@credibledata/cred-cli 0.0.103 → 0.0.105

package/dist/commands/misc/setup.js

@@ -0,0 +1,819 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTarget = resolveTarget;
+exports.scopeCommandToDirectory = scopeCommandToDirectory;
+exports.refuseWriteUnderIgnoredPin = refuseWriteUnderIgnoredPin;
+exports.credStoreToRefresh = credStoreToRefresh;
+exports.needsNoSession = needsNoSession;
+exports.describeIdentity = describeIdentity;
+exports.pinnedIdentity = pinnedIdentity;
+exports.listProxiedConnections = listProxiedConnections;
+exports.parseConnectionsFlag = parseConnectionsFlag;
+exports.parseSkillsFlag = parseSkillsFlag;
+exports.parsePortFlag = parsePortFlag;
+exports.setup = setup;
+exports.dev = dev;
+const path_1 = __importDefault(require("path"));
+const kleur_1 = __importDefault(require("kleur"));
+const axios_1 = require("axios");
+const api_1 = require("../../client/api");
+const shared_1 = require("../database/shared");
+const configuration_1 = require("../../client/configuration");
+const api_2 = require("../../client-codeassist/api");
+const configuration_2 = require("../../client-codeassist/configuration");
+const clientconfiguration_1 = require("../../clientconfiguration");
+const createconnections_1 = require("../connection/createconnections");
+const constants_1 = require("../../constants");
+const logger_1 = require("../../logger");
+const setenvironment_1 = require("../environment/setenvironment");
+const login_1 = require("./login");
+const utils_1 = require("../../utils");
+const folderconfig_1 = require("../../setup-core/folderconfig");
+const flow_1 = require("../../setup-core/flow");
+const briefing_1 = require("../../setup-core/briefing");
+const host_1 = require("../../setup-core/host");
+const ports_1 = require("../../setup-core/ports");
+const publisherversion_1 = require("../../setup-core/publisherversion");
+const importconnections_1 = require("../../setup-core/importconnections");
+const refresh_1 = require("../../setup-core/refresh");
+const skills_1 = require("../../setup-core/skills");
+const inquirerHost_1 = require("./inquirerHost");
+/**
+ * `cred init` and `cred dev` — the terminal front door.
+ *
+ * Both are thin: they build a Host, resolve where the control plane is, and hand
+ * off to `setup-core`. Everything worth reviewing is in the library, because the
+ * VS Code extension will run exactly the same steps.
+ */
+const connectionsApi = new api_1.ConnectionsApi(new configuration_1.Configuration());
+const codeAssistApi = new api_2.CodeAssistApi(new configuration_2.Configuration());
+/**
+ * Which deployment these commands act against, and with whose credentials.
+ *
+ * `~/.cred` stores tokens, organization and Credible environment *per
+ * deployment*, so the deployment has to be resolved before the credential store
+ * is read — not after. The store takes the resolved value as an override so
+ * every read (token, org, environment) comes from the same deployment the
+ * control-plane calls go to; resolving one without the other is how you end up
+ * presenting a staging token to production.
+ *
+ * Precedence lives in {@link resolveDeployment}: `--cell`, the directory's
+ * `.credible/config.json` pin, then the global `~/.cred` value.
+ */
+function resolveTarget(cwd, 
+/** The global store; `~/.cred` unless a caller (a spec) supplies another. */
+globalStore = new clientconfiguration_1.ClientConfiguration(), flag = (0, utils_1.cellFlag)()) {
+    const { deployment, from } = (0, folderconfig_1.resolveDeployment)({
+        cwd,
+        globalDefault: globalStore.getEnvironment(),
+        flag,
+    });
+    // Always pinned, even when the resolved deployment is the global one: the
+    // override then reads the same value the file would have given, so there is
+    // no second code path to reason about.
+    return {
+        deployment,
+        from,
+        credStore: globalStore.pinnedTo(deployment),
+    };
+}
+/**
+ * The command paths that run the publish action. `add version` is `publish`
+ * under its resource-shaped name.
+ */
+const PUBLISH_COMMANDS = new Set(["publish", "add version"]);
+/**
+ * The commands that act on the deployment this directory is pinned to, by
+ * command path. Each one's action calls {@link resolveTarget}.
+ */
+const PINNED_COMMANDS = new Set([...PUBLISH_COMMANDS, "add connection"]);
+/**
+ * The commands that do not take the directory's pin: they set or report the
+ * global identity, or resolve the pin themselves (`init`, `dev`, `status`,
+ * and the {@link PINNED_COMMANDS}, which print their own target line).
