@tonbo/cli 0.3.0 → 0.3.2

package/dist/bin/tonbo.js

@@ -32,1246 +32,1293 @@ async function requestJson(fetcher, url, init = {}) {
   return body;
 }
 
-// src/api.ts
-var TonboApi = class {
-  constructor(fetcher, accountOrigin = "https://tonbo.dev", managementOrigin = "https://api.tonbo.dev") {
-    this.fetcher = fetcher;
-    this.accountOrigin = accountOrigin;
-    this.managementOrigin = managementOrigin;
-  }
-  machineRequest(oauthToken, path6 = "", method = "GET", body) {
-    return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/machines${path6}`, {
-      method,
-      headers: {
-        authorization: `Bearer ${oauthToken}`,
-        ...body === void 0 ? {} : { "content-type": "application/json" }
-      },
-      ...body === void 0 ? {} : { body: JSON.stringify(body) }
-    });
-  }
-  listAgents(oauthToken) {
-    return requestJson(
-      this.fetcher,
-      `${this.accountOrigin}/api/cli/agents`,
-      {
-        headers: { authorization: `Bearer ${oauthToken}` }
-      }
-    ).then((body) => body.agents);
-  }
-  listOrganizations(oauthToken) {
-    return requestJson(
-      this.fetcher,
-      `${this.accountOrigin}/api/cli/accounts`,
-      {
-        headers: { authorization: `Bearer ${oauthToken}` }
-      }
-    ).then((body) => body.organizations);
-  }
-  createAgent(oauthToken, name, organizationId) {
-    return requestJson(
-      this.fetcher,
-      `${this.accountOrigin}/api/cli/agents`,
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${oauthToken}`,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify(organizationId ? { name, orgId: organizationId } : { name })
+// src/contracts.ts
+import { Ajv2020 } from "ajv/dist/2020.js";
+
+// src/generated/contracts.ts
+var piAgentSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json",
+  "title": "PI Agent v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "runtime",
+    "driver"
+  ],
+  "properties": {
+    "runtime": {
+      "const": "pi"
+    },
+    "secrets": {
+      "type": "array",
+      "maxItems": 32,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
       }
-    ).then((body) => body.agent);
-  }
-  registerSshKey(oauthToken, key) {
-    return requestJson(
-      this.fetcher,
-      `${this.accountOrigin}/api/cli/ssh-keys`,
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${oauthToken}`,
-          "content-type": "application/json"
+    },
+    "driver": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind"
+          ],
+          "properties": {
+            "kind": {
+              "const": "native"
+            }
+          }
         },
-        body: JSON.stringify({
-          algorithm: key.algorithm,
-          key_base64: key.keyBase64,
-          label: key.label
-        })
-      }
-    ).then((body) => body.key);
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "protocol",
+            "command"
+          ],
+          "properties": {
+            "kind": {
+              "const": "command"
+            },
+            "protocol": {
+              "const": "pi-rpc-v1"
+            },
+            "command": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 64,
+              "items": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 1024
+              }
+            }
+          }
+        }
+      ]
+    }
   }
-  revokeSshKey(oauthToken, fingerprint) {
-    return requestJson(
-      this.fetcher,
-      `${this.accountOrigin}/api/cli/ssh-keys`,
-      {
-        method: "DELETE",
-        headers: {
-          authorization: `Bearer ${oauthToken}`,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify({ fingerprint })
+};
+var agentServiceSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/agent-service-v1.schema.json",
+  "title": "Tonbo Agent application service v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "command"
+  ],
+  "properties": {
+    "command": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 4096
       }
-    ).then((body) => body.key);
-  }
-  exchangeManagementToken(oauthToken, agentId) {
-    return requestJson(
-      this.fetcher,
-      `${this.accountOrigin}/api/cli/agents/${agentId}/token`,
-      {
-        method: "POST",
-        headers: { authorization: `Bearer ${oauthToken}` }
+    },
+    "secrets": {
+      "type": "array",
+      "maxItems": 32,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
       }
-    ).then((body) => body.access_token);
+    },
+    "kubernetes": {
+      "$ref": "https://contracts.tonbo.dev/agents/kubernetes-profiles-v1.schema.json#/$defs/request"
+    }
   }
-  async deploy({
-    bundle,
-    origin,
-    agentId,
-    promote,
-    spec,
-    token
-  }) {
-    const descriptor = {
-      format: bundle.format,
-      sha256: bundle.sha256,
-      size_bytes: bundle.size_bytes
-    };
-    const bundlesPath = `/v1/agents/${agentId}/source-bundles`;
-    const prepared = await this.management("PUT", `${bundlesPath}/${bundle.sha256}`, token, {
-      format: descriptor.format,
-      size_bytes: descriptor.size_bytes
-    });
-    if (prepared.status === "upload") {
-      if (!prepared.upload_url) throw new Error("Tonbo did not return a source upload URL.");
-      if (!prepared.upload_headers || prepared.upload_headers["if-none-match"] !== "*")
-        throw new Error("Missing immutable source upload headers.");
-      const uploaded = await this.fetcher(prepared.upload_url, {
-        redirect: "error",
-        method: "PUT",
-        headers: prepared.upload_headers,
-        body: new Blob([new Uint8Array(bundle.bytes)])
-      });
-      let uploadError = null;
-      if (!uploaded.ok) {
-        uploadError = new Error(`Source upload failed with HTTP ${uploaded.status}.`);
-      }
-      try {
-        await this.management("POST", `${bundlesPath}/${bundle.sha256}/complete`, token, {
-          format: bundle.format,
-          size_bytes: bundle.size_bytes
-        });
-      } catch (error) {
-        if (uploadError)
-          throw new AggregateError([uploadError, error], "Source bundle upload did not complete.");
-        throw error;
+};
+var kubernetesProfilesSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/kubernetes-profiles-v1.schema.json",
+  "title": "Tonbo managed Kubernetes profiles v1",
+  "$defs": {
+    "request": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "profile"
+      ],
+      "properties": {
+        "profile": false
       }
     }
-    let deployment = await this.createDeployment(agentId, { spec, origin }, token);
-    const previous = await this.getProduction(agentId, token);
-    const previousDeployment = previous ? await this.getDeployment(agentId, previous.deployment_id, token) : null;
-    const unchanged = previousDeployment?.spec_sha256 === deployment.spec_sha256;
-    let production = previous;
-    if (promote) {
-      production = await this.putProduction(
-        agentId,
-        {
-          deployment_id: deployment.id,
-          desired_state: "running",
-          expected_generation: previous ? previous.generation : null
-        },
-        token
-      );
-      deployment = await this.getDeployment(agentId, deployment.id, token);
-    }
-    return { deployment, production, unchanged };
-  }
-  createDeployment(agentId, body, token) {
-    return this.management(
-      "POST",
-      `/v1/agents/${agentId}/deployments`,
-      token,
-      body
-    ).then((response) => response.data);
-  }
-  listDeployments(agentId, token) {
-    return this.managementList(`/v1/agents/${agentId}/deployments`, token);
-  }
-  getDeployment(agentId, deploymentId, token) {
-    return this.management(
-      "GET",
-      `/v1/agents/${agentId}/deployments/${deploymentId}`,
-      token
-    ).then((response) => response.data);
-  }
-  getProduction(agentId, token) {
-    return this.management(
-      "GET",
-      `/v1/agents/${agentId}/production`,
-      token
-    ).then(
-      (response) => response.data,
-      (error) => {
-        if (error.status === 404) return null;
-        throw error;
+  },
+  "x-tonbo-profiles": {}
+};
+var declarationSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/tonbo-declaration-v2.schema.json",
+  "title": "Tonbo Agent declaration v2",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "harness"
+  ],
+  "properties": {
+    "version": {
+      "const": 2
+    },
+    "inference": {
+      "type": "object",
+      "additionalProperties": false,
+      "default": {
+        "model": "claude-sonnet-4-5"
+      },
+      "required": [
+        "model"
+      ],
+      "properties": {
+        "model": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 160
+        }
       }
-    );
-  }
-  putProduction(agentId, body, token) {
-    return this.management(
-      "PUT",
-      `/v1/agents/${agentId}/production`,
-      token,
-      body
-    ).then((response) => response.data);
-  }
-  listRollouts(agentId, token) {
-    return this.managementList(`/v1/agents/${agentId}/production/rollouts`, token);
-  }
-  async run({
-    agentId,
-    prompt,
-    sessionId,
-    token,
-    turnId = randomUUID()
-  }) {
-    const agentPath = `/v1/agents/${agentId}`;
-    const production = await this.getProduction(agentId, token);
-    if (!production)
-      throw new Error("Agent has no Production Deployment; run `tonbo deploy` first.");
-    if (production.observed_state !== "running")
-      throw new Error(
-        `Production is ${production.observed_state}${production.last_error ? ` (${production.last_error})` : ""}; wait for it to be running.`
-      );
-    const session = sessionId ? { id: sessionId } : (await this.management("POST", `${agentPath}/sessions`, token, {
-      deployment_id: production.deployment_id
-    })).data;
-    const turn = (await this.management(
-      "POST",
-      `${agentPath}/sessions/${session.id}/turns`,
-      token,
-      { prompt },
-      turnId
-    )).data;
-    return { production, session, turn };
-  }
-  turnEvents({
-    after = 0,
-    agentId,
-    sessionId,
-    token,
-    turnId
-  }) {
-    return this.management(
-      "GET",
-      `/v1/agents/${agentId}/sessions/${sessionId}/turns/${turnId}/events?after=${after}`,
-      token
-    );
-  }
-  listAgentSecrets(agentId, token) {
-    return this.management(
-      "GET",
-      `/v1/agents/${agentId}/secrets`,
-      token
-    ).then((body) => body.data);
-  }
-  setAgentSecret(agentId, name, value, token) {
-    return this.management(
-      "PUT",
-      `/v1/agents/${agentId}/secrets/${encodeURIComponent(name)}`,
-      token,
-      { value }
-    );
-  }
-  deleteAgentSecret(agentId, name, token) {
-    return this.management(
-      "DELETE",
-      `/v1/agents/${agentId}/secrets/${encodeURIComponent(name)}`,
-      token
-    );
-  }
-  management(method, path6, token, body, idempotencyKey) {
-    return requestJson(this.fetcher, `${this.managementOrigin}${path6}`, {
-      method,
-      headers: {
-        authorization: `Bearer ${token}`,
-        ...body === void 0 ? {} : {
-          "content-type": "application/json",
-          "idempotency-key": idempotencyKey ?? randomUUID()
+    },
+    "build": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "command"
+      ],
+      "properties": {
+        "command": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1024
