchange(endpoint, body) {
+    return requestJson(this.fetcher, endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body
+    });
+  }
+  listenForCode(expectedState, ready, progress) {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const sockets = /* @__PURE__ */ new Set();
+      let authorizationStarted = false;
+      const startAuthorization = () => {
+        if (authorizationStarted) return;
+        authorizationStarted = true;
+        progress({ status: "completed", step: "browser" });
+        progress({ status: "started", step: "browser-authorization" });
+      };
+      const finish = (result, completedResponseSocket) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeout);
+        const complete = (closeError) => {
+          if (closeError) reject(closeError);
+          else if ("code" in result) {
+            progress({ status: "completed", step: "callback-close" });
+            resolve(result.code);
+          } else reject(result.error);
+        };
+        if ("code" in result) progress({ status: "started", step: "callback-close" });
+        if (!server.listening) {
+          complete();
+          return;
+        }
+        server.close(complete);
+        for (const socket of sockets) {
+          if (socket !== completedResponseSocket) socket.destroy();
+        }
+        server.closeIdleConnections();
+      };
+      const timeout = setTimeout(
+        () => {
+          finish({ error: new Error("Timed out waiting for browser login.") });
+        },
+        5 * 60 * 1e3
+      );
+      const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", LOOPBACK_REDIRECT);
+        const code = url.searchParams.get("code");
+        const oauthError = url.searchParams.get("error_description") ?? url.searchParams.get("error");
+        if (oauthError) {
+          const responseSocket2 = response.socket;
+          respond(
+            response,
+            "denied",
+            () => finish({ error: new Error(oauthError) }, responseSocket2)
+          );
+          return;
+        }
+        if (url.pathname !== "/callback" || url.searchParams.get("state") !== expectedState || !code) {
+          respond(response, "invalid");
+          return;
+        }
+        startAuthorization();
+        progress({ status: "completed", step: "browser-authorization" });
+        const responseSocket = response.socket;
+        respond(response, "complete", () => finish({ code }, responseSocket));
+      });
+      server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+      });
+      server.once("error", (error) => finish({ error }));
+      progress({ status: "started", step: "callback-server" });
+      server.listen(17655, "localhost", () => {
+        progress({ status: "completed", step: "callback-server" });
+        progress({ status: "started", step: "browser" });
+        void ready().then(startAuthorization).catch(
+          (error) => finish({
+            error: error instanceof Error ? error : new Error("Could not open the login browser.")
+          })
+        );
+      });
+    });
+  }
+};
+function respond(response, outcome, finished) {
+  const page = callbackResponse(outcome);
+  if (finished) response.once("finish", finished);
+  response.writeHead(page.status, { ...page.headers, connection: "close" });
+  response.end(page.body);
+}
+async function openBrowser(url) {
+  if (process.platform === "darwin") return void await exec("open", [url]);
+  if (process.platform === "win32")
+    return void await exec("rundll32", ["url.dll,FileProtocolHandler", url]);
+  return void await exec("xdg-open", [url]);
+}
+
+// src/commands.ts
+import path4 from "node:path";
+
+// src/build.ts
+import { spawn } from "node:child_process";
+async function runBuildCommand(root, command) {
+  if (command.length === 0) throw new Error("Build command must not be empty.");
+  await new Promise((resolve, reject) => {
+    const child = spawn(command[0], command.slice(1), {
+      cwd: root,
+      env: process.env,
+      // Command output is progress, not the CLI result. Keep stdout available
+      // for the single JSON document emitted by `tonbo --json deploy`.
+      stdio: ["inherit", process.stderr, process.stderr]
+    });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) resolve();
+      else
+        reject(
+          new Error(
+            `Build command failed${signal ? ` with signal ${signal}` : ` with status ${code}`}.`
+          )
+        );
+    });
+  });
+}
+
+// src/contracts.ts
+import { Ajv2020 } from "ajv/dist/2020.js";
+
+// src/generated/contracts.ts
+var piAgentSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json",
+  "title": "PI Agent v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "runtime",
+    "driver"
+  ],
+  "properties": {
+    "runtime": {
+      "const": "pi"
+    },
+    "secrets": {
+      "type": "array",
+      "maxItems": 32,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
+      }
+    },
+    "driver": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind"
+          ],
+          "properties": {
+            "kind": {
+              "const": "native"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "protocol",
+            "command"
+          ],
+          "properties": {
+            "kind": {
+              "const": "command"
+            },
+            "protocol": {
+              "const": "pi-rpc-v1"
+            },
+            "command": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 64,
+              "items": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 1024
+              }
+            }
+          }
+        }
+      ]
+    }
+  }
+};
+var projectServiceSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/project-service-v1.schema.json",
+  "title": "Tonbo Project application service v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "command"
+  ],
+  "properties": {
+    "command": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 4096
+      }
+    },
+    "secrets": {
+      "type": "array",
+      "maxItems": 32,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
+      }
+    },
+    "kubernetes": {
+      "$ref": "https://contracts.tonbo.dev/agents/kubernetes-profiles-v1.schema.json#/$defs/request"
+    }
+  }
+};
+var kubernetesProfilesSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/kubernetes-profiles-v1.schema.json",
+  "title": "Tonbo managed Kubernetes profiles v1",
+  "$defs": {
+    "request": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "profile"
+      ],
+      "properties": {
+        "profile": false
+      }
+    }
+  },
+  "x-tonbo-profiles": {}
+};
+var declarationSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/tonbo-declaration-v2.schema.json",
+  "title": "Tonbo Agent declaration v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "harness"
+  ],
+  "properties": {
+    "version": {
+      "const": 2
+    },
+    "inference": {
+      "type": "object",
+      "additionalProperties": false,
+      "default": {
+        "model": "claude-sonnet-4-5"
+      },
+      "required": [
+        "model"
+      ],
+      "properties": {
+        "model": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 160
+        }
+      }
+    },
+    "build": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "command"
+      ],
+      "properties": {
+        "command": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1024
+          }
+        }
+      }
+    },
+    "service": {
+      "$ref": "https://contracts.tonbo.dev/agents/project-service-v1.schema.json"
+    },
+    "agent": {
+      "$ref": "https://contracts.tonbo.dev/agents/project-name-v1.json#/$defs/publicHostname"
+    },
+    "harness": {
+      "$ref": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json"
+    }
+  }
+};
+var deploymentSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/managed-deployment-v1.schema.json",
+  "title": "Managed Project Deployment v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "agent",
+    "source",
+    "inference"
+  ],
+  "properties": {
+    "version": {
+      "const": 1
+    },
+    "agent": {
+      "$ref": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json"
+    },
+    "source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "format",
+        "sha256",
+        "size_bytes"
+      ],
+      "properties": {
+        "format": {
+          "const": "tar-v1"
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "size_bytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 67108864
+        }
+      }
+    },
+    "inference": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "model"
+      ],
+      "properties": {
+        "model": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 160
+        }
+      }
+    },
+    "service": {
+      "$ref": "https://contracts.tonbo.dev/agents/project-service-v1.schema.json"
+    }
+  }
+};
+var sourceBundleContract = {
+  "version": 1,
+  "format": "tar-v1",
+  "bucket": "agent-source-bundles",
+  "content_type": "application/vnd.tonbo.source+tar",
+  "max_bytes": 67108864
+};
+var piSessionContract = {
+  "version": 1,
+  "adapter": "pi-jsonl-v3",
+  "format_version": 3,
+  "durable_completion_timeout_seconds": 30,
+  "session_directory": "/sessions",
+  "path_template": "/sessions/{session_id}.jsonl",
+  "preflight_command": [
+    "/usr/local/bin/artifacts",
+    "runtime",
+    "session-preflight"
+  ]
+};
+var projectNameContract = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/project-name-v1.json",
+  "x-tonbo-version": 1,
+  "x-tonbo-public-hostname-apex": "tonbo.sh",
+  "x-tonbo-public-hostname-template": "<project>-<organization>.tonbo.sh",
+  "$defs": {
+    "name": {
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 40,
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",
+      "not": {
+        "enum": [
+          "api",
+          "artifacts",
+          "auth",
+          "inference",
+          "network-health",
+          "sandbox-control",
+          "status",
+          "streams",
+          "www"
+        ]
+      }
+    },
+    "publicHostname": {
+      "type": "string",
+      "minLength": 16,
+      "maxLength": 72,
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)+\\.tonbo\\.sh$",
+      "not": {
+        "enum": [
+          "api.tonbo.sh",
+          "artifacts.tonbo.sh",
+          "auth.tonbo.sh",
+          "inference.tonbo.sh",
+          "network-health.tonbo.sh",
+          "sandbox-control.tonbo.sh",
+          "status.tonbo.sh",
+          "streams.tonbo.sh",
+          "www.tonbo.sh"
+        ]
+      }
+    }
+  }
+};
+
+// src/contracts.ts
+var ajv = new Ajv2020({ allErrors: true, useDefaults: true });
+ajv.addKeyword({ keyword: "x-tonbo-profiles" });
+ajv.addKeyword({ keyword: "x-tonbo-version" });
+ajv.addKeyword({ keyword: "x-tonbo-public-hostname-apex" });
+ajv.addKeyword({ keyword: "x-tonbo-public-hostname-template" });
+ajv.addSchema(kubernetesProfilesSchema);
+ajv.addSchema(piAgentSchema);
+ajv.addSchema(projectNameContract);
+ajv.addSchema(projectServiceSchema);
+var validateDeclaration = ajv.compile(declarationSchema);
+var validateDeploymentSpec = ajv.compile(deploymentSchema);
+function validationMessage(label, errors) {
+  const detail = errors?.map((error) => `${error.instancePath || "/"} ${error.message}`).join("; ");
+  return `${label} is invalid${detail ? `: ${detail}` : "."}`;
+}
+function parseDeclaration(value) {
+  const candidate = structuredClone(value);
+  if (!validateDeclaration(candidate)) {
+    throw new Error(validationMessage(".tonbo TOML", validateDeclaration.errors));
+  }
+  return candidate;
+}
+function assertManagedDeploymentSpec(value) {
+  if (!validateDeploymentSpec(value)) {
+    throw new Error(validationMessage("Managed Deployment spec", validateDeploymentSpec.errors));
+  }
+}
+
+// src/declaration.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { lstat as lstat2, open, readFile as readFile2, rename, rm } from "node:fs/promises";
+import path2 from "node:path";
+import { parse, stringify } from "smol-toml";
+var DECLARATION_FILENAME = ".tonbo";
+var DEFAULT_INFERENCE_MODEL = "claude-sonnet-4-5";
+function createDeclaration(model = DEFAULT_INFERENCE_MODEL, driver = { kind: "native" }, buildCommand, projectHostname) {
+  return parseDeclaration({
+    version: 2,
+    ...projectHostname ? { agent: projectHostname } : {},
+    harness: { runtime: "pi", driver },
+    inference: { model: model.trim() },
+    ...buildCommand ? { build: { command: buildCommand } } : {}
+  });
+}
+function renderDeclaration(declaration) {
+  return `# Tonbo Agent configuration.