+ */
+const UNSCOPED_COMMANDS = new Set([
+    "login",
+    "logout",
+    "set-access-token",
+    "set",
+    "init",
+    "dev",
+    "status",
+    "help",
+]);
+/** Resources that belong to an organization and not to an environment. */
+const ORG_ONLY_RESOURCES = new Set([
+    "group",
+    "groups",
+    "group-access-token",
+    "member",
+]);
+/**
+ * Scope every org- and environment-scoped command run in `cwd` to the
+ * directory's pin, and say so, the way `cred publish` already did. Returns the
+ * line printed, or undefined when there is no pin or the command is exempt.
+ *
+ * `cred set ...` stays global on purpose: it is how a user changes their
+ * default, and re-pinning a directory is `cred --cell <cell> init`. In a pinned
+ * directory it says so rather than appearing to do nothing.
+ */
+function scopeCommandToDirectory(commandPath, cwd, log) {
+    var _a, _b, _c, _d;
+    if (!commandPath)
+        return undefined;
+    const command = commandPath.split(" ")[0];
+    if (UNSCOPED_COMMANDS.has(command) && command !== "set")
+        return undefined;
+    const target = resolveTarget(cwd);
+    const identity = pinnedIdentity(cwd, target.credStore);
+    const pinned = identity.from === "folder" || target.from === "folder";
+    // Groups, their members and tokens belong to the organization alone, so
+    // naming an environment there would describe something the command ignores.
+    const orgOnly = ORG_ONLY_RESOURCES.has((_a = commandPath.split(" ")[1]) !== null && _a !== void 0 ? _a : "");
+    const where = describeIdentity(target.deployment, identity, identity.from, target.from, orgOnly ? "organization" : "environment");
+    if (command === "set") {
+        if (pinned) {
+            log(`This directory stays on ${where} \`cred set\` changes your global settings; \`cred --cell <cell> init\` re-pins this directory.`);
+        }
+        return undefined;
+    }
+    // Named in every confirmation, pinned or not: the global case is the one
+    // most likely to be wrong, as `describeIdentity` explains.
+    (0, utils_1.setCommandTarget)(orgOnly
+        ? `organization ${(_b = identity.organization) !== null && _b !== void 0 ? _b : "?"} on ${target.deployment}`
+        : `${(_c = identity.organization) !== null && _c !== void 0 ? _c : "?"}/${(_d = identity.environment) !== null && _d !== void 0 ? _d : "?"} on ${target.deployment}`);
+    // These print their own "Publishing to …" line and resolve the pin
+    // themselves.
+    if (PINNED_COMMANDS.has(commandPath))
+        return undefined;
+    if (pinned) {
+        clientconfiguration_1.ClientConfiguration.scopeCommand({
+            deployment: target.deployment,
+            organization: identity.organization,
+            environment: identity.environment,
+        });
+    }
+    // Every time, pinned or global, so an agent always has the line to check
+    // against the organization and environment it means.
+    const line = `Using ${where}`;
+    log(line);
+    return line;
+}
+/**
+ * Refuse a write whose `--cell` makes the directory's pin inert. Takes
+ * Commander's resolved command path: the argv heuristic that scopes reads
+ * reads `publish --replication 2` as `publish 2`.
+ */
+function refuseWriteUnderIgnoredPin(commandPath, cwd) {
+    if (!PINNED_COMMANDS.has(commandPath))
+        return;
+    const target = resolveTarget(cwd);
+    refuseIgnoredPin(commandPath, pinnedIdentity(cwd, target.credStore).ignoredPin, target.deployment);
+}
+/**
+ * The credential store the `preAction` refresh has to renew for a command.
+ *
+ * A pinned command sends the pinned deployment's token, so that is the one to
+ * check. Checking the global one instead failed `cred publish` with "not logged
+ * in" in a directory pinned to a deployment whose login was fine, whenever the
+ * global deployment's login had lapsed.
+ */
+function credStoreToRefresh(commandPath, cwd, globalStore) {
+    return PINNED_COMMANDS.has(commandPath)
+        ? resolveTarget(cwd).credStore
+        : globalStore;
+}
+/**
+ * Whether the `preAction` refresh must skip this command: `publish --dry-run`
+ * (and `add version --dry-run`) uploads nothing and needs no login. Without
+ * this, a logged-out user's preview exited 1 before `publish` was reached.