+          }
         }
-      },
-      ...body === void 0 ? {} : { body: JSON.stringify(body) }
-    });
+      }
+    },
+    "service": {
+      "$ref": "https://contracts.tonbo.dev/agents/agent-service-v1.schema.json"
+    },
+    "agent": {
+      "$ref": "https://contracts.tonbo.dev/agents/agent-name-v1.json#/$defs/publicHostname"
+    },
+    "harness": {
+      "$ref": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json"
+    }
   }
-  async managementList(path6, token) {
-    const values = [];
-    let cursor = null;
-    do {
-      const separator = path6.includes("?") ? "&" : "?";
-      const page = await this.management(
-        "GET",
-        `${path6}${separator}limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`,
-        token
-      );
-      values.push(...page.data);
-      cursor = page.next_cursor;
-    } while (cursor);
-    return values;
+};
+var deploymentSchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/managed-deployment-v1.schema.json",
+  "title": "Managed Agent Deployment v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "agent",
+    "source",
+    "inference"
+  ],
+  "properties": {
+    "version": {
+      "const": 1
+    },
+    "agent": {
+      "$ref": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json"
+    },
+    "source": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "format",
+        "sha256",
+        "size_bytes"
+      ],
+      "properties": {
+        "format": {
+          "const": "tar-v1"
+        },
+        "sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "size_bytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 67108864
+        }
+      }
+    },
+    "inference": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "model"
+      ],
+      "properties": {
+        "model": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 160
+        }
+      }
+    },
+    "service": {
+      "$ref": "https://contracts.tonbo.dev/agents/agent-service-v1.schema.json"
+    }
   }
 };
-
-// src/agent-source.ts
-import { lstat, readFile } from "node:fs/promises";
-import path from "node:path";
-
-// ../../packages/agent-source-inspector/src/index.ts
-var AGENTS_INSTRUCTIONS_PATH = "AGENTS.md";
-var PI_SETTINGS_PATH = ".pi/settings.json";
-var MAX_HARNESS_CONFIG_BYTES = 256 * 1024;
-var supportedHarnesses = [
-  {
-    command: "pi",
-    id: "pi",
-    name: "PI"
-  }
-];
-var supportedExecutionTargets = [
-  { driver: "native", harness: "pi" },
-  { driver: "command", harness: "pi" }
-];
-var AgentSourceInspectionError = class extends Error {
-  constructor(code, path6, message, options) {
-    super(message, options);
-    this.code = code;
-    this.path = path6;
-    this.name = "AgentSourceInspectionError";
+var agentNameContract = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/agents/agent-name-v1.json",
+  "x-tonbo-version": 1,
+  "x-tonbo-public-hostname-apex": "tonbo.sh",
+  "x-tonbo-public-hostname-template": "<agent>-<organization>-<word>-<word>.tonbo.sh",
+  "$defs": {
+    "name": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 40,
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",
+      "not": {
+        "enum": [
+          "api",
+          "artifacts",
+          "auth",
+          "inference",
+          "network-health",
+          "sandbox-control",
+          "status",
+          "streams",
+          "www"
+        ]
+      }
+    },
+    "publicHostname": {
+      "type": "string",
+      "minLength": 16,
+      "maxLength": 72,
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)+\\.tonbo\\.sh$",
+      "not": {
+        "enum": [
+          "api.tonbo.sh",
+          "artifacts.tonbo.sh",
+          "auth.tonbo.sh",
+          "inference.tonbo.sh",
+          "network-health.tonbo.sh",
+          "sandbox-control.tonbo.sh",
+          "status.tonbo.sh",
+          "streams.tonbo.sh",
+          "www.tonbo.sh"
+        ]
+      }
+    },
+    "hostnameWord": {
+      "type": "string",
+      "enum": [
+        "arch",
+        "bark",
+        "beam",
+        "bell",
+        "bird",
+        "blue",
+        "boat",
+        "bold",
+        "book",
+        "calm",
+        "cave",
+        "clay",
+        "coal",
+        "cool",
+        "cove",
+        "dawn",
+        "deer",
+        "dove",
+        "dune",
+        "dusk",
+        "echo",
+        "fern",
+        "fire",
+        "flax",
+        "flow",
+        "foam",
+        "fawn",
+        "frog",
+        "gate",
+        "glow",
+        "gold",
+        "gray",
+        "gulf",
+        "hail",
+        "halo",
+        "hare",
+        "hawk",
+        "hill",
+        "iris",
+        "jade",
+        "kite",
+        "lake",
+        "lamb",
+        "leaf",
+        "lime",
+        "lion",
+        "lobe",
+        "loft",
+        "loom",
+        "luma",
+        "lynx",
+        "mint",
+        "mist",
+        "moon",
+        "moss",
+        "navy",
+        "nest",
+        "nova",
+        "oak",
+        "ocean",
+        "onyx",
+        "opal",
+        "otter",
+        "palm",
+        "peak",
+        "pine",
+        "pond",
+        "pool",
+        "rain",
+        "reed",
+        "reef",
+        "rice",
+        "ring",
+        "rise",
+        "road",
+        "rock",
+        "rose",
+        "ruby",
+        "sage",
+        "sand",
+        "seal",
+        "seed",
+        "silk",
+        "sky",
+        "snow",
+        "soft",
+        "star",
+        "stem",
+        "stone",
+        "surf",
+        "swan",
+        "teal",
+        "tide",
+        "tree",
+        "vale",
+        "vine",
+        "wave",
+        "west",
+        "wind",
+        "wing",
+        "wolf",
+        "wood",
+        "wren",
+        "yarn",
+        "zest"
+      ]
+    }
   }
 };
-function parsePiPackageCount(contents) {
-  let settings;
-  try {
-    settings = JSON.parse(contents);
-  } catch (error) {
-    throw new AgentSourceInspectionError(
-      "invalid_pi_settings",
-      PI_SETTINGS_PATH,
-      `${PI_SETTINGS_PATH} must contain valid JSON.`,
-      { cause: error }
-    );
+var regionDiscoverySchema = {
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.tonbo.dev/regions/discovery-v1.schema.json",
+  "title": "Regional allocation discovery v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "version",
+    "regions"
+  ],
+  "properties": {
+    "version": {
+      "const": 1
+    },
+    "regions": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "id",
+          "display_name",
+          "allocation_enabled"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^[a-z]{2}(-gov)?-[a-z]+-[0-9]+$"
+          },
+          "display_name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "allocation_enabled": {
+            "type": "boolean"
+          }
+        }
+      }
+    }
   }
-  if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
-    throw new AgentSourceInspectionError(
-      "invalid_pi_settings",
-      PI_SETTINGS_PATH,
-      `${PI_SETTINGS_PATH} must contain a JSON object.`
-    );
+};
+
+// src/contracts.ts
+var ajv = new Ajv2020({ allErrors: true, useDefaults: true });
+ajv.addKeyword({ keyword: "x-tonbo-profiles" });
+ajv.addKeyword({ keyword: "x-tonbo-version" });
+ajv.addKeyword({ keyword: "x-tonbo-public-hostname-apex" });
+ajv.addKeyword({ keyword: "x-tonbo-public-hostname-template" });
+ajv.addSchema(kubernetesProfilesSchema);
+ajv.addSchema(piAgentSchema);
+ajv.addSchema(agentNameContract);
+ajv.addSchema(agentServiceSchema);
+var validateDeclaration = ajv.compile(declarationSchema);
+var validateDeploymentSpec = ajv.compile(deploymentSchema);
+var validateRegionDiscovery = ajv.compile(regionDiscoverySchema);
+function parseRegionDiscovery(value) {
+  if (!validateRegionDiscovery(value)) {
+    throw new Error(validationMessage("Region discovery", validateRegionDiscovery.errors));
   }
-  if (!("packages" in settings)) return 0;
-  const packages = settings.packages;
-  if (!Array.isArray(packages)) {
-    throw new AgentSourceInspectionError(
-      "invalid_pi_settings",
-      PI_SETTINGS_PATH,
-      `${PI_SETTINGS_PATH} packages must be an array.`
-    );
+  const result = value;
+  if (new Set(result.regions.map((region) => region.id)).size !== result.regions.length)
+    throw new Error("Region discovery contains duplicate region identities.");
+  return result;
+}
+function validationMessage(label, errors) {
+  const detail = errors?.map((error) => `${error.instancePath || "/"} ${error.message}`).join("; ");
+  return `${label} is invalid${detail ? `: ${detail}` : "."}`;
+}
+function parseDeclaration(value) {
+  const candidate = structuredClone(value);
+  if (!validateDeclaration(candidate)) {
+    throw new Error(validationMessage(".tonbo TOML", validateDeclaration.errors));
   }
-  return packages.length;
+  return candidate;
 }
-async function inspectAgentSource(source) {
-  const [agentsMd, piSettings] = await Promise.all([
-    source.has(AGENTS_INSTRUCTIONS_PATH),
-    source.readText(PI_SETTINGS_PATH, MAX_HARNESS_CONFIG_BYTES)
-  ]);
-  if (piSettings !== null) {
-    return {
-      version: 1,
-      instructions: { agentsMd },
-      harness: {
-        id: "pi",
-        reason: "pi_settings_found",
-        state: "identified"
-      },
-      pi: {
-        packageCount: parsePiPackageCount(piSettings),
-        settingsFound: true
-      }
-    };
+function assertManagedDeploymentSpec(value) {
+  if (!validateDeploymentSpec(value)) {
+    throw new Error(validationMessage("Managed Deployment spec", validateDeploymentSpec.errors));
   }
-  return {
-    version: 1,
-    instructions: { agentsMd },
-    harness: {
-      candidates: supportedHarnesses.map((harness) => harness.id),
-      reason: "no_harness_specific_config",
-      state: "selection_required"
-    },
-    pi: {
-      packageCount: 0,
-      settingsFound: false
-    }
-  };
-}
-
-// src/agent-source.ts
-var LocalAgentSource = class {
-  constructor(root) {
-    this.root = root;
-  }
-  async has(filename) {
-    const metadata = await this.metadata(filename);
-    return metadata?.isFile() === true;
-  }
-  async readText(filename, maxBytes) {
-    const metadata = await this.metadata(filename);
-    if (!metadata) return null;
-    if (!metadata.isFile() || metadata.isSymbolicLink()) {
-      throw new Error(`${filename} must be a regular file.`);
-    }
-    if (metadata.size > maxBytes) {
-      throw new Error(`${filename} exceeds the ${maxBytes}-byte inspection limit.`);
-    }
-    return readFile(path.join(this.root, filename), "utf8");
-  }
-  async metadata(filename) {
-    try {
-      return await lstat(path.join(this.root, filename));
-    } catch (error) {
-      if (error.code === "ENOENT") return null;
-      throw error;
-    }
-  }
-};
-function inspectLocalAgentSource(root) {
-  return inspectAgentSource(new LocalAgentSource(root));
 }
 
-// src/auth.ts
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-
-// src/callback-page.ts
-var WORDMARK = [
-  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
-  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
-].join("\n");
-var OUTCOMES = {
-  complete: {
-    status: 200,
-    title: "You are signed in.",
-    body: "Return to your terminal. This tab can be closed."