+# Edit this file directly or run \`tonbo init\` to reconfigure.
+${stringify(declaration)}`;
+}
+async function bindDeclarationProject(root, projectHostname) {
+  const declaration = await loadDeclaration(root);
+  const bound = parseDeclaration({ ...declaration, agent: projectHostname });
+  await saveDeclaration(root, bound, true);
+  return bound;
+}
+async function declarationExists(root) {
+  const filename = path2.join(root, DECLARATION_FILENAME);
+  try {
+    const metadata = await lstat2(filename);
+    if (metadata.isSymbolicLink() || !metadata.isFile())
+      throw new Error(`${filename} must be a regular file.`);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function saveDeclaration(root, declaration, overwrite) {
+  const filename = path2.join(root, DECLARATION_FILENAME);
+  const exists = await declarationExists(root);
+  if (exists && !overwrite)
+    throw new Error(`${DECLARATION_FILENAME} already exists. Pass --force to replace it.`);
+  const contents = renderDeclaration(declaration);
+  if (!overwrite) {
+    const handle2 = await open(filename, "wx", 420).catch((error) => {
+      if (error.code === "EEXIST")
+        throw new Error(`${DECLARATION_FILENAME} already exists. Pass --force to replace it.`);
+      throw error;
+    });
+    try {
+      await handle2.writeFile(contents, "utf8");
+      await handle2.sync();
+    } finally {
+      await handle2.close();
+    }
+    return;
+  }
+  const temporary = path2.join(root, `.${DECLARATION_FILENAME}.${process.pid}.${randomUUID2()}.tmp`);
+  let handle;
+  try {
+    handle = await open(temporary, "wx", 420);
+    await handle.writeFile(contents, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await rename(temporary, filename);
+  } catch (error) {
+    await handle?.close().catch(() => void 0);
+    await rm(temporary, { force: true }).catch(() => void 0);
+    throw error;
+  }
+}
+async function loadDeclaration(declarationRoot) {
+  const filename = path2.join(declarationRoot, DECLARATION_FILENAME);
+  let parsed;
+  try {
+    parsed = parse(await readFile2(filename, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT")
+      throw new Error(`No ${DECLARATION_FILENAME} declaration found at ${filename}.`);
+    throw new Error(`Could not read ${filename} as TOML.`, { cause: error });
+  }
+  return parseDeclaration(parsed);
+}
+function buildDeploymentSpec(declaration, source) {
+  const spec = {
+    version: 1,
+    agent: declaration.harness,
+    source: {
+      format: source.format,
+      sha256: source.sha256,
+      size_bytes: source.size_bytes
+    },
+    inference: declaration.inference,
+    ...declaration.service ? { service: declaration.service } : {}
+  };
+  assertManagedDeploymentSpec(spec);
+  return spec;
+}
+
+// src/source.ts
+import { createHash as createHash2 } from "node:crypto";
+import { lstat as lstat3, readFile as readFile3, readdir } from "node:fs/promises";
+import path3 from "node:path";
+import ignore from "ignore";
+import tar from "tar-stream";
+var MAX_BUNDLE_BYTES = sourceBundleContract.max_bytes;
+var SESSION_SOURCE_DIRECTORY = piSessionContract.session_directory.replace(/^\/+|\/+$/g, "");
+var DEFAULT_IGNORES = [
+  ".git/",
+  "node_modules/",
+  ".DS_Store",
+  ".env",
+  ".env.*",
+  "!.env.example",
+  ".tonbo-cache/",
+  ".tonbo-system/",
+  ".pi/npm/",
+  ".pi/git/"
+];
+var EXACT_NPM_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var GIT_COMMIT = /^[0-9a-f]{40}$/i;
+function packageSource(value, index) {
+  if (typeof value === "string") return value;
+  if (value && typeof value === "object" && "source" in value && typeof value.source === "string")
+    return value.source;
+  throw new Error(`.pi/settings.json packages[${index}] must be a source string or object.`);
+}
+async function validatePackageSource(root, source) {
+  if (source.startsWith("npm:")) {
+    const specifier = source.slice(4);
+    const separator = specifier.lastIndexOf("@");
+    if (separator <= 0 || !EXACT_NPM_VERSION.test(specifier.slice(separator + 1))) {
+      throw new Error(
+        `PI package ${source} must pin an exact npm version, for example npm:my-agent@1.2.3.`
+      );
+    }
+    return;
+  }
+  if (source.startsWith("git:")) {
+    const separator = source.lastIndexOf("@");
+    if (separator <= "git:".length || !GIT_COMMIT.test(source.slice(separator + 1))) {
+      throw new Error(`PI package ${source} must pin a full 40-character Git commit.`);
+    }
+    return;
+  }
+  if (source.startsWith("./") || source.startsWith("../")) {
+    const settingsDirectory = path3.join(root, ".pi");
+    const resolved = path3.resolve(settingsDirectory, source);
+    const relative = path3.relative(root, resolved);
+    if (relative === ".." || relative.startsWith(`..${path3.sep}`) || path3.isAbsolute(relative)) {
+      throw new Error(`Local PI package ${source} resolves outside the deployed project.`);
+    }
+    let metadata;
+    try {
+      metadata = await lstat3(resolved);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        throw new Error(`Local PI package ${source} does not exist.`);
+      }
+      throw error;
+    }
+    if (!metadata.isDirectory() || metadata.isSymbolicLink()) {
+      throw new Error(`Local PI package ${source} must resolve to a real project directory.`);
+    }
+    return;
+  }
+  throw new Error(
+    `PI package ${source} must use an exact npm version, a full Git commit, or a project-local path.`
+  );
+}
+async function validatePiPackages(root) {
+  const filename = path3.join(root, ".pi", "settings.json");
+  let settings;
+  try {
+    settings = JSON.parse(await readFile3(filename, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw new Error(`Could not read ${filename} as JSON.`, { cause: error });
+  }
+  if (!settings || typeof settings !== "object" || !("packages" in settings)) return;
+  const packages = settings.packages;
+  if (!Array.isArray(packages)) throw new Error(`${filename} packages must be an array.`);
+  await Promise.all(
+    packages.map((value, index) => validatePackageSource(root, packageSource(value, index)))
+  );
+}
+async function findDeclarationRoot(start) {
+  let candidate = path3.resolve(start);
+  for (; ; ) {
+    try {
+      if ((await lstat3(path3.join(candidate, ".tonbo"))).isFile()) return candidate;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const parent = path3.dirname(candidate);
+    if (parent === candidate) {
+      throw new Error(`No .tonbo declaration found above ${path3.resolve(start)}.`);
+    }
+    candidate = parent;
+  }
+}
+async function sourceIgnore(root) {
+  const matcher = ignore().add(DEFAULT_IGNORES);
+  try {
+    matcher.add(await readFile3(path3.join(root, ".tonboignore"), "utf8"));
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  return matcher;
+}
+async function collectFiles(root) {
+  const matcher = await sourceIgnore(root);
+  const files = [];
+  async function visit(directory, relativeDirectory) {
+    const entries = await readdir(directory, { withFileTypes: true });
+    entries.sort((left, right) => left.name.localeCompare(right.name, "en"));
+    for (const entry of entries) {
+      const relative = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
+      const ignored = matcher.ignores(relative + (entry.isDirectory() ? "/" : ""));
+      if (ignored) continue;
+      if (relative === SESSION_SOURCE_DIRECTORY || relative.startsWith(`${SESSION_SOURCE_DIRECTORY}/`)) {
+        throw new Error(