+ */
+function needsNoSession(commandPath, options) {
+    return PUBLISH_COMMANDS.has(commandPath) && Boolean(options.dryRun);
+}
+/**
+ * Say where a command is about to act, and on whose say-so.
+ *
+ * Always, not only when a pin was involved. The silent case used to be the
+ * global fallback, which is exactly the one most likely to be wrong: `cred
+ * init` writes the settled organization and environment back to `~/.cred` as
+ * well as to the pin, so running init in `repo/pkg-a` moves the global too —
+ * and a later `cred publish` from an unpinned `repo/` picks those up and
+ * publishes to pkg-a's environment without a word. Naming the source is what
+ * makes that visible before the upload rather than after it.
+ */
+function describeIdentity(deployment, identity, from, deploymentFrom, 
+/** `organization` for a command that has no environment, such as groups. */
+scope = "environment") {
+    var _a, _b, _c;
+    const where = from === "folder"
+        ? "pinned in .credible/config.json"
+        : deploymentFrom === "flag"
+            ? `set by --cell${identity.ignoredPin ? ` (this directory's pin to ${identity.ignoredPin} is ignored)` : ""}`
+            : // Names `cred init` and no flags: the callers, `publish` and
+                // `add connection`, have no --organization/--environment.
+                "from your global settings (~/.cred) — run `cred init` here to pin this directory";
+    const target = scope === "organization"
+        ? `organization ${(_a = identity.organization) !== null && _a !== void 0 ? _a : "?"}`
+        : `${(_b = identity.organization) !== null && _b !== void 0 ? _b : "?"}/${(_c = identity.environment) !== null && _c !== void 0 ? _c : "?"}`;
+    return `${target} on ${deployment}, ${where}.`;
+}
+/**
+ * The directory's pin, unless it is for another cell than `deployment`: its
+ * organization and environment name things in that cell, so `--cell` ignores
+ * them (and `ignoredPin` says which cell they were for).
+ */
+function pinFor(cwd, deployment) {
+    var _a;
+    const pinCell = (0, folderconfig_1.resolveDeployment)({ cwd, globalDefault: deployment });
+    if (pinCell.from === "folder" && pinCell.deployment !== deployment) {
+        return { ignoredPin: pinCell.deployment };
+    }
+    return { pin: (_a = (0, folderconfig_1.findFolderConfig)(cwd)) === null || _a === void 0 ? void 0 : _a.config };
+}
+/**
+ * `--cell` ignores a pin for another cell, so a write that followed it would
+ * act on an organization and environment the directory never named. `cred init`
+ * is the one explicit re-pin.
+ */
+function refuseIgnoredPin(command, ignoredPin, deployment) {
+    if (!ignoredPin)
+        return;
+    throw new host_1.SetupError(`\`cred ${command}\` writes, and this directory is pinned to ${ignoredPin}, not ${deployment}.`, `run \`cred --cell ${deployment} init\` to re-pin it on purpose, or drop --cell.`);
+}
+/**
+ * The organization and environment a command in `cwd` acts on: the directory's
+ * pin when there is one, else the global `~/.cred` value — the same precedence
+ * `init` and `dev` apply, minus flags. `cred publish` and the standalone
+ * connection import read this rather than the global value alone: a
+ * `cred add environment` in another tab moves the global, and a publish that
+ * followed it went to that environment while the pin named another.
+ */
+function pinnedIdentity(cwd, credStore) {
+    const { pin, ignoredPin } = pinFor(cwd, credStore.getEnvironment());
+    const resolved = (0, folderconfig_1.resolveIdentity)({
+        flag: {},
+        folder: {
+            organization: pin === null || pin === void 0 ? void 0 : pin.organization,
+            environment: pin === null || pin === void 0 ? void 0 : pin.environment,
+        },
+        global: {
+            organization: credStore.getOrganization(),
+            environment: credStore.getProject(),
+        },
+    });
+    return {
+        organization: resolved.organization.value,
+        environment: resolved.environment.value,
+        from: resolved.environment.from === "folder" ||
+            resolved.organization.from === "folder"
+            ? "folder"
+            : "global",
+        ignoredPin,
+    };
+}
+function hasConnections(wired) {
+    return wired.config.environments[0].connections.length > 0;
+}
+/**
+ * The last line for an environment with no connections. Not "now open
+ * claude": the server is up, but every query an agent tries will fail.