-  },
-  denied: {
-    status: 400,
-    title: "Login was not completed.",
-    body: "Nothing was authorized. Return to your terminal to try again."
-  },
-  invalid: {
-    // The state did not match, the code was missing, or the path was wrong.
-    // Say that it could not be verified rather than which check failed: the
-    // person who can read this page is not necessarily the one who started
-    // the login.
-    status: 400,
-    title: "This callback could not be verified.",
-    body: "Return to your terminal and start the login again."
+// src/api.ts
+var TonboApi = class {
+  constructor(fetcher, accountOrigin = "https://tonbo.dev", managementOrigin = "https://api.tonbo.dev") {
+    this.fetcher = fetcher;
+    this.accountOrigin = accountOrigin;
+    this.managementOrigin = managementOrigin;
   }
-};
-function renderCallbackPage(outcome) {
-  const { title, body } = OUTCOMES[outcome];
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex">
-<title>Tonbo CLI</title>
-<style>
-  :root {
-    --paper: #f3f2ee;
-    --ink: #1d1b17;
-    --rule: #c9c5ba;
-    --quiet: #5c564a;
-    --signal: #d64a03;
+  async listRegions(oauthToken) {
+    return parseRegionDiscovery(
+      await requestJson(this.fetcher, `${this.accountOrigin}/api/cli/regions`, {
+        headers: { authorization: `Bearer ${oauthToken}` }
+      })
+    );
   }
-  @media (prefers-color-scheme: dark) {
-    :root {
-      --paper: #1d1b17;
-      --ink: #f3f2ee;
-      --rule: #3a362e;
-      --quiet: #a49e8f;
-      --signal: #f08b4b;
-    }
+  machineRequest(oauthToken, path6 = "", method = "GET", body) {
+    return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/machines${path6}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${oauthToken}`,
+        ...body === void 0 ? {} : { "content-type": "application/json" }
+      },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
+    });
   }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: grid;
-    grid-template-rows: auto 1fr;
-    padding: 0 clamp(20px, 5vw, 72px);
-    background: var(--paper);
-    color: var(--ink);
-    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;
-    -webkit-font-smoothing: antialiased;
+  listAgents(oauthToken) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/agents`,
+      {
+        headers: { authorization: `Bearer ${oauthToken}` }
+      }
+    ).then((body) => body.agents);
   }
-  header { padding: 28px 0; }
-  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
-     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
-     what makes the rows meet without seams. Iosevka is not available here,
-     so it falls back to the platform monospace. */
-  pre.wordmark {
-    margin: 0;
-    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
-    font-size: 8px;
-    font-weight: 400;
-    line-height: 10px;
-    letter-spacing: 0;
-    white-space: pre;
-    color: var(--signal);
-    transform: scaleY(0.8);
-    transform-origin: left top;
+  listOrganizations(oauthToken) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/accounts`,
+      {
+        headers: { authorization: `Bearer ${oauthToken}` }
+      }
+    ).then((body) => body.organizations);
   }
-  main {
-    display: flex;
-    flex-direction: column;
-    justify-content: center;
-    max-width: 46ch;
-    padding-bottom: 12vh;
+  createAgent(oauthToken, name, organizationId) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/agents`,
+      {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${oauthToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(organizationId ? { name, orgId: organizationId } : { name })
+      }
+    ).then((body) => body.agent);
   }
-  h1 {
-    margin: 0;
-    font-size: 26px;
-    font-weight: 300;
-    line-height: 1.16;
-    letter-spacing: -0.018em;
+  registerSshKey(oauthToken, key) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/ssh-keys`,
+      {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${oauthToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          algorithm: key.algorithm,
+          key_base64: key.keyBase64,
+          label: key.label
+        })
+      }
+    ).then((body) => body.key);
   }
-  p {
-    margin: 14px 0 0;
-    font-size: 16px;
-    line-height: 1.55;
-    color: var(--quiet);
+  revokeSshKey(oauthToken, fingerprint) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/ssh-keys`,
+      {
+        method: "DELETE",
+        headers: {
+          authorization: `Bearer ${oauthToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({ fingerprint })
+      }
+    ).then((body) => body.key);
   }
-  hr {
-    width: 40px;
-    margin: 28px 0 0;
-    border: 0;
-    border-top: 1px solid var(--rule);
+  exchangeManagementToken(oauthToken, agentId) {
+    return requestJson(
+      this.fetcher,
+      `${this.accountOrigin}/api/cli/agents/${agentId}/token`,
+      {
+        method: "POST",
+        headers: { authorization: `Bearer ${oauthToken}` }
+      }
+    ).then((body) => body.access_token);
   }
-</style>
-</head>
-<body>
-<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
-<main>
-  <h1>${title}</h1>
-  <p>${body}</p>
-  <hr>
-</main>
-</body>
-</html>
-`;
-}
-function callbackResponse(outcome) {
-  return {
-    status: OUTCOMES[outcome].status,
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store"
-    },
-    body: renderCallbackPage(outcome)
-  };
-}
-
-// src/auth.ts
-var exec = promisify(execFile);
-var LOOPBACK_REDIRECT = "http://localhost:17655/callback";
-function base64url(value) {
-  return value.toString("base64url");
-}
-function withAbsoluteExpiry(tokens) {
-  if (tokens.expires_at || !Number.isInteger(tokens.expires_in) || (tokens.expires_in ?? 0) <= 0)
-    return tokens;
-  return {
-    ...tokens,
-    expires_at: Math.floor(Date.now() / 1e3) + (tokens.expires_in ?? 0)
-  };
-}
-var AuthClient = class {
-  constructor(credentials, fetcher, accountOrigin = "https://tonbo.dev", browserOpener = openBrowser) {
-    this.credentials = credentials;
-    this.fetcher = fetcher;
-    this.accountOrigin = accountOrigin;
-    this.browserOpener = browserOpener;
+  async deploy({
+    bundle,
+    origin,
+    agentId,
+    promote,
+    spec,
+    token
+  }) {
+    const descriptor = {
+      format: bundle.format,
+      sha256: bundle.sha256,
+      size_bytes: bundle.size_bytes
+    };
+    const bundlesPath = `/v1/agents/${agentId}/source-bundles`;
+    const prepared = await this.management("PUT", `${bundlesPath}/${bundle.sha256}`, token, {
+      format: descriptor.format,
+      size_bytes: descriptor.size_bytes
+    });
+    if (prepared.status === "upload") {
+      if (!prepared.upload_url) throw new Error("Tonbo did not return a source upload URL.");
+      if (!prepared.upload_headers || prepared.upload_headers["if-none-match"] !== "*")
+        throw new Error("Missing immutable source upload headers.");
+      const uploaded = await this.fetcher(prepared.upload_url, {
+        redirect: "error",
+        method: "PUT",
+        headers: prepared.upload_headers,
+        body: new Blob([new Uint8Array(bundle.bytes)])
+      });
+      let uploadError = null;
+      if (!uploaded.ok) {
+        uploadError = new Error(`Source upload failed with HTTP ${uploaded.status}.`);
+      }
+      try {
+        await this.management("POST", `${bundlesPath}/${bundle.sha256}/complete`, token, {
+          format: bundle.format,
+          size_bytes: bundle.size_bytes
+        });
+      } catch (error) {
+        if (uploadError)
+          throw new AggregateError([uploadError, error], "Source bundle upload did not complete.");
+        throw error;
+      }
+    }
+    let deployment = await this.createDeployment(agentId, { spec, origin }, token);
+    const previous = await this.getProduction(agentId, token);
+    const previousDeployment = previous ? await this.getDeployment(agentId, previous.deployment_id, token) : null;
+    const unchanged = previousDeployment?.spec_sha256 === deployment.spec_sha256;
+    let production = previous;
+    if (promote) {
+      production = await this.putProduction(
+        agentId,
+        {
+          deployment_id: deployment.id,
+          desired_state: "running",
+          expected_generation: previous ? previous.generation : null
+        },
+        token
+      );
+      deployment = await this.getDeployment(agentId, deployment.id, token);
+    }
+    return { deployment, production, unchanged };
   }
-  async accessToken() {
-    const injected = process.env.TONBO_ACCESS_TOKEN?.trim();
-    if (injected) return injected;
-    const tokens = await this.credentials.load();
-    if (!tokens) throw new Error("Not logged in. Run `tonbo login`.");
-    const legacyRelativeExpiry = !tokens.expires_at && tokens.expires_in;
-    if (!legacyRelativeExpiry && (!tokens.expires_at || tokens.expires_at > Math.floor(Date.now() / 1e3) + 30))