+          `Source path ${SESSION_SOURCE_DIRECTORY}/ is reserved for durable PI history. Rename it or exclude it with .tonboignore.`
+        );
+      }
+      const absolute = path3.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        await visit(absolute, relative);
+        continue;
+      }
+      const metadata = await lstat3(absolute);
+      if (!metadata.isFile()) {
+        throw new Error(
+          `Source path ${relative} is not a regular file. V1 does not follow symlinks or special files.`
+        );
+      }
+      files.push({
+        absolute,
+        mode: metadata.mode & 73 ? 493 : 420,
+        relative,
+        size: metadata.size
+      });
+    }
+  }
+  await visit(root, "");
+  if (!files.some((file) => file.relative === ".tonbo")) {
+    throw new Error("The source bundle must contain .tonbo.");
+  }
+  return files;
+}
+function addEntry(pack, file, contents) {
+  return new Promise((resolve, reject) => {
+    pack.entry(
+      {
+        gid: 0,
+        mode: file.mode,
+        mtime: /* @__PURE__ */ new Date(0),
+        name: file.relative,
+        size: contents.length,
+        type: "file",
+        uid: 0
+      },
+      contents,
+      (error) => error ? reject(error) : resolve()
+    );
+  });
+}
+async function buildSourceBundle(root) {
+  const resolvedRoot = path3.resolve(root);
+  await validatePiPackages(resolvedRoot);
+  const files = await collectFiles(resolvedRoot);
+  const payloadBytes = files.reduce((total, file) => total + file.size, 0);
+  if (payloadBytes > MAX_BUNDLE_BYTES) {
+    throw new Error(`Source files exceed ${MAX_BUNDLE_BYTES} bytes after ignore rules.`);
+  }
+  const pack = tar.pack();
+  const chunks = [];
+  let size = 0;
+  pack.on("data", (chunk) => {
+    size += chunk.length;
+    if (size > MAX_BUNDLE_BYTES) {
+      pack.destroy(
+        new Error(`Source bundle exceeds ${MAX_BUNDLE_BYTES} bytes after ignore rules.`)
+      );
+      return;
+    }
+    chunks.push(chunk);
+  });
+  const completed = new Promise((resolve, reject) => {
+    pack.on("end", resolve);
+    pack.on("error", reject);
+  });
+  for (const file of files) {
+    await addEntry(pack, file, await readFile3(file.absolute));
+  }
+  pack.finalize();
+  await completed;
+  const bytes = Buffer.concat(chunks);
+  return {
+    bytes,
+    format: sourceBundleContract.format,
+    root: resolvedRoot,
+    sha256: createHash2("sha256").update(bytes).digest("hex"),
+    size_bytes: bytes.length
+  };
+}
+
+// src/ssh-key.ts
+import { createHash as createHash3 } from "node:crypto";
+import { readFile as readFile4 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+var DEFAULT_PUBLIC_KEYS = ["id_ed25519.pub", "id_ecdsa.pub", "id_rsa.pub"];
+var ALGORITHMS = /* @__PURE__ */ new Set(["ssh-ed25519", "ecdsa-sha2-nistp256", "ssh-rsa"]);
+function parseOpenSshPublicKey(value, label) {
+  const fields = value.trim().split(/\s+/);
+  if (fields.length < 2 || !ALGORITHMS.has(fields[0]))
+    throw new Error("SSH public key must be Ed25519, ECDSA P-256, or RSA.");
+  const blob = Buffer.from(fields[1], "base64");
+  if (blob.length < 32 || blob.length > 16384 || blob.toString("base64") !== fields[1])
+    throw new Error("SSH public key is not canonical base64.");
+  return {
+    algorithm: fields[0],
+    fingerprint: `SHA256:${createHash3("sha256").update(blob).digest("base64").replace(/=$/, "")}`,
+    keyBase64: fields[1],
+    label
+  };
+}
+async function readSshPublicKey(path6) {
+  return parseOpenSshPublicKey(await readFile4(path6, "utf8"), basename(path6, ".pub"));
+}
+async function readDefaultSshPublicKeys(sshDirectory = join(homedir(), ".ssh")) {
+  const keys = [];
+  for (const name of DEFAULT_PUBLIC_KEYS) {
+    const key = await readSshPublicKey(join(sshDirectory, name)).catch(
+      (error) => {
+        if (error.code === "ENOENT") return null;
+        throw error;
+      }
+    );
+    if (key) keys.push(key);
+  }
+  return keys;
+}
+
+// src/project-name.ts
+var PROJECT_NAME_RULE = projectNameContract.$defs.name;
+var PROJECT_NAME_PATTERN = new RegExp(PROJECT_NAME_RULE.pattern);
+var RESERVED_PROJECT_NAMES = new Set(PROJECT_NAME_RULE.not.enum);
+function validateProjectName(name) {
+  const valid = name.length >= PROJECT_NAME_RULE.minLength && name.length <= PROJECT_NAME_RULE.maxLength && PROJECT_NAME_PATTERN.test(name) && !RESERVED_PROJECT_NAMES.has(name);
+  if (!valid) {
+    throw new Error(
+      `Project name must be ${PROJECT_NAME_RULE.minLength}-${PROJECT_NAME_RULE.maxLength} lowercase letters, digits, or single hyphens, start with a letter, and not be reserved.`
+    );
+  }
+}
+function projectNameSuggestion(value) {
+  let name = value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-+/g, "-");
+  if (!/^[a-z]/.test(name)) name = `agent-${name}`;
+  name = name.slice(0, PROJECT_NAME_RULE.maxLength).replace(/-+$/g, "");
+  if (name.length < PROJECT_NAME_RULE.minLength) {
+    name = `${name || "agent"}-agent`.slice(0, PROJECT_NAME_RULE.maxLength);
+  }
+  if (RESERVED_PROJECT_NAMES.has(name)) name = `${name}-agent`;
+  return name;
+}
+
+// src/commands.ts
+async function resolveProject(deps) {
+  const root = await findDeclarationRoot(deps.cwd());
+  const declaration = await loadDeclaration(root);
+  if (!declaration.agent) {
+    throw new Error("No Project is configured in .tonbo. Run `tonbo project use <project>` first.");
+  }
+  const oauthToken = await deps.auth.accessToken();
+  return {
+    declaration,
+    oauthToken,
+    project: selectProject(await deps.api.listProjects(oauthToken), declaration.agent),
+    root
+  };
+}
+function selectProject(projects, selector) {
+  const normalized = selector.toLowerCase();
+  const matches = projects.filter(
+    (project) => project.id === selector || project.name === normalized || project.publicHostname === normalized
+  );
+  if (matches.length === 0) throw new Error(`Project ${selector} was not found in your account.`);
+  if (matches.length > 1)
+    throw new Error(`Project name ${selector} is ambiguous; use its full hostname or ID.`);
+  if (matches[0].status !== "active") throw new Error(`Project ${selector} is not active.`);
+  return matches[0];
+}
+async function initCommand(deps, options) {
+  const root = deps.cwd();
+  const exists = await declarationExists(root);
+  let existingDeclaration;
+  if (exists) {
+    existingDeclaration = await loadDeclaration(root).catch(() => void 0);
+  }
+  const interactive = deps.interactive();
+  const overwrite = options.force === true || exists && interactive;
+  if (exists && !overwrite)
+    throw new Error(`${DECLARATION_FILENAME} already exists. Pass --force to replace it.`);
+  const inspection = await deps.inspectSource(root);
+  let harness = options.harness ?? (existingDeclaration ? "pi" : void 0);
+  if (harness !== void 0 && harness !== "pi") {
+    throw new Error("--harness must name a supported Harness: pi.");
+  }
+  let driver = options.driver ?? existingDeclaration?.harness.driver.kind;
+  if (driver !== void 0 && driver !== "native" && driver !== "command") {
+    throw new Error("--driver must be native or command.");
+  }
+  if (!harness) {
+    if (inspection.harness.state === "identified") harness = inspection.harness.id;
+    else if (!interactive) {
+      throw new Error("No Harness-specific configuration found. Pass --harness pi.");
+    } else {
+      deps.output({
+        message: "No Harness-specific configuration was found in this project."