+ */
+function servingWithoutConnections(uiUrl) {
+    return `Publisher is serving ${kleur_1.default.cyan(uiUrl)}, but the environment has no connections, so there is nothing to query yet. To fix it, ${briefing_1.NO_CONNECTIONS_NEXT_STEP}.`;
+}
+/**
+ * What the local Publisher proxies: the environment's connections, then each
+ * `READY` database under its own name (database-design.md §12.5). A database
+ * is not on the connections list, but it is addressed through the same
+ * router route, so `buildPublisherConfig` gives it the same `connectionUriFor`
+ * and `@malloydata/db-publisher` needs no change.
+ *
+ * A 404 from `listDatabases` is a deployment without databases, so it adds
+ * none. Any other failure is a warning, not a failed `cred dev`: the
+ * connections alone still serve every model that does not read a database.
+ */
+function listProxiedConnections(controlPlane, credStore, organization, credibleEnvironment) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        const options = { baseURL: controlPlane, headers: credStore.getHeaders() };
+        const connections = (_a = (yield connectionsApi.listConnections(organization, credibleEnvironment, -1, 0, options)).data) !== null && _a !== void 0 ? _a : [];
+        let databases = [];
+        try {
+            const listed = (_b = (yield shared_1.databasesApi.listDatabases(organization, credibleEnvironment, -1, 0, options)).data) !== null && _b !== void 0 ? _b : [];
+            databases = listed
+                .filter((database) => database.status === "READY")
+                .map((database) => ({ name: database.name }));
+        }
+        catch (error) {
+            if (!((0, axios_1.isAxiosError)(error) && ((_c = error.response) === null || _c === void 0 ? void 0 : _c.status) === 404)) {
+                logger_1.logger.warn(`Could not list the databases of '${credibleEnvironment}' (${(0, utils_1.describeApiError)(error)}), so the local Publisher has its connections only.`);
+            }
+        }
+        const named = new Set(connections.map((c) => c.name));
+        return [
+            ...connections,
+            ...databases.filter((database) => !named.has(database.name)),
+        ];
+    });
+}
+function buildContext(deployment, credStore, canOpenBrowser, identity) {
+    const controlPlane = constants_1.controlPlanesByEnv[deployment];
+    return {
+        host: (0, inquirerHost_1.createInquirerHost)({ canOpenBrowser, session: credStore }),
+        credStore,
+        deployment,
+        publisherVersion: publisherversion_1.PUBLISHER_VERSION,
+        cwd: process.cwd(),
+        showAllPublisherOutput: logger_1.debugRequested,
+        listConnections: (organization, credibleEnvironment) => listProxiedConnections(controlPlane, credStore, organization, credibleEnvironment),
+        // Bound to the pair `chooseTarget` settled, not read from the store at
+        // call time: another terminal's `cred set environment` while the
+        // credential question is open must not redirect the create.
+        createConnection: (0, createconnections_1.makeConnectionCreator)(controlPlane, credStore, {
+            organization: identity.organization,
+            environment: identity.credibleEnvironment,
+        }),
+        fetchSkills: (manifest) => __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const response = yield codeAssistApi.getAgentSkills(manifest, undefined, undefined, {
+                    baseURL: constants_1.codeAssistByEnv[deployment],
+                    headers: credStore.getHeaders(),
+                });
+                return response.data;
+            }
+            catch (error) {
+                // A deployment without the endpoint has no skills to offer; that
+                // is a skip, not a failure. Anything else is reported by the flow.
+                if ((0, axios_1.isAxiosError)(error) && ((_a = error.response) === null || _a === void 0 ? void 0 : _a.status) === 404) {
+                    return undefined;
+                }
+                throw new Error((0, utils_1.describeApiError)(error));
+            }
+        }),
+    };
+}
+/**
+ * Parse `--connections`. Anything but the two keywords is a name list.
+ *
+ * Empty names (`a,,b`, a trailing comma) are dropped rather than passed on as
+ * a lookup for `''` that fails with a confusing "no connection named ''".
+ */
+function parseConnectionsFlag(value) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    if (trimmed === "all" || trimmed === "none")
+        return trimmed;
+    const names = trimmed
+        .split(",")
+        .map((name) => name.trim())
+        .filter(Boolean);
+    if (names.length === 0) {
+        throw new host_1.UsageError(`${importconnections_1.CONNECTIONS_FLAG} was given '${value}', which names nothing.`, "pass all, none, or a comma-separated list of connection names.");
+    }
+    return names;
+}
+/**
+ * Report a SetupError as its message, and anything else as itself.