-      return tokens.access_token;
-    if (!tokens.refresh_token) throw new Error("Tonbo login expired. Run `tonbo login` again.");
-    const config = await this.config();
-    const refreshed = withAbsoluteExpiry(
-      await this.exchange(
-        config.token_endpoint,
-        new URLSearchParams({
-          client_id: config.client_id,
-          grant_type: "refresh_token",
-          refresh_token: tokens.refresh_token
-        })
-      )
+  createDeployment(agentId, body, token) {
+    return this.management(
+      "POST",
+      `/v1/agents/${agentId}/deployments`,
+      token,
+      body
+    ).then((response) => response.data);
+  }
+  listDeployments(agentId, token) {
+    return this.managementList(`/v1/agents/${agentId}/deployments`, token);
+  }
+  getDeployment(agentId, deploymentId, token) {
+    return this.management(
+      "GET",
+      `/v1/agents/${agentId}/deployments/${deploymentId}`,
+      token
+    ).then((response) => response.data);
+  }
+  getProduction(agentId, token) {
+    return this.management(
+      "GET",
+      `/v1/agents/${agentId}/production`,
+      token
+    ).then(
+      (response) => response.data,
+      (error) => {
+        if (error.status === 404) return null;
+        throw error;
+      }
     );
-    if (!refreshed.refresh_token) refreshed.refresh_token = tokens.refresh_token;
-    await this.credentials.save(refreshed);
-    return refreshed.access_token;
   }
-  async login(progress = () => {
+  putProduction(agentId, body, token) {
+    return this.management(
+      "PUT",
+      `/v1/agents/${agentId}/production`,
+      token,
+      body
+    ).then((response) => response.data);
+  }
+  listRollouts(agentId, token) {
+    return this.managementList(`/v1/agents/${agentId}/production/rollouts`, token);
+  }
+  async run({
+    agentId,
+    prompt,
+    sessionId,
+    token,
+    turnId = randomUUID()
   }) {
-    progress({ status: "started", step: "account-config" });
-    const config = await this.config();
-    progress({ status: "completed", step: "account-config" });
-    if (config.redirect_uri !== LOOPBACK_REDIRECT)
-      throw new Error(`Unsupported OAuth redirect URI: ${config.redirect_uri}`);
-    const verifier = base64url(randomBytes(48));
-    const challenge = createHash("sha256").update(verifier).digest("base64url");
-    const state = base64url(randomBytes(24));
-    const authorization = new URL(config.authorization_endpoint);
-    authorization.search = new URLSearchParams({
-      client_id: config.client_id,
-      code_challenge: challenge,
-      code_challenge_method: "S256",
-      redirect_uri: config.redirect_uri,
-      response_type: "code",
-      scope: "openid profile email",
-      state
-    }).toString();
-    const code = await this.listenForCode(
-      state,
-      () => this.browserOpener(authorization.toString()),
-      progress
-    );
-    progress({ status: "started", step: "token-exchange" });
-    const tokens = withAbsoluteExpiry(
-      await this.exchange(
-        config.token_endpoint,
-        new URLSearchParams({
-          client_id: config.client_id,
-          code,
-          code_verifier: verifier,
-          grant_type: "authorization_code",
-          redirect_uri: config.redirect_uri
-        })
-      )
+    const agentPath = `/v1/agents/${agentId}`;
+    const production = await this.getProduction(agentId, token);
+    if (!production)
+      throw new Error("Agent has no Production Deployment; run `tonbo deploy` first.");
+    if (production.observed_state !== "running")
+      throw new Error(
+        `Production is ${production.observed_state}${production.last_error ? ` (${production.last_error})` : ""}; wait for it to be running.`
+      );
+    const session = sessionId ? { id: sessionId } : (await this.management("POST", `${agentPath}/sessions`, token, {
+      deployment_id: production.deployment_id
+    })).data;
+    const turn = (await this.management(
+      "POST",
+      `${agentPath}/sessions/${session.id}/turns`,
+      token,
+      { prompt },
+      turnId
+    )).data;
+    return { production, session, turn };
+  }
+  turnEvents({
+    after = 0,
+    agentId,
+    sessionId,
+    token,
+    turnId
+  }) {
+    return this.management(
+      "GET",
+      `/v1/agents/${agentId}/sessions/${sessionId}/turns/${turnId}/events?after=${after}`,
+      token
     );
-    progress({ status: "completed", step: "token-exchange" });
-    progress({ status: "started", step: "credential-store" });
-    await this.credentials.save(tokens);
-    progress({ status: "completed", step: "credential-store" });
-    return tokens;
   }
-  config() {
-    return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/config`);
+  listAgentSecrets(agentId, token) {
+    return this.management(
+      "GET",
+      `/v1/agents/${agentId}/secrets`,
+      token
+    ).then((body) => body.data);
   }
-  exchange(endpoint, body) {
-    return requestJson(this.fetcher, endpoint, {
-      method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded" },
-      body
-    });
+  setAgentSecret(agentId, name, value, token) {
+    return this.management(
+      "PUT",
+      `/v1/agents/${agentId}/secrets/${encodeURIComponent(name)}`,
+      token,
+      { value }
+    );
   }
-  listenForCode(expectedState, ready, progress) {
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const sockets = /* @__PURE__ */ new Set();
-      let authorizationStarted = false;
-      const startAuthorization = () => {
-        if (authorizationStarted) return;
-        authorizationStarted = true;
-        progress({ status: "completed", step: "browser" });
-        progress({ status: "started", step: "browser-authorization" });
-      };
-      const finish = (result, completedResponseSocket) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timeout);
-        const complete = (closeError) => {
-          if (closeError) reject(closeError);
-          else if ("code" in result) {
-            progress({ status: "completed", step: "callback-close" });
-            resolve(result.code);
-          } else reject(result.error);
-        };
-        if ("code" in result) progress({ status: "started", step: "callback-close" });
-        if (!server.listening) {
-          complete();
-          return;
-        }
-        server.close(complete);
-        for (const socket of sockets) {
-          if (socket !== completedResponseSocket) socket.destroy();
-        }
-        server.closeIdleConnections();
-      };
-      const timeout = setTimeout(
-        () => {
-          finish({ error: new Error("Timed out waiting for browser login.") });
-        },
-        5 * 60 * 1e3
-      );
-      const server = createServer((request, response) => {
-        const url = new URL(request.url ?? "/", LOOPBACK_REDIRECT);
-        const code = url.searchParams.get("code");
-        const oauthError = url.searchParams.get("error_description") ?? url.searchParams.get("error");
-        if (oauthError) {
-          const responseSocket2 = response.socket;
-          respond(
-            response,
-            "denied",
-            () => finish({ error: new Error(oauthError) }, responseSocket2)
-          );
-          return;
-        }
-        if (url.pathname !== "/callback" || url.searchParams.get("state") !== expectedState || !code) {
-          respond(response, "invalid");
-          return;
+  deleteAgentSecret(agentId, name, token) {
+    return this.management(
+      "DELETE",
+      `/v1/agents/${agentId}/secrets/${encodeURIComponent(name)}`,
+      token
+    );
+  }
+  management(method, path6, token, body, idempotencyKey) {
+    return requestJson(this.fetcher, `${this.managementOrigin}${path6}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...body === void 0 ? {} : {
+          "content-type": "application/json",
+          "idempotency-key": idempotencyKey ?? randomUUID()
         }
-        startAuthorization();
-        progress({ status: "completed", step: "browser-authorization" });
-        const responseSocket = response.socket;
-        respond(response, "complete", () => finish({ code }, responseSocket));
-      });
-      server.on("connection", (socket) => {
-        sockets.add(socket);
-        socket.once("close", () => sockets.delete(socket));
-      });
-      server.once("error", (error) => finish({ error }));
-      progress({ status: "started", step: "callback-server" });
-      server.listen(17655, "localhost", () => {
-        progress({ status: "completed", step: "callback-server" });
-        progress({ status: "started", step: "browser" });
-        void ready().then(startAuthorization).catch(
-          (error) => finish({
-            error: error instanceof Error ? error : new Error("Could not open the login browser.")