+      });
+      harness = await selectHarness(deps);
+    }
+  }
+  if (!driver) {
+    if (!interactive) {
+      throw new Error("PI execution mode is required. Pass --driver native or --driver command.");
+    }
+    if (inspection.pi.settingsFound) {
+      const packageSummary = inspection.pi.packageCount === 0 ? "Found PI configuration at .pi/settings.json." : `Found PI configuration at .pi/settings.json with ${inspection.pi.packageCount} package${inspection.pi.packageCount === 1 ? "" : "s"}.`;
+      deps.output({ message: packageSummary });
+    }
+    driver = "native";
+  }
+  if (driver === "native" && (options.agentEntry || options.buildCommand)) {
+    throw new Error("--agent-entry and --build-command require --driver command.");
+  }
+  const existingEntry = existingDeclaration?.harness.driver.kind === "command" && existingDeclaration.harness.driver.command[0] === "node" ? existingDeclaration.harness.driver.command[1] : void 0;
+  let entry = options.agentEntry?.trim() || existingEntry;
+  if (driver === "command" && !entry && interactive) {
+    entry = (await deps.prompt("PI SDK entry file [dist/agent.mjs]: ")).trim();
+  }
+  entry ||= "dist/agent.mjs";
+  let model = options.model?.trim() || existingDeclaration?.inference.model || DEFAULT_INFERENCE_MODEL;
+  let buildCommand = driver === "command" ? options.buildCommand ?? existingDeclaration?.build?.command ?? ["npm", "run", "build"] : void 0;
+  let projectPlan = existingDeclaration?.agent ? {
+    kind: "existing",
+    publicHostname: existingDeclaration.agent
+  } : { kind: "later" };
+  if (interactive && !existingDeclaration?.agent) {
+    projectPlan = await selectInitProject(deps, root);
+  }
+  if (interactive) {
+    while (true) {
+      deps.output({
+        message: renderInitSummary(projectPlan, harness, driver, model, entry, buildCommand)
+      });
+      const saveLabel = initSaveLabel(exists, projectPlan);
+      const action = await deps.select(`${saveLabel} with this configuration?`, [
+        {
+          name: saveLabel,
+          value: "save"
+        },
+        {
+          description: "Change the project, Harness, execution mode, model, or SDK entrypoint.",
+          name: "Edit configuration",
+          value: "edit"
+        },
+        { name: "Cancel", value: "cancel" }
+      ]);
+      if (action === "cancel") {
+        deps.output({
+          message: exists ? `Cancelled. Kept existing ${DECLARATION_FILENAME}.` : `Cancelled. Did not create ${DECLARATION_FILENAME}.`
+        });
+        return;
+      }
+      if (action === "save") break;
+      const setting = await deps.select("What would you like to change?", [
+        {
+          description: initProjectSummary(projectPlan),
+          name: "Project",
+          value: "project"
+        },
+        { description: harnessName(harness), name: "Harness", value: "harness" },
+        {
+          description: driver === "native" ? "PI CLI (`pi`)" : "PI SDK app",
+          name: "Execution mode",
+          value: "driver"
+        },
+        { description: model, name: "Inference model", value: "model" },
+        ...driver === "command" ? [{ description: entry, name: "PI SDK entry file", value: "entry" }] : [],
+        { name: "Back to review", value: "back" }
+      ]);
+      if (setting === "project") projectPlan = await selectInitProject(deps, root);
+      if (setting === "harness") harness = await selectHarness(deps);
+      if (setting === "driver") {
+        driver = await deps.select(
+          "How should Tonbo start PI?",
+          piTargetChoices(inspection.pi.settingsFound)
+        );
+        if (driver === "command") {
+          const answer = (await deps.prompt(`PI SDK entry file [${entry}]: `)).trim();
+          if (answer) entry = answer;
+          buildCommand = options.buildCommand ?? ["npm", "run", "build"];
+        } else {
+          buildCommand = void 0;
+        }
+      }
+      if (setting === "model") {
+        const answer = (await deps.prompt(`Inference model [${model}]: `)).trim();
+        if (answer) model = answer;
+      }
+      if (setting === "entry") {
+        const answer = (await deps.prompt(`PI SDK entry file [${entry}]: `)).trim();
+        if (answer) entry = answer;
+      }
+    }
+  }
+  let projectHostname = projectPlan.kind === "existing" ? projectPlan.publicHostname : void 0;
+  let createdProject;
+  if (projectPlan.kind === "create") {
+    const oauthToken = await deps.auth.accessToken();
+    createdProject = await deps.api.createProject(
+      oauthToken,
+      projectPlan.name,
+      projectPlan.organizationId
+    );
+    projectHostname = createdProject.publicHostname;
+  }
+  const configuredDeclaration = createDeclaration(
+    model,
+    driver === "native" ? { kind: "native" } : { kind: "command", protocol: "pi-rpc-v1", command: ["node", entry] },
+    buildCommand,
+    projectHostname
+  );
+  const declaration = parseDeclaration({
+    ...configuredDeclaration,
+    harness: {
+      ...configuredDeclaration.harness,
+      ...existingDeclaration?.harness.secrets ? { secrets: existingDeclaration.harness.secrets } : {}
+    },
+    ...existingDeclaration?.service ? { service: existingDeclaration.service } : {}
+  });
+  try {
+    await saveDeclaration(root, declaration, overwrite);
+  } catch (error) {
+    if (createdProject) {
+      throw new Error(
+        `Created project ${createdProject.name}, but could not write ${DECLARATION_FILENAME}. Fix the file and run \`tonbo project use ${createdProject.publicHostname}\`.`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+  const driverSummary = driver === "command" ? `PI SDK app
+Build: ${buildCommand?.join(" ")}
+Entrypoint: node ${entry}` : inspection.pi.packageCount > 0 ? `PI CLI with ${inspection.pi.packageCount} package${inspection.pi.packageCount === 1 ? "" : "s"}` : "PI CLI";
+  const projectSummary = createdProject ? `Project: ${createdProject.name} (${createdProject.publicHostname})
+Organization: ${createdProject.organizationName}
+Application: https://${createdProject.publicHostname}
+SSH after deploy: ssh ${createdProject.sshDestination}` : projectPlan.kind === "existing" ? `Project: ${projectPlan.name ? `${projectPlan.name} (${projectPlan.publicHostname})` : projectPlan.publicHostname}${projectPlan.organizationName ? `
+Organization: ${projectPlan.organizationName}` : ""}${projectPlan.sshDestination ? `
+SSH after deploy: ssh ${projectPlan.sshDestination}` : ""}` : "Next: tonbo project create <name>";
+  deps.output({
+    message: `${createdProject ? `Created project ${createdProject.name} and` : exists ? "Updated" : "Created"} ${DECLARATION_FILENAME}.
+${projectSummary}
+Harness: PI
+Mode: ${driverSummary}${projectPlan.kind === "later" ? "" : "\nNext: tonbo deploy"}`,
+    declaration,
+    path: path4.join(root, DECLARATION_FILENAME)
+  });
+}
+function initSaveLabel(exists, project) {
+  if (project.kind === "create") {
+    return exists ? `Create project and replace ${DECLARATION_FILENAME}` : `Create project and ${DECLARATION_FILENAME}`;
+  }
+  return exists ? `Replace ${DECLARATION_FILENAME}` : `Create ${DECLARATION_FILENAME}`;
+}
+async function selectInitProject(deps, root) {
+  for (; ; ) {
+    const action = await deps.select("How should this Agent connect to Tonbo?", [
+      {
+        description: "Create it only after you confirm the complete configuration.",
+        name: "Create a new project",
+        value: "create"
+      },
+      {
+        description: "Bind this source tree to one project you can access.",
+        name: "Use an existing project",
+        value: "existing"
+      },
+      {
+        description: "Write an unbound declaration and configure its project later.",
+        name: "Set up later",
+        value: "later"
+      }
+    ]);
+    if (action === "later") return { kind: "later" };
+    if (action === "create") {
+      const organization = await selectInitOrganization(deps);
+      const defaultName = projectNameSuggestion(path4.basename(root)) || "tonbo-agent";
+      for (; ; ) {
+        const answer = (await deps.prompt(`Project name [${defaultName}]: `)).trim().toLowerCase();
+        const name = answer || defaultName;
+        try {
+          validateProjectName(name);
+          return {
+            kind: "create",
+            name,
+            organizationId: organization?.id,
+            organizationName: organization?.name
+          };
+        } catch (error) {
+          deps.output({
+            message: error instanceof Error ? error.message : "Project name is invalid."