+ *
+ * A question that could not be asked exits 2, not 1: it is the one failure a
+ * caller can fix by re-running with the flag the message names, and a script
+ * needs to tell that apart from "setup broke".
+ */
+function reportAndExit(error) {
+    if (error instanceof host_1.NeedsInputError) {
+        logger_1.logger.error(error.message);
+        process.exit(error.exitCode);
+    }
+    if (error instanceof host_1.ReportedSetupError) {
+        process.exit(1);
+    }
+    if (error instanceof host_1.UsageError) {
+        logger_1.logger.error(error.message);
+        process.exit(error.exitCode);
+    }
+    if (error instanceof host_1.SetupError) {
+        logger_1.logger.error(error.message);
+    }
+    else {
+        logger_1.logger.error(error instanceof Error ? error.message : String(error));
+    }
+    process.exit(1);
+}
+/**
+ * Make sure we are logged in with an organization and an environment, prompting
+ * for whatever is missing.
+ *
+ * This is what makes `cred init` the single command a new user is told to type.
+ * `cred login` and `cred set environment` still exist — they are what you run
+ * *again* — but a first-time user should not have to know they come first, and
+ * should certainly not learn it from an error message.
+ *
+ * This is also why `init` and `dev` are exempt from the global token-refresh
+ * hook in `index.ts`: that hook exits the process when it finds no credentials,
+ * which for these two commands is the state they exist to resolve. They do their
+ * own refresh here instead — a spent-but-refreshable token has to renew silently
+ * rather than trigger a browser round-trip, since the `listConnections` call in
+ * `wireDirectory` needs a live token either way.
+ *
+ * `organization` is the one already known — `--organization`, else the pin's.
+ * Dropping it failed every AWS login (its tenant needs the organization up
+ * front) and, on GCP, opened the organization picker, which exits 2 without a
+ * terminal even when `-o` named it.
+ */
+function ensureLoggedIn(credStore, organization) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const refreshed = yield (0, refresh_1.ensureFreshTokens)(credStore);
+        if (refreshed.status === "offline" || refreshed.status === "not-renewable") {
+            logger_1.logger.warn(refreshed.reason);
+        }
+        const needsLogin = refreshed.status === "logged-out" || !credStore.isTokenValid().valid;
+        if (needsLogin) {
+            logger_1.logger.info("You are not logged in yet — starting that now.");
+            const currentEnv = credStore.getEnvironment();
+            // The cluster is this deployment's, asked for explicitly: named alone,
+            // an organization picks its own default cluster, which can be another
+            // deployment's (videoamp defaults to gcp), and the tokens would land in
+            // a slot nothing here reads.
+            let target;
+            try {
+                target = (0, login_1.resolveLoginTarget)(currentEnv, organization, constants_1.CLUSTER_BY_ENVIRONMENT[currentEnv]);
+            }
+            catch (error) {
+                throw new host_1.SetupError(error instanceof Error ? error.message : String(error));
+            }
+            yield (0, login_1.login)(organization, constants_1.controlPlanesByEnv[target.targetEnv], undefined, target.cluster, 
+            // The deployment `credStore` is scoped to. Without it login writes the
+            // tokens and organization under the file's global `activeEnvironment`,
+            // and the `getOrganization()` check below then reads a slot login
+            // never touched — so a directory pinned to a non-global deployment,
+            // the case the pin exists for, failed its own first run.
+            target.targetEnv);
+        }
+        if (!credStore.getOrganization()) {
+            // login() persists the organization it resolved, so reaching here means
+            // login did not complete. Its own output already said why.
+            throw new host_1.SetupError("Setup needs an organization and login did not finish.", "run `cred login` and try again.");
+        }
+    });
+}
+/**
+ * Establish which organization and Credible environment this directory is for.
+ *
+ * These two values are baked into `.mcp.json`, the agent briefing and the
+ * publisher config, and they are the expensive ones to get wrong: a directory
+ * wired against the wrong environment looks completely normal until someone
+ * queries it.
+ *
+ * Resolution order is {@link resolveIdentity}'s: a flag, then this directory's
+ * pin, then the global `~/.cred` value. What each mode does with the result:
+ *
+ *  - `always-ask` (`init`) asks unless a flag settled it. It is the
+ *    once-per-directory command, and `selectFromList` skips a prompt with one
+ *    option, so a single-organization user sees no extra step anyway.