-          })
-        );
-      });
+      },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
     });
   }
+  async managementList(path6, token) {
+    const values = [];
+    let cursor = null;
+    do {
+      const separator = path6.includes("?") ? "&" : "?";
+      const page = await this.management(
+        "GET",
+        `${path6}${separator}limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ""}`,
+        token
+      );
+      values.push(...page.data);
+      cursor = page.next_cursor;
+    } while (cursor);
+    return values;
+  }
 };
-function respond(response, outcome, finished) {
-  const page = callbackResponse(outcome);
-  if (finished) response.once("finish", finished);
-  response.writeHead(page.status, { ...page.headers, connection: "close" });
-  response.end(page.body);
-}
-async function openBrowser(url) {
-  if (process.platform === "darwin") return void await exec("open", [url]);
-  if (process.platform === "win32")
-    return void await exec("rundll32", ["url.dll,FileProtocolHandler", url]);
-  return void await exec("xdg-open", [url]);
-}
 
-// src/commands.ts
-import { DEFAULT_INFERENCE_MODEL as DEFAULT_INFERENCE_MODEL2 } from "@tonbo/agent-source-bundler/inference-default";
-
-// ../../packages/agent-source-bundler/src/generated/contracts.ts
-var sourceBundleContract = { "version": 1, "format": "tar-v1", "key_prefix": "agent-source-bundles", "content_type": "application/vnd.tonbo.source+tar", "max_bytes": 67108864 };
-var piSessionContract = { "version": 1, "adapter": "pi-jsonl-v3", "format_version": 3, "durable_completion_timeout_seconds": 30, "session_directory": "/sessions", "path_template": "/sessions/{session_id}.jsonl", "preflight_command": ["/usr/local/bin/artifacts", "runtime", "session-preflight"] };
+// src/agent-source.ts
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
 
-// ../../packages/agent-source-bundler/src/deployment-origin.ts
-function deploymentOriginLabel(actor) {
-  return actor === "onboarding" ? "Setup guide" : "tonbo deploy";
+// ../../packages/agent-source-inspector/dist/src/index.js
+var AGENTS_INSTRUCTIONS_PATH = "AGENTS.md";
+var PI_SETTINGS_PATH = ".pi/settings.json";
+var MAX_HARNESS_CONFIG_BYTES = 256 * 1024;
+var supportedHarnesses = [
+  {
+    command: "pi",
+    id: "pi",
+    name: "PI"
+  }
+];
+var supportedExecutionTargets = [
+  { driver: "native", harness: "pi" },
+  { driver: "command", harness: "pi" }
+];
+var AgentSourceInspectionError = class extends Error {
+  code;
+  path;
+  constructor(code, path6, message, options) {
+    super(message, options);
+    this.code = code;
+    this.path = path6;
+    this.name = "AgentSourceInspectionError";
+  }
+};
+function parsePiPackageCount(contents) {
+  let settings;
+  try {
+    settings = JSON.parse(contents);
+  } catch (error) {
+    throw new AgentSourceInspectionError("invalid_pi_settings", PI_SETTINGS_PATH, `${PI_SETTINGS_PATH} must contain valid JSON.`, { cause: error });
+  }
+  if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+    throw new AgentSourceInspectionError("invalid_pi_settings", PI_SETTINGS_PATH, `${PI_SETTINGS_PATH} must contain a JSON object.`);
+  }
+  if (!("packages" in settings))
+    return 0;
+  const packages = settings.packages;
+  if (!Array.isArray(packages)) {
+    throw new AgentSourceInspectionError("invalid_pi_settings", PI_SETTINGS_PATH, `${PI_SETTINGS_PATH} packages must be an array.`);
+  }
+  return packages.length;
 }
-function githubRepositoryUrl(remote) {
-  if (typeof remote !== "string" || !remote || /\s/.test(remote) || [...remote].some((character) => character.charCodeAt(0) < 32))
-    return null;
-  let path6;
-  const ssh = /^git@github\.com:([^?#]+)$/.exec(remote);
-  if (ssh) path6 = ssh[1];
-  else {
+async function inspectAgentSource(source) {
+  const [agentsMd, piSettings] = await Promise.all([
+    source.has(AGENTS_INSTRUCTIONS_PATH),
+    source.readText(PI_SETTINGS_PATH, MAX_HARNESS_CONFIG_BYTES)
+  ]);
+  if (piSettings !== null) {
+    return {
+      version: 1,
+      instructions: { agentsMd },
+      harness: {
+        id: "pi",
+        reason: "pi_settings_found",
+        state: "identified"
+      },
+      pi: {
+        packageCount: parsePiPackageCount(piSettings),
+        settingsFound: true
+      }
+    };
+  }
+  return {
+    version: 1,
+    instructions: { agentsMd },
+    harness: {
+      candidates: supportedHarnesses.map((harness) => harness.id),
+      reason: "no_harness_specific_config",
+      state: "selection_required"
+    },
+    pi: {
+      packageCount: 0,
+      settingsFound: false
+    }
+  };
+}
+
+// src/agent-source.ts
+var LocalAgentSource = class {
+  constructor(root) {
+    this.root = root;
+  }
+  async has(filename) {
+    const metadata = await this.metadata(filename);
+    return metadata?.isFile() === true;
+  }
+  async readText(filename, maxBytes) {
+    const metadata = await this.metadata(filename);
+    if (!metadata) return null;
+    if (!metadata.isFile() || metadata.isSymbolicLink()) {
+      throw new Error(`${filename} must be a regular file.`);
+    }
+    if (metadata.size > maxBytes) {
+      throw new Error(`${filename} exceeds the ${maxBytes}-byte inspection limit.`);
+    }
+    return readFile(path.join(this.root, filename), "utf8");
+  }
+  async metadata(filename) {
     try {
-      const url = new URL(remote);
-      if (url.hostname !== "github.com" || url.port || !["https:", "ssh:"].includes(url.protocol))
-        return null;
-      path6 = url.pathname.slice(1);
-    } catch {
-      return null;
+      return await lstat(path.join(this.root, filename));
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
     }
   }
-  path6 = path6.replace(/\/$/, "").replace(/\.git$/, "");
-  const parts = path6.split("/");
-  if (parts.length !== 2 || !/^[a-z\d](?:[a-z\d-]{0,38})$/i.test(parts[0]) || !/^[a-z\d._-]{1,100}$/i.test(parts[1]) || [".", ".."].includes(parts[1]))
-    return null;
-  return `https://github.com/${parts[0]}/${parts[1]}`;
+};
+function inspectLocalAgentSource(root) {
+  return inspectAgentSource(new LocalAgentSource(root));
 }
 
-// src/commands.ts
-import path4 from "node:path";
+// src/auth.ts
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 
-// src/build.ts
-import { spawn } from "node:child_process";
-async function runBuildCommand(root, command) {
-  if (command.length === 0) throw new Error("Build command must not be empty.");
-  await new Promise((resolve, reject) => {
-    const child = spawn(command[0], command.slice(1), {
-      cwd: root,
-      env: process.env,
-      // Command output is progress, not the CLI result. Keep stdout available
-      // for the single JSON document emitted by `tonbo --json deploy`.
-      stdio: ["inherit", process.stderr, process.stderr]
-    });
-    child.once("error", reject);
-    child.once("exit", (code, signal) => {
-      if (code === 0) resolve();
-      else
-        reject(
-          new Error(
-            `Build command failed${signal ? ` with signal ${signal}` : ` with status ${code}`}.`
-          )
-        );
-    });
-  });
-}
-
-// src/contracts.ts
-import { Ajv2020 } from "ajv/dist/2020.js";
-
-// src/generated/contracts.ts
-var piAgentSchema = {
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json",
-  "title": "PI Agent v1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "runtime",
-    "driver"
-  ],
-  "properties": {
-    "runtime": {
-      "const": "pi"
-    },
-    "secrets": {
-      "type": "array",
-      "maxItems": 32,
-      "uniqueItems": true,
-      "items": {
-        "type": "string",
-        "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
-      }
-    },
-    "driver": {
-      "oneOf": [
-        {
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "kind"
-          ],
-          "properties": {
-            "kind": {
-              "const": "native"
-            }
-          }
-        },
-        {
-          "type": "object",
-          "additionalProperties": false,
-          "required": [
-            "kind",
-            "protocol",
-            "command"
-          ],
-          "properties": {
-            "kind": {
-              "const": "command"
-            },
-            "protocol": {
-              "const": "pi-rpc-v1"
-            },
-            "command": {
-              "type": "array",
-              "minItems": 1,
-              "maxItems": 64,
-              "items": {
-                "type": "string",
-                "minLength": 1,
-                "maxLength": 1024
-              }
-            }
-          }
-        }
-      ]
-    }
+// src/callback-page.ts
+var WORDMARK = [
+  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
+  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
+  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
+].join("\n");
+var OUTCOMES = {
+  complete: {
+    status: 200,
+    title: "You are signed in.",
+    body: "Return to your terminal. This tab can be closed."
+  },
+  denied: {
+    status: 400,
+    title: "Login was not completed.",
+    body: "Nothing was authorized. Return to your terminal to try again."
+  },
+  invalid: {
+    // The state did not match, the code was missing, or the path was wrong.