+          });
+        }
+      }
+    }
+    const oauthToken = await deps.auth.accessToken();
+    const projects = (await deps.api.listProjects(oauthToken)).filter(
+      (project2) => project2.status === "active"
+    );
+    if (projects.length === 0) {
+      deps.output({ message: "No active projects are available. Create a new project instead." });
+      continue;
+    }
+    const id = await deps.select(
+      "Which project should this Agent use?",
+      projects.map((project2) => ({
+        name: project2.name,
+        description: `Organization: ${project2.organizationName} \xB7 ${project2.publicHostname} \xB7 ${project2.id}`,
+        value: project2.id
+      }))
+    );
+    const project = selectProject(projects, id);
+    return {
+      kind: "existing",
+      name: project.name,
+      organizationName: project.organizationName,
+      publicHostname: project.publicHostname,
+      sshDestination: project.sshDestination
+    };
+  }
+}
+function initProjectSummary(project) {
+  if (project.kind === "create")
+    return `Create ${project.name}${project.organizationName ? ` in ${project.organizationName}` : ""} (permanent address assigned after creation)`;
+  if (project.kind === "existing") {
+    return project.name ? `${project.name}${project.organizationName ? ` in ${project.organizationName}` : ""} (${project.publicHostname})` : `Keep ${project.publicHostname}`;
+  }
+  return "Set up later";
+}
+async function selectInitOrganization(deps) {
+  const oauthToken = await deps.auth.accessToken();
+  const organizations = (await deps.api.listOrganizations(oauthToken)).filter(
+    (organization) => organization.role !== "member"
+  );
+  if (organizations.length === 0)
+    throw new Error("No organization lets you create a project. Ask an admin or owner.");
+  if (organizations.length === 1) return organizations[0];
+  const id = await deps.select(
+    "Which organization should own the new project?",
+    organizations.map((organization) => ({
+      description: organization.role,
+      name: organization.name,
+      value: organization.id
+    }))
+  );
+  return organizations.find((organization) => organization.id === id) ?? organizations[0];
+}
+async function selectHarness(deps) {
+  return await deps.select(
+    "Which supported Harness should Tonbo use?",
+    supportedHarnesses.map((supported) => ({
+      description: `Run this project with the ${supported.command} command.`,
+      name: `${supported.name} (\`${supported.command}\`)`,
+      value: supported.id
+    }))
+  );
+}
+function harnessName(harness) {
+  const supported = supportedHarnesses.find((candidate) => candidate.id === harness);
+  return supported?.name ?? harness;
+}
+function renderInitSummary(project, harness, driver, model, entry, buildCommand) {
+  const lines = [
+    "",
+    "Tonbo Agent configuration:",
+    `  Project:       ${initProjectSummary(project)}`,
+    `  Harness:       ${harnessName(harness)}`,
+    `  Execution:     ${driver === "native" ? "PI CLI (`pi`)" : "PI SDK app"}`,
+    `  Model:         ${model}`
+  ];
+  if (driver === "command") {
+    lines.push(`  Build:         ${buildCommand?.join(" ") ?? "none"}`);
+    lines.push(`  Entrypoint:    node ${entry}`);
+  }
+  return lines.join("\n");
+}
+function piTargetChoices(settingsFound) {
+  const choices = {
+    command: {
+      description: "Run a custom Node.js entrypoint built on the PI SDK.",
+      name: "PI SDK app",
+      value: "command"
+    },
+    native: {
+      description: settingsFound ? "Run pi directly and load the detected project-local PI configuration." : "Run pi directly with AGENTS.md and optional project-local .pi resources.",
+      name: "PI CLI (`pi`)",
+      value: "native"
+    }
+  };
+  return supportedExecutionTargets.filter((target) => target.harness === "pi").map((target) => choices[target.driver]);
+}
+async function loginCommand(deps) {
+  try {
+    const tokens = await deps.auth.login((event) => reportLoginProgress(deps.progress, event));
+    deps.progress.start("Preparing SSH access");
+    const keys = await deps.defaultSshPublicKeys();
+    await Promise.all(keys.map((key) => deps.api.registerSshKey(tokens.access_token, key)));
+    deps.progress.succeed("SSH access ready");
+    deps.output({ message: "Logged in to Tonbo." });
+  } catch (error) {
+    deps.progress.fail();
+    throw error;
+  }
+}
+var LOGIN_PROGRESS_MESSAGES = {
+  "account-config": {
+    started: "Connecting to Tonbo",
+    completed: "Connected to Tonbo"
+  },
+  "callback-server": {
+    started: "Starting local browser callback",
+    completed: "Local browser callback ready"
+  },
+  browser: {
+    started: "Opening browser",
+    completed: "Browser opened"
+  },
+  "browser-authorization": {
+    started: "Waiting for browser authorization",
+    completed: "Browser authorization received"
+  },
+  "callback-close": {
+    started: "Closing local browser callback",
+    completed: "Local browser callback closed"
+  },
+  "token-exchange": {
+    started: "Exchanging authorization code",
+    completed: "Authorization code exchanged"
+  },
+  "credential-store": {
+    started: "Saving login session",
+    completed: "Login session saved"
+  }
+};
+function reportLoginProgress(progress, event) {
+  const messages = LOGIN_PROGRESS_MESSAGES[event.step];
+  if (event.status === "started") progress.start(messages.started);
+  else progress.succeed(messages.completed);
+}
+async function sshKeyAddCommand(deps, path6) {
+  const key = await readSshPublicKey(path6);
+  const oauthToken = await deps.auth.accessToken();
+  await deps.api.registerSshKey(oauthToken, key);
+  deps.output({ message: `Registered SSH key ${key.fingerprint}.`, key });
+}
+async function sshKeyRemoveCommand(deps, fingerprint) {
+  const oauthToken = await deps.auth.accessToken();
+  const key = await deps.api.revokeSshKey(oauthToken, fingerprint);
+  deps.output({ message: `Revoked SSH key ${key.fingerprint}.`, key });
+}
+async function projectUseCommand(deps, selector, force = false) {
+  const root = await findDeclarationRoot(deps.cwd());
+  const declaration = await loadDeclaration(root);
+  const oauthToken = await deps.auth.accessToken();
+  const projects = await deps.api.listProjects(oauthToken);
+  const project = selectProject(projects, selector);
+  if (declaration.agent === project.publicHostname) {
+    deps.output({ message: `.tonbo already uses project ${project.publicHostname}.`, project });
+    return;
+  }
+  if (declaration.agent && !force) {
+    const current = projects.find((candidate) => candidate.publicHostname === declaration.agent);
+    const currentLabel = current?.publicHostname ?? declaration.agent;
+    if (!deps.interactive()) {
+      throw new Error(
+        `.tonbo already uses project ${currentLabel}. Pass --force to rebind it to ${project.publicHostname}.`
+      );
+    }
+    const action = await deps.select(
+      `Rebind .tonbo from ${currentLabel} to ${project.publicHostname}?`,
+      [
+        { name: `Rebind to ${project.publicHostname}`, value: "rebind" },
+        { name: "Cancel", value: "cancel" }
+      ]
+    );
+    if (action !== "rebind") {
+      deps.output({ message: `Cancelled. .tonbo still uses project ${currentLabel}.` });
+      return;
+    }
+  }
+  await bindDeclarationProject(root, project.publicHostname);
+  deps.output({ message: `Bound .tonbo to project ${project.publicHostname}.`, project });
+}
+async function projectCreateCommand(deps, name) {
+  const root = await findDeclarationRoot(deps.cwd());
+  const declaration = await loadDeclaration(root);
+  if (declaration.agent) {
+    throw new Error(
+      `.tonbo is already bound to project ${declaration.agent}. Run \`tonbo project use <project>\` to review a rebind.`
+    );
+  }
+  const oauthToken = await deps.auth.accessToken();
+  validateProjectName(name);
+  const project = await deps.api.createProject(oauthToken, name);
+  try {
+    await bindDeclarationProject(root, project.publicHostname);
+  } catch (error) {
+    throw new Error(
+      `Created project ${project.name}, but could not bind ${DECLARATION_FILENAME}. Fix the file and run \`tonbo project use ${project.publicHostname}\`.`,
+      { cause: error }
+    );
+  }
+  deps.output({ message: `Created project ${project.name} and bound it in .tonbo.`, project });
+}
+async function deployCommand(deps, options = { promote: true }) {
+  const { declaration, oauthToken, project, root } = await resolveProject(deps);