+    // Say that it could not be verified rather than which check failed: the
+    // person who can read this page is not necessarily the one who started
+    // the login.
+    status: 400,
+    title: "This callback could not be verified.",
+    body: "Return to your terminal and start the login again."
   }
 };
-var agentServiceSchema = {
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://contracts.tonbo.dev/agents/agent-service-v1.schema.json",
-  "title": "Tonbo Agent application service v1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "command"
-  ],
-  "properties": {
-    "command": {
-      "type": "array",
-      "minItems": 1,
-      "maxItems": 64,
-      "items": {
-        "type": "string",
-        "minLength": 1,
-        "maxLength": 4096
-      }
-    },
-    "secrets": {
-      "type": "array",
-      "maxItems": 32,
-      "uniqueItems": true,
-      "items": {
-        "type": "string",
-        "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
-      }
-    },
-    "kubernetes": {
-      "$ref": "https://contracts.tonbo.dev/agents/kubernetes-profiles-v1.schema.json#/$defs/request"
-    }
+function renderCallbackPage(outcome) {
+  const { title, body } = OUTCOMES[outcome];
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Tonbo CLI</title>
+<style>
+  :root {
+    --paper: #f3f2ee;
+    --ink: #1d1b17;
+    --rule: #c9c5ba;
+    --quiet: #5c564a;
+    --signal: #d64a03;
   }
-};
-var kubernetesProfilesSchema = {
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://contracts.tonbo.dev/agents/kubernetes-profiles-v1.schema.json",
-  "title": "Tonbo managed Kubernetes profiles v1",
-  "$defs": {
-    "request": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "profile"
-      ],
-      "properties": {
-        "profile": false
-      }
-    }
-  },
-  "x-tonbo-profiles": {}
-};
-var declarationSchema = {
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://contracts.tonbo.dev/agents/tonbo-declaration-v2.schema.json",
-  "title": "Tonbo Agent declaration v2",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "version",
-    "harness"
-  ],
-  "properties": {
-    "version": {
-      "const": 2
-    },
-    "inference": {
-      "type": "object",
-      "additionalProperties": false,
-      "default": {
-        "model": "claude-sonnet-4-5"
-      },
-      "required": [
-        "model"
-      ],
-      "properties": {
-        "model": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 160
-        }
-      }
-    },
-    "build": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "command"
-      ],
-      "properties": {
-        "command": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 64,
-          "items": {
-            "type": "string",
-            "minLength": 1,
-            "maxLength": 1024
-          }
-        }
-      }
-    },
-    "service": {
-      "$ref": "https://contracts.tonbo.dev/agents/agent-service-v1.schema.json"
-    },
-    "agent": {
-      "$ref": "https://contracts.tonbo.dev/agents/agent-name-v1.json#/$defs/publicHostname"
-    },
-    "harness": {
-      "$ref": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json"
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --paper: #1d1b17;
+      --ink: #f3f2ee;
+      --rule: #3a362e;
+      --quiet: #a49e8f;
+      --signal: #f08b4b;
     }
   }
-};
-var deploymentSchema = {
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://contracts.tonbo.dev/agents/managed-deployment-v1.schema.json",
-  "title": "Managed Agent Deployment v1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": [
-    "version",
-    "agent",
-    "source",
-    "inference"
-  ],
-  "properties": {
-    "version": {
-      "const": 1
-    },
-    "agent": {
-      "$ref": "https://contracts.tonbo.dev/agents/pi-agent-v1.schema.json"
-    },
-    "source": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "format",
-        "sha256",
-        "size_bytes"
-      ],
-      "properties": {
-        "format": {
-          "const": "tar-v1"
-        },
-        "sha256": {
-          "type": "string",
-          "pattern": "^[0-9a-f]{64}$"
-        },
-        "size_bytes": {
-          "type": "integer",
-          "minimum": 1,
-          "maximum": 67108864
-        }
-      }
-    },
-    "inference": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": [
-        "model"
-      ],
-      "properties": {
-        "model": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 160
-        }
-      }
-    },
-    "service": {
-      "$ref": "https://contracts.tonbo.dev/agents/agent-service-v1.schema.json"
-    }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: grid;
+    grid-template-rows: auto 1fr;
+    padding: 0 clamp(20px, 5vw, 72px);
+    background: var(--paper);
+    color: var(--ink);
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;
+    -webkit-font-smoothing: antialiased;
   }
-};
-var agentNameContract = {
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://contracts.tonbo.dev/agents/agent-name-v1.json",
-  "x-tonbo-version": 1,
-  "x-tonbo-public-hostname-apex": "tonbo.sh",
-  "x-tonbo-public-hostname-template": "<agent>-<organization>-<word>-<word>.tonbo.sh",
-  "$defs": {
-    "name": {
-      "type": "string",
-      "minLength": 3,
-      "maxLength": 40,
-      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",
-      "not": {
-        "enum": [
-          "api",
-          "artifacts",
-          "auth",
-          "inference",
-          "network-health",
-          "sandbox-control",
-          "status",
-          "streams",
-          "www"
-        ]
-      }
-    },
-    "publicHostname": {
-      "type": "string",
-      "minLength": 16,
-      "maxLength": 72,
-      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)+\\.tonbo\\.sh$",
-      "not": {
-        "enum": [
-          "api.tonbo.sh",
-          "artifacts.tonbo.sh",
-          "auth.tonbo.sh",
-          "inference.tonbo.sh",
-          "network-health.tonbo.sh",
-          "sandbox-control.tonbo.sh",
-          "status.tonbo.sh",
-          "streams.tonbo.sh",
-          "www.tonbo.sh"
-        ]
-      }
+  header { padding: 28px 0; }
+  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
+     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
+     what makes the rows meet without seams. Iosevka is not available here,
+     so it falls back to the platform monospace. */
+  pre.wordmark {
+    margin: 0;
+    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
+    font-size: 8px;
+    font-weight: 400;
+    line-height: 10px;
+    letter-spacing: 0;
+    white-space: pre;
+    color: var(--signal);
+    transform: scaleY(0.8);
+    transform-origin: left top;
+  }
+  main {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    max-width: 46ch;
+    padding-bottom: 12vh;
+  }
+  h1 {
+    margin: 0;
+    font-size: 26px;
+    font-weight: 300;
+    line-height: 1.16;
+    letter-spacing: -0.018em;
+  }
+  p {
+    margin: 14px 0 0;
+    font-size: 16px;
+    line-height: 1.55;
+    color: var(--quiet);
+  }
+  hr {
+    width: 40px;
+    margin: 28px 0 0;
+    border: 0;
+    border-top: 1px solid var(--rule);
+  }
+</style>
+</head>
+<body>
+<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
+<main>
+  <h1>${title}</h1>
+  <p>${body}</p>
+  <hr>
+</main>
+</body>
+</html>
+`;
+}
+function callbackResponse(outcome) {
+  return {
+    status: OUTCOMES[outcome].status,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
     },
-    "hostnameWord": {
-      "type": "string",
-      "enum": [
-        "arch",
-        "bark",
-        "beam",
-        "bell",
-        "bird",
-        "blue",
-        "boat",
-        "bold",
-        "book",
-        "calm",
-        "cave",
-        "clay",
-        "coal",
-        "cool",
-        "cove",
-        "dawn",
-        "deer",
-        "dove",
-        "dune",
-        "dusk",
-        "echo",
-        "fern",
-        "fire",
-        "flax",
-        "flow",
-        "foam",
-        "fawn",
-        "frog",
-        "gate",
-        "glow",
-        "gold",
-        "gray",
-        "gulf",
-        "hail",
-        "halo",
-        "hare",
-        "hawk",
-        "hill",
-        "iris",
-        "jade",
-        "kite",
-        "lake",
-        "lamb",
-        "leaf",
-        "lime",
-        "lion",
-        "lobe",
-        "loft",
-        "loom",
-        "luma",
-        "lynx",
-        "mint",
-        "mist",
-        "moon",
-        "moss",
-        "navy",
-        "nest",
-        "nova",
-        "oak",
-        "ocean",
-        "onyx",
-        "opal",
-        "otter",
-        "palm",
-        "peak",
-        "pine",
-        "pond",
-        "pool",
-        "rain",
-        "reed",
-        "reef",
-        "rice",
-        "ring",
-        "rise",
-        "road",
-        "rock",
-        "rose",
-        "ruby",
-        "sage",
-        "sand",
-        "seal",
-        "seed",
-        "silk",
-        "sky",
-        "snow",
-        "soft",
-        "star",
-        "stem",
-        "stone",
-        "surf",
-        "swan",
-        "teal",
-        "tide",
-        "tree",
-        "vale",
-        "vine",
-        "wave",
-        "west",
-        "wind",
-        "wing",
-        "wolf",
-        "wood",
-        "wren",
-        "yarn",
-        "zest"
-      ]
-    }
+    body: renderCallbackPage(outcome)
+  };
+}
+
+// src/auth.ts
+var exec = promisify(execFile);
+var LOOPBACK_REDIRECT = "http://localhost:17655/callback";
+function base64url(value) {
+  return value.toString("base64url");
+}
+function withAbsoluteExpiry(tokens) {
+  if (tokens.expires_at || !Number.isInteger(tokens.expires_in) || (tokens.expires_in ?? 0) <= 0)
+    return tokens;
+  return {
+    ...tokens,
+    expires_at: Math.floor(Date.now() / 1e3) + (tokens.expires_in ?? 0)
+  };
+}
+var AuthClient = class {
+  constructor(credentials, fetcher, accountOrigin = "https://tonbo.dev", browserOpener = openBrowser) {
+    this.credentials = credentials;
+    this.fetcher = fetcher;
+    this.accountOrigin = accountOrigin;
+    this.browserOpener = browserOpener;
+  }