+  if (declaration.build) await runBuildCommand(root, declaration.build.command);
+  const source = await buildSourceBundle(root);
+  const origin = { actor: "cli", git: await deps.gitProvenance(root) };
+  const managementToken = await deps.api.exchangeManagementToken(oauthToken, project.id);
+  const result = await deps.api.deploy({
+    bundle: source,
+    origin,
+    projectId: project.id,
+    promote: options.promote,
+    spec: buildDeploymentSpec(declaration, source),
+    token: managementToken
+  });
+  const { deployment } = result;
+  const shortId = shortDeploymentId(deployment.id);
+  const lines = [
+    options.promote ? `Deployed project ${project.name}.` : `Created Deployment ${deploymentName(deployment)} (${shortId}) for project ${project.name} without promoting it.`,
+    `Organization: ${project.organizationName}`,
+    `Deployment: ${deploymentName(deployment)} (${shortId})`,
+    `Source: ${deploymentSourceLabel(deployment)}`,
+    `Production: ${options.promote ? productionStateLabel(deployment) : `not promoted; run \`tonbo deployments promote ${shortId}\` to move Production here`}`,
+    `Application: https://${project.publicHostname}`
+  ];
+  if (result.unchanged) {
+    lines.push(
+      `Contents are identical to the ${options.promote ? "previous" : "current"} Production Deployment; the running Agent does not change.`
+    );
+  }
+  if (options.promote) {
+    lines.push(
+      "",
+      "Agent process: starts with the first turn and stays warm while the runtime is active.",
+      "",
+      "Start the Agent:",
+      '  tonbo run "<prompt>"',
+      "",
+      "Connect with SSH:",
+      `  ssh ${project.sshDestination}`
+    );
+  }
+  deps.output({ message: lines.join("\n"), project, ...result });
+}
+async function runCommand(deps, prompt, options) {
+  const { oauthToken, project } = await resolveProject(deps);
+  const managementToken = await deps.api.exchangeManagementToken(oauthToken, project.id);
+  const result = await deps.api.run({
+    projectId: project.id,
+    prompt,
+    sessionId: options.session,
+    token: managementToken
+  });
+  deps.output({
+    message: result.turn.assistant_text,
+    project,
+    ...result
+  });
+}
+async function projectShowCommand(deps) {
+  const { project, token } = await projectManagement(deps);
+  const production = await deps.api.getProduction(project.id, token);
+  const deployment = production ? await deps.api.getDeployment(project.id, production.deployment_id, token) : null;
+  const lines = [
+    `project: ${project.name}`,
+    `Organization: ${project.organizationName}`,
+    `application: https://${project.publicHostname}`,
+    `ssh: ssh ${project.sshDestination}`
+  ];
+  if (deployment) {
+    lines.push(
+      `production: ${deploymentName(deployment)} (${shortDeploymentId(deployment.id)}) ${productionStateLabel(deployment)}`
+    );
+  }
+  deps.output({ message: lines.join("\n"), project, production, deployment });
+}
+function shortDeploymentId(id) {
+  return id.replace(/-/g, "").slice(0, 8);
+}
+function deploymentName(deployment) {
+  const subject = deployment.origin.git?.subject?.trim();
+  return subject ? subject : shortDeploymentId(deployment.id);
+}
+function deploymentSourceLabel(deployment) {
+  const git = deployment.origin.git;
+  if (!git) return "tonbo deploy";
+  const sha = git.commit_sha.slice(0, 7);
+  return git.ref ? `${sha} \xB7 ${git.ref}` : sha;
+}
+function productionStateLabel(deployment) {
+  const { generation, state } = deployment.production;
+  return generation === null ? state : `${state} (generation ${generation})`;
+}
+function selectDeployment(deployments, prefix) {
+  const normalized = prefix.trim().toLowerCase().replace(/-/g, "");
+  if (!/^[0-9a-f]+$/.test(normalized)) {
+    throw new Error(`Deployment id ${prefix} must be a hexadecimal id prefix.`);
+  }
+  const matches = deployments.filter(
+    (deployment) => deployment.id.replace(/-/g, "").startsWith(normalized)
+  );
+  if (matches.length === 0) throw new Error(`Deployment ${prefix} was not found in this project.`);
+  if (matches.length > 1) {
+    throw new Error(
+      `Deployment id ${prefix} is ambiguous; it matches ${matches.map((deployment) => shortDeploymentId(deployment.id)).join(", ")}. Use more characters.`
+    );
+  }
+  return matches[0];
+}
+function renderTable(headers, rows) {
+  const widths = headers.map(
+    (header, column) => Math.max(header.length, ...rows.map((row) => row[column].length))
+  );
+  const render = (row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column])).join("  ").trimEnd();
+  return [render(headers), ...rows.map(render)].join("\n");
+}
+function formatTimestamp(value) {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return value;
+  return `${date.toISOString().slice(0, 16)}Z`;
+}
+function productionMarker(state) {
+  if (state === "current") return "\u25CF";
+  if (state === "previous") return "\u25CB";
+  return "";
+}
+async function deploymentsListCommand(deps) {
+  const { project, token } = await projectManagement(deps);
+  const [deployments, production] = await Promise.all([
+    deps.api.listDeployments(project.id, token),
+    deps.api.getProduction(project.id, token)
+  ]);
+  const message = deployments.length ? renderTable(
+    ["ID", "NAME", "STATUS", "PRODUCTION", "SOURCE", "CREATED", "BY"],
+    deployments.map((deployment) => [
+      shortDeploymentId(deployment.id),
+      deploymentName(deployment),
+      deployment.production.state,
+      productionMarker(deployment.production.state),
+      deploymentSourceLabel(deployment),
+      formatTimestamp(deployment.created_at),
+      deployment.created_by_user_id ? shortDeploymentId(deployment.created_by_user_id) : ""
+    ])
+  ) : `No Deployments exist for project ${project.name}. Run \`tonbo deploy\` to create one.`;
+  deps.output({ message, project, production, deployments });
+}
+async function deploymentsShowCommand(deps, prefix) {
+  const { project, token } = await projectManagement(deps);
+  const deployment = selectDeployment(await deps.api.listDeployments(project.id, token), prefix);
+  const rollouts = (await deps.api.listRollouts(project.id, token)).filter(
+    (rollout) => rollout.deployment_id === deployment.id || rollout.previous_deployment_id === deployment.id
+  );
+  deps.output({
+    message: renderDeploymentDetail(deployment, rollouts),
+    project,
+    deployment,
+    rollouts
+  });
+}
+function renderDeploymentDetail(deployment, rollouts) {
+  const git = deployment.origin.git;
+  const source = deployment.spec.source;
+  const bundleLabel = typeof source?.sha256 === "string" ? [
+    typeof source.format === "string" ? source.format : "",
+    source.sha256,
+    typeof source.size_bytes === "number" ? `(${source.size_bytes} bytes)` : ""
+  ].filter(Boolean).join(" ") : null;
+  const inference = deployment.spec.inference;
+  const rows = [
+    ["Deployment", `${deploymentName(deployment)} (${shortDeploymentId(deployment.id)})`],
+    ["ID", deployment.id],
+    ["Status", productionStateLabel(deployment)],
+    ["Source", `${deploymentSourceLabel(deployment)}${git?.dirty ? " (dirty)" : ""}`]
+  ];
+  if (git) rows.push(["Commit", git.commit_sha], ["Author", git.author ?? ""]);
+  rows.push(
+    ["Created", formatTimestamp(deployment.created_at)],
+    ["Created by", deployment.created_by_user_id ?? ""],
+    ["Spec sha256", deployment.spec_sha256]
+  );
+  if (typeof inference?.model === "string") rows.push(["Model", inference.model]);
+  if (bundleLabel) rows.push(["Bundle", bundleLabel]);
+  const label = Math.max(...rows.map(([name]) => name.length)) + 1;
+  const lines = rows.map(([name, value]) => `${`${name}:`.padEnd(label)} ${value}`.trimEnd());
+  lines.push("", "Rollouts:");
+  if (rollouts.length === 0) lines.push("  none");
+  for (const rollout of rollouts) {
+    const direction = rollout.deployment_id === deployment.id ? `${rollout.kind} to this Deployment${rollout.previous_deployment_id ? ` from ${shortDeploymentId(rollout.previous_deployment_id)}` : ""}` : `${rollout.kind} away to ${shortDeploymentId(rollout.deployment_id)}`;
+    lines.push(
+      `  generation ${rollout.generation}  ${formatTimestamp(rollout.created_at)}  ${direction}${rollout.created_by_user_id ? `  by ${shortDeploymentId(rollout.created_by_user_id)}` : ""}`
+    );
+  }
+  return lines.join("\n");
+}
+async function deploymentsPromoteCommand(deps, prefix) {
+  const { project, token } = await projectManagement(deps);
+  const target = selectDeployment(await deps.api.listDeployments(project.id, token), prefix);