+  async accessToken() {
+    const injected = process.env.TONBO_ACCESS_TOKEN?.trim();
+    if (injected) return injected;
+    const tokens = await this.credentials.load();
+    if (!tokens) throw new Error("Not logged in. Run `tonbo login`.");
+    const legacyRelativeExpiry = !tokens.expires_at && tokens.expires_in;
+    if (!legacyRelativeExpiry && (!tokens.expires_at || tokens.expires_at > Math.floor(Date.now() / 1e3) + 30))
+      return tokens.access_token;
+    if (!tokens.refresh_token) throw new Error("Tonbo login expired. Run `tonbo login` again.");
+    const config = await this.config();
+    const refreshed = withAbsoluteExpiry(
+      await this.exchange(
+        config.token_endpoint,
+        new URLSearchParams({
+          client_id: config.client_id,
+          grant_type: "refresh_token",
+          refresh_token: tokens.refresh_token
+        })
+      )
+    );
+    if (!refreshed.refresh_token) refreshed.refresh_token = tokens.refresh_token;
+    await this.credentials.save(refreshed);
+    return refreshed.access_token;
+  }
+  async login(progress = () => {
+  }) {
+    progress({ status: "started", step: "account-config" });
+    const config = await this.config();
+    progress({ status: "completed", step: "account-config" });
+    if (config.redirect_uri !== LOOPBACK_REDIRECT)
+      throw new Error(`Unsupported OAuth redirect URI: ${config.redirect_uri}`);
+    const verifier = base64url(randomBytes(48));
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    const state = base64url(randomBytes(24));
+    const authorization = new URL(config.authorization_endpoint);
+    authorization.search = new URLSearchParams({
+      client_id: config.client_id,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      redirect_uri: config.redirect_uri,
+      response_type: "code",
+      scope: "openid profile email",
+      state
+    }).toString();
+    const code = await this.listenForCode(
+      state,
+      () => this.browserOpener(authorization.toString()),
+      progress
+    );
+    progress({ status: "started", step: "token-exchange" });
+    const tokens = withAbsoluteExpiry(
+      await this.exchange(
+        config.token_endpoint,
+        new URLSearchParams({
+          client_id: config.client_id,
+          code,
+          code_verifier: verifier,
+          grant_type: "authorization_code",
+          redirect_uri: config.redirect_uri
+        })
+      )
+    );
+    progress({ status: "completed", step: "token-exchange" });
+    progress({ status: "started", step: "credential-store" });
+    await this.credentials.save(tokens);
+    progress({ status: "completed", step: "credential-store" });
+    return tokens;
+  }
+  config() {
+    return requestJson(this.fetcher, `${this.accountOrigin}/api/cli/config`);
+  }
+  exchange(endpoint, body) {
+    return requestJson(this.fetcher, endpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body
+    });
+  }
+  listenForCode(expectedState, ready, progress) {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const sockets = /* @__PURE__ */ new Set();
+      let authorizationStarted = false;
+      const startAuthorization = () => {
+        if (authorizationStarted) return;
+        authorizationStarted = true;
+        progress({ status: "completed", step: "browser" });
+        progress({ status: "started", step: "browser-authorization" });
+      };
+      const finish = (result, completedResponseSocket) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeout);
+        const complete = (closeError) => {
+          if (closeError) reject(closeError);
+          else if ("code" in result) {
+            progress({ status: "completed", step: "callback-close" });
+            resolve(result.code);
+          } else reject(result.error);
+        };
+        if ("code" in result) progress({ status: "started", step: "callback-close" });
+        if (!server.listening) {
+          complete();
+          return;
+        }
+        server.close(complete);
+        for (const socket of sockets) {
+          if (socket !== completedResponseSocket) socket.destroy();
+        }
+        server.closeIdleConnections();
+      };
+      const timeout = setTimeout(
+        () => {
+          finish({ error: new Error("Timed out waiting for browser login.") });
+        },
+        5 * 60 * 1e3
+      );
+      const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", LOOPBACK_REDIRECT);
+        const code = url.searchParams.get("code");
+        const oauthError = url.searchParams.get("error_description") ?? url.searchParams.get("error");
+        if (oauthError) {
+          const responseSocket2 = response.socket;
+          respond(
+            response,
+            "denied",
+            () => finish({ error: new Error(oauthError) }, responseSocket2)
+          );
+          return;
+        }
+        if (url.pathname !== "/callback" || url.searchParams.get("state") !== expectedState || !code) {
+          respond(response, "invalid");
+          return;
+        }
+        startAuthorization();
+        progress({ status: "completed", step: "browser-authorization" });
+        const responseSocket = response.socket;
+        respond(response, "complete", () => finish({ code }, responseSocket));
+      });
+      server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+      });
+      server.once("error", (error) => finish({ error }));
+      progress({ status: "started", step: "callback-server" });
+      server.listen(17655, "localhost", () => {
+        progress({ status: "completed", step: "callback-server" });
+        progress({ status: "started", step: "browser" });
+        void ready().then(startAuthorization).catch(
+          (error) => finish({
+            error: error instanceof Error ? error : new Error("Could not open the login browser.")
+          })
+        );
+      });
+    });
   }
 };
-
-// src/contracts.ts
-var ajv = new Ajv2020({ allErrors: true, useDefaults: true });
-ajv.addKeyword({ keyword: "x-tonbo-profiles" });
-ajv.addKeyword({ keyword: "x-tonbo-version" });
-ajv.addKeyword({ keyword: "x-tonbo-public-hostname-apex" });
-ajv.addKeyword({ keyword: "x-tonbo-public-hostname-template" });
-ajv.addSchema(kubernetesProfilesSchema);
-ajv.addSchema(piAgentSchema);
-ajv.addSchema(agentNameContract);
-ajv.addSchema(agentServiceSchema);
-var validateDeclaration = ajv.compile(declarationSchema);
-var validateDeploymentSpec = ajv.compile(deploymentSchema);
-function validationMessage(label, errors) {
-  const detail = errors?.map((error) => `${error.instancePath || "/"} ${error.message}`).join("; ");
-  return `${label} is invalid${detail ? `: ${detail}` : "."}`;
+function respond(response, outcome, finished) {
+  const page = callbackResponse(outcome);
+  if (finished) response.once("finish", finished);
+  response.writeHead(page.status, { ...page.headers, connection: "close" });
+  response.end(page.body);
 }
-function parseDeclaration(value) {
-  const candidate = structuredClone(value);
-  if (!validateDeclaration(candidate)) {
-    throw new Error(validationMessage(".tonbo TOML", validateDeclaration.errors));
-  }
-  return candidate;
+async function openBrowser(url) {
+  if (process.platform === "darwin") return void await exec("open", [url]);
+  if (process.platform === "win32")
+    return void await exec("rundll32", ["url.dll,FileProtocolHandler", url]);
+  return void await exec("xdg-open", [url]);
 }
-function assertManagedDeploymentSpec(value) {
-  if (!validateDeploymentSpec(value)) {
-    throw new Error(validationMessage("Managed Deployment spec", validateDeploymentSpec.errors));
+
+// ../../packages/agent-source-bundler/dist/src/generated/contracts.js
+var inferenceDefault = { "model": "claude-sonnet-5" };
+var sourceBundleContract = { "version": 1, "format": "tar-v1", "key_prefix": "agent-source-bundles", "content_type": "application/vnd.tonbo.source+tar", "max_bytes": 67108864 };
+var piSessionContract = { "version": 1, "adapter": "pi-jsonl-v3", "format_version": 3, "durable_completion_timeout_seconds": 30, "turn_claim_seconds": 30, "turn_claim_renew_seconds": 10, "session_directory": "/sessions", "path_template": "/sessions/{session_id}.jsonl", "preflight_command": ["/usr/local/bin/artifacts", "runtime", "session-preflight"] };
+
+// ../../packages/agent-source-bundler/dist/src/inference-default.js
+var DEFAULT_INFERENCE_MODEL = inferenceDefault.model;
+
+// ../../packages/agent-source-bundler/dist/src/deployment-origin.js
+function deploymentOriginLabel(actor) {
+  return actor === "onboarding" ? "Setup guide" : "tonbo deploy";
+}
+function githubRepositoryUrl(remote) {
+  if (typeof remote !== "string" || !remote || /\s/.test(remote) || [...remote].some((character) => character.charCodeAt(0) < 32))
+    return null;
+  let path6;
+  const ssh = /^git@github\.com:([^?#]+)$/.exec(remote);
+  if (ssh)
+    path6 = ssh[1];
+  else {
+    try {
+      const url = new URL(remote);
+      if (url.hostname !== "github.com" || url.port || !["https:", "ssh:"].includes(url.protocol))
+        return null;
+      path6 = url.pathname.slice(1);
+    } catch {
+      return null;
+    }
   }
+  path6 = path6.replace(/\/$/, "").replace(/\.git$/, "");
+  const parts = path6.split("/");
+  if (parts.length !== 2 || !/^[a-z\d](?:[a-z\d-]{0,38})$/i.test(parts[0]) || !/^[a-z\d._-]{1,100}$/i.test(parts[1]) || [".", ".."].includes(parts[1]))
+    return null;
+  return `https://github.com/${parts[0]}/${parts[1]}`;
 }
 
-// src/declaration.ts
-import { DEFAULT_INFERENCE_MODEL } from "@tonbo/agent-source-bundler/inference-default";
+// src/commands.ts
+import path4 from "node:path";
+
+// src/build.ts
+import { spawn } from "node:child_process";
+async function runBuildCommand(root, command) {
+  if (command.length === 0) throw new Error("Build command must not be empty.");
+  await new Promise((resolve, reject) => {
+    const child = spawn(command[0], command.slice(1), {
+      cwd: root,
+      env: process.env,
+      // Command output is progress, not the CLI result. Keep stdout available
+      // for the single JSON document emitted by `tonbo --json deploy`.