+  const result = await moveProduction(deps, project.id, target, token);
+  deps.output({
+    message: describeProductionMove(project, result, "Promoted"),
+    project,
+    ...result
+  });
+}
+async function deploymentsRollbackCommand(deps, prefix) {
+  const { project, token } = await projectManagement(deps);
+  let target;
+  if (prefix !== void 0) {
+    target = selectDeployment(await deps.api.listDeployments(project.id, token), prefix);
+  } else {
+    const rollouts = await deps.api.listRollouts(project.id, token);
+    const previousId = rollouts.find(
+      (rollout) => rollout.previous_deployment_id !== null
+    )?.previous_deployment_id;
+    if (!previousId) {
+      throw new Error(
+        `Project ${project.name} has no previous Production Deployment to roll back to. Name one with \`tonbo deployments rollback <id>\`.`
+      );
+    }
+    target = await deps.api.getDeployment(project.id, previousId, token);
+  }
+  const result = await moveProduction(deps, project.id, target, token);
+  deps.output({
+    message: describeProductionMove(project, result, "Rolled back"),
+    project,
+    ...result
+  });
+}
+async function moveProduction(deps, projectId, target, token) {
+  const previous = await deps.api.getProduction(projectId, token);
+  const production = await deps.api.putProduction(
+    projectId,
+    {
+      deployment_id: target.id,
+      desired_state: "running",
+      expected_generation: previous ? previous.generation : null
+    },
+    token
+  );
+  return {
+    deployment: await deps.api.getDeployment(projectId, target.id, token),
+    previous,
+    production
+  };
+}
+function describeProductionMove(project, move, verb) {
+  const { deployment, previous } = move;
+  const name = `${deploymentName(deployment)} (${shortDeploymentId(deployment.id)})`;
+  const headline = previous?.deployment_id === deployment.id ? `Deployment ${name} is already Production for project ${project.name}; requested it to be running.` : `${verb} ${name} to Production for project ${project.name}${previous ? ` (from ${shortDeploymentId(previous.deployment_id)})` : ""}.`;
+  return `${headline}
+Production: ${productionStateLabel(deployment)}
+Application: https://${project.publicHostname}`;
+}
+async function projectManagement(deps) {
+  const { oauthToken, project } = await resolveProject(deps);
+  return {
+    project,
+    token: await deps.api.exchangeManagementToken(oauthToken, project.id)
+  };
+}
+async function secretListCommand(deps) {
+  const { project, token } = await projectManagement(deps);
+  const secrets = await deps.api.listProjectSecrets(project.id, token);
+  deps.output({
+    message: secrets.length ? secrets.map((secret) => secret.name).join("\n") : "No project secrets are configured.",
+    project,
+    secrets
+  });
+}
+async function secretSetCommand(deps, name, options) {
+  const value = await deps.secretValue(name, options.fromEnv);
+  const { project, token } = await projectManagement(deps);
+  const secret = await deps.api.setProjectSecret(project.id, name, value, token);
+  deps.output({
+    message: `Set project secret ${secret.name}. Redeploy to replace the active runtime with this value.`,
+    project,
+    secret
+  });
+}
+async function secretRemoveCommand(deps, name) {
+  const { project, token } = await projectManagement(deps);
+  await deps.api.deleteProjectSecret(project.id, name, token);
+  deps.output({ message: `Removed project secret ${name}.`, project, name });
+}
+
+// src/credentials.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { chmod, lstat as lstat4, mkdir, open as open2, readFile as readFile5, rename as rename2, rm as rm2 } from "node:fs/promises";
+import os from "node:os";
+import path5 from "node:path";
+function defaultConfigDirectory() {
+  const base = process.env.XDG_CONFIG_HOME || path5.join(os.homedir(), ".config");
+  return path5.join(base, "tonbo");
+}
+var FileCredentialStore = class {
+  constructor(filename = path5.join(defaultConfigDirectory(), "credentials.json")) {
+    this.filename = filename;
+  }
+  async load() {
+    try {
+      await assertPrivateRegularFile(this.filename);
+      const parsed = JSON.parse(await readFile5(this.filename, "utf8"));
+      if (!isOAuthTokenSet(parsed)) throw new Error("invalid token set");
+      return parsed;
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw new Error(`Could not read Tonbo credentials at ${this.filename}.`, { cause: error });
+    }
+  }
+  async save(tokens) {
+    if (!isOAuthTokenSet(tokens)) throw new Error("Refusing to store a malformed Tonbo token set.");
+    const directory = path5.dirname(this.filename);
+    await mkdir(directory, { mode: 448, recursive: true });
+    await preparePrivateDirectory(directory);
+    await assertExistingDestinationIsSafe(this.filename);
+    const temporary = path5.join(
+      directory,
+      `.${path5.basename(this.filename)}.${process.pid}.${randomUUID3()}.tmp`
+    );
+    let handle = null;
+    try {
+      handle = await open2(temporary, "wx", 384);
+      await handle.writeFile(`${JSON.stringify(tokens, null, 2)}
+`, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = null;
+      if (process.platform !== "win32") await chmod(temporary, 384);
+      await rename2(temporary, this.filename);
+    } catch (error) {
+      await handle?.close().catch(() => void 0);
+      await rm2(temporary, { force: true }).catch(() => void 0);
+      throw new Error(`Could not store Tonbo credentials at ${this.filename}.`, { cause: error });
+    }
+  }
+};
+function isOAuthTokenSet(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const token = value;
+  return typeof token.access_token === "string" && token.access_token.length > 0 && (token.refresh_token === void 0 || typeof token.refresh_token === "string") && (token.expires_at === void 0 || Number.isInteger(token.expires_at) && (token.expires_at ?? 0) > 0);
+}
+async function preparePrivateDirectory(directory) {
+  const stat = await lstat4(directory);
+  if (stat.isSymbolicLink() || !stat.isDirectory())
+    throw new Error("Tonbo config directory must be a real directory.");
+  if (process.platform !== "win32") await chmod(directory, 448);
+}
+async function assertExistingDestinationIsSafe(filename) {
+  try {
+    const stat = await lstat4(filename);
+    if (stat.isSymbolicLink() || !stat.isFile())
+      throw new Error("Tonbo credential path must be a regular file.");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+async function assertPrivateRegularFile(filename) {
+  const stat = await lstat4(filename);
+  if (stat.isSymbolicLink() || !stat.isFile())
+    throw new Error("Tonbo credential path must be a regular file.");
+  if (process.platform !== "win32" && (stat.mode & 63) !== 0)
+    throw new Error("Tonbo credential file must have mode 0600.");
+}
+
+// src/git.ts
+import { execFile as execFile2 } from "node:child_process";
+var defaultGitRunner = (args, cwd) => new Promise((resolve, reject) => {
+  execFile2(
+    "git",
+    args,
+    {
+      cwd,
+      encoding: "utf8",
+      // Never take the index lock for a read: a concurrent editor or IDE
+      // must not turn provenance collection into a failure.
+      env: { ...process.env, GIT_OPTIONAL_LOCKS: "0" },
+      windowsHide: true
+    },
+    (error, stdout) => error ? reject(new Error(`git ${args.join(" ")} failed.`, { cause: error })) : resolve(stdout)
+  );
+});
+var COMMIT_SHA = /^[0-9a-f]{40}$/;
+var REF_MAX_LENGTH = 255;
+var SUBJECT_MAX_LENGTH = 512;
+var AUTHOR_MAX_LENGTH = 255;
+async function collectGitProvenance(root, run = defaultGitRunner) {
+  const commitSha = await read(run, ["rev-parse", "HEAD"], root);
+  if (!commitSha || !COMMIT_SHA.test(commitSha)) return null;
+  const [ref, subject, author, status] = await Promise.all([
+    read(run, ["rev-parse", "--abbrev-ref", "HEAD"], root),
+    read(run, ["log", "-1", "--format=%s"], root),
+    read(run, ["log", "-1", "--format=%an"], root),
+    // Only the deployed tree matters: changes elsewhere in the repository do
+    // not alter the uploaded bundle.
+    read(run, ["status", "--porcelain", "--", "."], root)
+  ]);
+  return {
+    commit_sha: commitSha,
+    ref: ref === "HEAD" ? null : clamp(ref, REF_MAX_LENGTH),
+    subject: clamp(subject, SUBJECT_MAX_LENGTH),
+    author: clamp(author, AUTHOR_MAX_LENGTH),
+    // When the status cannot be read the tree cannot be shown to match the
+    // commit, so the Deployment is recorded as dirty rather than clean.
+    dirty: status === null || status.length > 0
+  };
+}
+async function read(run, args, cwd) {
+  try {
+    return (await run(args, cwd)).trim();
+  } catch {
+    return null;
+  }
+}
+function clamp(value, maxLength) {
+  if (!value) return null;
+  return value.length > maxLength ? value.slice(0, maxLength) : value;
+}
+
+// src/progress.ts
+var FRAMES = ["|", "/", "-", "\\"];
+var TerminalProgress = class {
+  constructor(stream, intervalMs = 80) {
+    this.stream = stream;
+    this.intervalMs = intervalMs;
+  }
+  activeMessage;
+  frame = 0;
+  lastWidth = 0;
+  timer;
+  start(message) {
+    if (this.activeMessage) this.succeed();
+    this.activeMessage = message;
+    this.frame = 0;
+    if (!this.stream.isTTY) {
+      this.stream.write(`[..] ${message}
+`);
+      return;
+    }
+    this.render(`[${FRAMES[this.frame]}] ${message}`);
+    this.timer = setInterval(() => {
+      this.frame = (this.frame + 1) % FRAMES.length;
+      this.render(`[${FRAMES[this.frame]}] ${this.activeMessage}`);
+    }, this.intervalMs);
+    this.timer.unref();
+  }
+  succeed(message = this.activeMessage) {
+    this.finish("ok", message);
+  }
+  fail(message = this.activeMessage) {
+    this.finish("!!", message);
+  }
+  finish(marker, message) {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = void 0;
+    this.activeMessage = void 0;
+    if (!message) return;
+    const line = `[${marker}] ${message}`;
+    if (this.stream.isTTY) {
+      this.render(line);
+      this.stream.write("\n");
+      this.lastWidth = 0;
+      return;
+    }
+    this.stream.write(`${line}
+`);
+  }
+  render(value) {
+    this.stream.write(`\r${value.padEnd(this.lastWidth)}`);
+    this.lastWidth = value.length;
+  }
+};
+var silentProgress = {
+  start: () => {
+  },
+  succeed: () => {
+  },
+  fail: () => {
+  }
+};
+
+// src/prompt.ts
+import select from "@inquirer/select";
+import { createInterface } from "node:readline/promises";
+async function terminalPrompt(question) {
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    return await prompt.question(`? ${question}`);
+  } finally {
+    prompt.close();
+  }
+}
+async function terminalSelect(question, choices) {
+  return select(
+    {
+      choices,
+      message: question,
+      pageSize: choices.length
+    },
+    {
+      input: process.stdin,
+      output: process.stderr
+    }
+  );
+}
+
+// src/app.ts
+var packageVersion = JSON.parse(
+  readFileSync(new URL("../../package.json", import.meta.url), "utf8")
+);
+function createDependencies(json = false) {
+  const accountOrigin = process.env.TONBO_ACCOUNT_ORIGIN || "https://tonbo.dev";
+  const managementOrigin = process.env.TONBO_API_ORIGIN || "https://api.tonbo.dev";
+  return {
+    api: new TonboApi(fetch, accountOrigin, managementOrigin),
+    auth: new AuthClient(new FileCredentialStore(), fetch, accountOrigin),
+    cwd: () => process.cwd(),
+    defaultSshPublicKeys: readDefaultSshPublicKeys,
+    gitProvenance: collectGitProvenance,
+    interactive: () => !json && process.stdin.isTTY === true && process.stderr.isTTY === true,
+    inspectSource: inspectLocalAgentSource,
+    output: (value) => {
+      if (json) console.log(JSON.stringify(value));
+      else console.log(value.message ?? value);
+    },
+    progress: json ? silentProgress : new TerminalProgress(process.stderr),
+    prompt: terminalPrompt,
+    select: terminalSelect,
+    secretValue: (name, fromEnvironment) => {
+      const environmentName = fromEnvironment ?? name;
+      const value = process.env[environmentName];
+      if (!value)
+        throw new Error(
+          `Environment variable ${environmentName} is empty. Set it before running tonbo secret set.`
+        );
+      return Promise.resolve(value);
+    }
+  };
+}
+function jsonOutput(program) {
+  return program.opts().json === true;
+}
+function createProgram(dependencies = createDependencies) {
+  const program = new Command().name("tonbo").description("Deploy a persistent Project Agent to Tonbo.").version(packageVersion.version).option("--json", "print machine-readable JSON");
+  program.command("init").description("interactively create a Tonbo Agent declaration in this directory").option("--harness <harness>", "Agent Harness (currently pi)").option("--model <model>", "inference model").option("--driver <driver>", "PI driver: native or command").option("--agent-entry <file>", "Node entry file for the command driver").option("--build-command <argv...>", "build command argv for the command driver").option("--force", `replace an existing ${DECLARATION_FILENAME}`).action(
+    async (options) => initCommand(dependencies(jsonOutput(program)), options)
+  );
+  program.command("login").description("sign in through the browser and store the session in the user config").action(async () => loginCommand(dependencies(jsonOutput(program))));
+  const machine = program.command("machine").description("manage independent account-owned Machines");
+  machine.command("list").option("--account <account>", "account UUID").action(async (options) => {
+    const deps = dependencies(jsonOutput(program));
+    deps.output(
+      await deps.api.machineRequest(
+        await deps.auth.accessToken(),
+        options.account ? `?account=${encodeURIComponent(options.account)}` : ""
+      )
+    );
+  });
+  machine.command("allocate").requiredOption("--account <account>", "owning account UUID").requiredOption("--region <region>", "compute region (currently us-east-1)").action(async (options) => {
+    const deps = dependencies(jsonOutput(program));
+    deps.output(
+      await deps.api.machineRequest(await deps.auth.accessToken(), "", "POST", {
+        accountId: options.account,
+        region: options.region
+      })
+    );
+  });
+  for (const operation of ["show", "metrics", "release"]) {
+    machine.command(`${operation} <machine>`).action(async (id) => {
+      const deps = dependencies(jsonOutput(program));
+      const result = await deps.api.machineRequest(
+        await deps.auth.accessToken(),
+        `/${encodeURIComponent(id)}`,
+        operation === "release" ? "DELETE" : "GET"
+      );
+      deps.output(operation === "metrics" ? result.metrics : result);
+    });
+  }
+  machine.command("bind <machine>").requiredOption("--agent <agent>", "Agent UUID").action(async (id, options) => {
+    const deps = dependencies(jsonOutput(program));
+    deps.output(
+      await deps.api.machineRequest(
+        await deps.auth.accessToken(),
+        `/${encodeURIComponent(id)}/binding`,
+        "POST",
+        { agentId: options.agent }
+      )
+    );
+  });
+  machine.command("unbind <machine>").description("detach Agent and reset system disk; retain Agent Workspace and Sessions").action(async (id) => {
+    const deps = dependencies(jsonOutput(program));
+    const token = await deps.auth.accessToken();
+    const path6 = `/${encodeURIComponent(id)}`;
+    const current = await deps.api.machineRequest(token, path6);
+    if (!current.binding) throw new Error("Machine is not bound to an Agent.");
+    deps.output(
+      await deps.api.machineRequest(token, `${path6}/binding`, "DELETE", {
+        agentId: current.binding.agent_id,
+        bindingId: current.binding.id,
+        generation: current.binding.generation
+      })
+    );
+  });
+  const project = program.command("project").description("manage the project bound to this Agent directory");
+  project.command("create <name>").description("create and bind a project to this Agent directory").action(async (name) => projectCreateCommand(dependencies(jsonOutput(program)), name));
+  const sshKey = program.command("ssh-key").description("manage public keys used by native project SSH");
+  sshKey.command("add <public-key>").description("register an OpenSSH public key with the current Tonbo account").action(async (path6) => sshKeyAddCommand(dependencies(jsonOutput(program)), path6));
+  sshKey.command("remove <fingerprint>").description("revoke an SSH public key from the current Tonbo account").action(
+    async (fingerprint) => sshKeyRemoveCommand(dependencies(jsonOutput(program)), fingerprint)
+  );
+  project.command("use <project>").description("write a project ID into this Agent's .tonbo declaration").option("--force", "replace an existing project binding without confirmation").action(
+    async (selector, options) => projectUseCommand(dependencies(jsonOutput(program)), selector, options.force === true)
+  );
+  project.command("show").description("show the project bound to this Agent directory and its connection addresses").action(async () => projectShowCommand(dependencies(jsonOutput(program))));
+  program.command("deploy").description("upload this directory as a new Deployment and promote it to Production").option("--no-promote", "create the Deployment without moving Production").action(
+    async (options) => deployCommand(dependencies(jsonOutput(program)), { promote: options.promote })
+  );
+  const deployments = program.command("deployments").description("list and move between the immutable Deployments of the bound project");
+  deployments.command("list", { isDefault: true }).description("list Deployments, newest first").action(async () => deploymentsListCommand(dependencies(jsonOutput(program))));
+  deployments.command("show <deployment>").description("show one Deployment and its Rollouts by id prefix").action(
+    async (prefix) => deploymentsShowCommand(dependencies(jsonOutput(program)), prefix)
+  );
+  deployments.command("promote <deployment>").description("move Production to a Deployment by id prefix").action(
+    async (prefix) => deploymentsPromoteCommand(dependencies(jsonOutput(program)), prefix)
+  );
+  deployments.command("rollback [deployment]").description("move Production back to the previous Production Deployment, or to a named one").action(
+    async (prefix) => deploymentsRollbackCommand(dependencies(jsonOutput(program)), prefix)
+  );
+  program.command("run <prompt>").description("run one prompt in a durable project session").option("--session <session>", "resume an existing Agent Session UUID").action(
+    async (prompt, options) => runCommand(dependencies(jsonOutput(program)), prompt, options)
+  );
+  const secret = program.command("secret").description("manage encrypted environment secrets for the project service");
+  secret.command("list").action(async () => secretListCommand(dependencies(jsonOutput(program))));
+  secret.command("set <name>").description("set a secret from an environment variable (the same name by default)").option("--from-env <name>", "read the value from another environment variable").action(
+    async (name, options) => secretSetCommand(dependencies(jsonOutput(program)), name, options)
+  );
+  secret.command("remove <name>").action(async (name) => secretRemoveCommand(dependencies(jsonOutput(program)), name));
+  return program;
+}
+
+// src/main.ts
+try {
+  await createProgram().parseAsync(process.argv);
+} catch (error) {
+  console.error(error instanceof Error ? error.message : error);
+  process.exitCode = 1;
+}