+      stdio: ["inherit", process.stderr, process.stderr]
+    });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) resolve();
+      else
+        reject(
+          new Error(
+            `Build command failed${signal ? ` with signal ${signal}` : ` with status ${code}`}.`
+          )
+        );
+    });
+  });
+}
 
-// ../../packages/agent-source-bundler/src/native-pi.ts
+// ../../packages/agent-source-bundler/dist/src/native-pi.js
 import { stringify } from "smol-toml";
 function nativePiDeclaration(model) {
   return {
@@ -1382,7 +1429,7 @@ function buildDeploymentSpec(declaration, source) {
   return spec;
 }
 
-// ../../packages/agent-source-bundler/src/index.ts
+// ../../packages/agent-source-bundler/dist/src/index.js
 import { createHash as createHash2 } from "node:crypto";
 import { lstat as lstat3, readFile as readFile3, readdir } from "node:fs/promises";
 import path3 from "node:path";
@@ -1405,7 +1452,8 @@ var DEFAULT_IGNORES = [
 var EXACT_NPM_VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 var GIT_COMMIT = /^[0-9a-f]{40}$/i;
 function packageSource(value, index) {
-  if (typeof value === "string") return value;
+  if (typeof value === "string")
+    return value;
   if (value && typeof value === "object" && "source" in value && typeof value.source === "string")
     return value.source;
   throw new Error(`.pi/settings.json packages[${index}] must be a source string or object.`);
@@ -1415,9 +1463,7 @@ async function validatePackageSource(root, source) {
     const specifier = source.slice(4);
     const separator = specifier.lastIndexOf("@");
     if (separator <= 0 || !EXACT_NPM_VERSION.test(specifier.slice(separator + 1))) {
-      throw new Error(
-        `PI package ${source} must pin an exact npm version, for example npm:my-agent@1.2.3.`
-      );
+      throw new Error(`PI package ${source} must pin an exact npm version, for example npm:my-agent@1.2.3.`);
     }
     return;
   }
@@ -1449,9 +1495,7 @@ async function validatePackageSource(root, source) {
     }
     return;
   }
-  throw new Error(
-    `PI package ${source} must use an exact npm version, a full Git commit, or a agent-local path.`
-  );
+  throw new Error(`PI package ${source} must use an exact npm version, a full Git commit, or a agent-local path.`);
 }
 async function validatePiPackages(root) {
   const filename = path3.join(root, ".pi", "settings.json");
@@ -1459,23 +1503,26 @@ async function validatePiPackages(root) {
   try {
     settings = JSON.parse(await readFile3(filename, "utf8"));
   } catch (error) {
-    if (error.code === "ENOENT") return;
+    if (error.code === "ENOENT")
+      return;
     throw new Error(`Could not read ${filename} as JSON.`, { cause: error });
   }
-  if (!settings || typeof settings !== "object" || !("packages" in settings)) return;
+  if (!settings || typeof settings !== "object" || !("packages" in settings))
+    return;
   const packages = settings.packages;
-  if (!Array.isArray(packages)) throw new Error(`${filename} packages must be an array.`);
-  await Promise.all(
-    packages.map((value, index) => validatePackageSource(root, packageSource(value, index)))
-  );
+  if (!Array.isArray(packages))
+    throw new Error(`${filename} packages must be an array.`);
+  await Promise.all(packages.map((value, index) => validatePackageSource(root, packageSource(value, index))));
 }
 async function findDeclarationRoot(start) {
   let candidate = path3.resolve(start);
   for (; ; ) {
     try {
-      if ((await lstat3(path3.join(candidate, ".tonbo"))).isFile()) return candidate;
+      if ((await lstat3(path3.join(candidate, ".tonbo"))).isFile())
+        return candidate;
     } catch (error) {
-      if (error.code !== "ENOENT") throw error;
+      if (error.code !== "ENOENT")
+        throw error;
     }
     const parent = path3.dirname(candidate);
     if (parent === candidate) {
@@ -1489,7 +1536,8 @@ async function sourceIgnore(root) {
   try {
     matcher.add(await readFile3(path3.join(root, ".tonboignore"), "utf8"));
   } catch (error) {
-    if (error.code !== "ENOENT") throw error;
+    if (error.code !== "ENOENT")
+      throw error;
   }
   return matcher;
 }
@@ -1502,11 +1550,10 @@ async function collectFiles(root) {
     for (const entry of entries) {
       const relative = relativeDirectory ? `${relativeDirectory}/${entry.name}` : entry.name;
       const ignored = matcher.ignores(relative + (entry.isDirectory() ? "/" : ""));
-      if (ignored) continue;
+      if (ignored)
+        continue;
       if (relative === SESSION_SOURCE_DIRECTORY || relative.startsWith(`${SESSION_SOURCE_DIRECTORY}/`)) {
-        throw new Error(
-          `Source path ${SESSION_SOURCE_DIRECTORY}/ is reserved for durable PI history. Rename it or exclude it with .tonboignore.`
-        );
+        throw new Error(`Source path ${SESSION_SOURCE_DIRECTORY}/ is reserved for durable PI history. Rename it or exclude it with .tonboignore.`);
       }
       const absolute = path3.join(directory, entry.name);
       if (entry.isDirectory()) {
@@ -1515,9 +1562,7 @@ async function collectFiles(root) {
       }
       const metadata = await lstat3(absolute);
       if (!metadata.isFile()) {
-        throw new Error(
-          `Source path ${relative} is not a regular file. V1 does not follow symlinks or special files.`
-        );
+        throw new Error(`Source path ${relative} is not a regular file. V1 does not follow symlinks or special files.`);
       }
       files.push({
         absolute,
@@ -1535,19 +1580,15 @@ async function collectFiles(root) {
 }
 function addEntry(pack, file, contents) {
   return new Promise((resolve, reject) => {
-    pack.entry(
-      {
-        gid: 0,
-        mode: file.mode,
-        mtime: /* @__PURE__ */ new Date(0),
-        name: file.relative,
-        size: contents.length,
-        type: "file",
-        uid: 0
-      },
-      contents,
-      (error) => error ? reject(error) : resolve()
-    );
+    pack.entry({
+      gid: 0,
+      mode: file.mode,
+      mtime: /* @__PURE__ */ new Date(0),
+      name: file.relative,
+      size: contents.length,
+      type: "file",
+      uid: 0
+    }, contents, (error) => error ? reject(error) : resolve());
   });
 }
 async function buildSourceBundle(root) {
@@ -1564,9 +1605,7 @@ async function buildSourceBundle(root) {
   pack.on("data", (chunk) => {
     size += chunk.length;
     if (size > MAX_BUNDLE_BYTES) {
-      pack.destroy(
-        new Error(`Source bundle exceeds ${MAX_BUNDLE_BYTES} bytes after ignore rules.`)
-      );
+      pack.destroy(new Error(`Source bundle exceeds ${MAX_BUNDLE_BYTES} bytes after ignore rules.`));
       return;
     }
     chunks.push(chunk);
@@ -1727,7 +1766,7 @@ async function initCommand(deps, options) {
     entry = (await deps.prompt("PI SDK entry file [dist/agent.mjs]: ")).trim();
   }
   entry ||= "dist/agent.mjs";
-  let model = options.model?.trim() || existingDeclaration?.inference.model || DEFAULT_INFERENCE_MODEL2;
+  let model = options.model?.trim() || existingDeclaration?.inference.model || DEFAULT_INFERENCE_MODEL;
   let buildCommand = driver === "command" ? options.buildCommand ?? existingDeclaration?.build?.command ?? ["npm", "run", "build"] : void 0;
   let agentPlan = existingDeclaration?.agent ? {
     kind: "existing",
@@ -2666,6 +2705,10 @@ function createProgram(dependencies = createDependencies) {
     async (options) => initCommand(dependencies(jsonOutput(program)), options)
   );
   program.command("login").description("sign in through the browser and store the session in the user config").action(async () => loginCommand(dependencies(jsonOutput(program))));
+  program.command("region").description("discover regions and Machine allocation availability").command("list").action(async () => {
+    const deps = dependencies(jsonOutput(program));
+    deps.output(await deps.api.listRegions(await deps.auth.accessToken()));
+  });
   const machine = program.command("machine").description("manage independent account-owned Machines");
   machine.command("list").option("--account <account>", "account UUID").action(async (options) => {
     const deps = dependencies(jsonOutput(program));
@@ -2676,7 +2719,7 @@ function createProgram(dependencies = createDependencies) {
       )
     );
   });
-  machine.command("allocate").requiredOption("--account <account>", "owning account UUID").requiredOption("--region <region>", "compute region (currently us-east-1)").action(async (options) => {
+  machine.command("allocate").requiredOption("--account <account>", "owning account UUID").requiredOption("--region <region>", "compute region (see tonbo region list)").action(async (options) => {
     const deps = dependencies(jsonOutput(program));
     deps.output(
       await deps.api.machineRequest(await deps.auth.accessToken(), "", "POST", {