+ *  - `confirm` (`dev`) states what the pin says and takes a yes, opening the
+ *    pickers on a no. A flag skips the question and re-pins, which is how
+ *    `cred dev --environment staging` switches a directory over.
+ *
+ * Whatever is settled is written back to the directory's pin by
+ * {@link wireDirectory}, and to `~/.cred` here so unrelated commands
+ * (`cred publish`) act on the same pair.
+ */
+function chooseTarget(credStore, deployment, mode, flags, cwd) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const controlPlane = constants_1.controlPlanesByEnv[deployment];
+        const { pin } = pinFor(cwd, deployment);
+        const resolved = (0, folderconfig_1.resolveIdentity)({
+            flag: flags,
+            folder: {
+                organization: pin === null || pin === void 0 ? void 0 : pin.organization,
+                environment: pin === null || pin === void 0 ? void 0 : pin.environment,
+            },
+            global: {
+                organization: credStore.getOrganization(),
+                environment: credStore.getProject(),
+            },
+        });
+        // A flag is an instruction, not a suggestion, so it is never confirmed. It is
+        // also the only path a script can take, and a script cannot answer a prompt.
+        //
+        // Either flag suppresses the confirmation, not both together. The shortcut
+        // below persists what it confirms *without validating it*, so with one flag
+        // set it read the flag's value back out of `resolveIdentity`, put it in the
+        // prompt, and wrote a yes straight to disk — which is how `cred dev
+        // --environment stagng` re-pinned a directory to a typo and then failed
+        // somewhere far from the cause. A named value goes through `setEnvironment`.
+        const flagged = resolved.organization.from === "flag" ||
+            resolved.environment.from === "flag";
+        // A "no" to the confirmation below. `settleTarget` in `confirm` mode keeps
+        // the resolved pair, so without this a decline re-wired the very pair the
+        // user had just turned down.
+        let declined = false;
+        if (!flagged && mode === "confirm") {
+            const { value: organization } = resolved.organization;
+            const { value: environment } = resolved.environment;
+            if (organization && environment) {
+                // The confirm re-states recorded state, so without a terminal it is
+                // taken as a yes rather than refused: `cred dev` in an agent's shell
+                // must start the publisher, not exit asking for a flag that would
+                // only repeat what the pin already says. `--yes` is the same answer
+                // given on purpose.
+                // Taken as a yes silently: `dev` has already printed the target line
+                // every scoped command prints, so saying it again here repeated it.
+                const keep = flags.yes || !(0, utils_1.isInteractive)()
+                    ? true
+                    : yield (0, utils_1.getConfirmation)(`Use organization ${kleur_1.default.cyan(organization)} and environment ${kleur_1.default.cyan(environment)}?`, credStore, { flag: "--yes" });
+                if (keep)
+                    return persist(credStore, organization, environment);
+                declined = true;
+            }
+        }
+        // `~/.cred` gets the settled pair or nothing. The organization has to be in
+        // the store before `setEnvironment` can list its environments, so a refused
+        // environment would otherwise leave the new organization beside the old
+        // environment — a pair nobody chose, which the next unpinned `cred publish`
+        // targets.
+        const before = {
+            organization: credStore.getOrganization(),
+            environment: credStore.getProject(),
+        };
+        const restore = () => {
+            credStore.setOrganization(before.organization);
+            credStore.setProject(before.environment);
+        };
+        // Ctrl-C at a picker does not throw. Inquirer closes the prompt and re-raises
+        // SIGINT at the process, and nothing else is listening yet (the supervisor
+        // subscribes once it spawns), so Node exited with the new organization and
+        // no environment on disk. Listening here is also what keeps Node from
+        // exiting on its own, so this handler has to exit.
+        const onSignal = (signal) => {
+            restore();
+            process.exit(signal === "SIGINT" ? 130 : 1);
+        };
+        for (const signal of inquirerHost_1.INTERRUPTS)
+            process.once(signal, onSignal);
+        try {
+            return yield settleTarget(credStore, controlPlane, declined ? "always-ask" : mode, flags, resolved);
+        }
+        catch (error) {
+            restore();
+            throw error;
+        }
+        finally {
+            for (const signal of inquirerHost_1.INTERRUPTS)
+                process.off(signal, onSignal);
+        }
+    });
+}
+/** The part of {@link chooseTarget} that writes to the store as it goes. */
+function settleTarget(credStore, controlPlane, mode, flags, resolved) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        // `confirm` mode keeps the organization it already resolved rather than
+        // re-asking: `cred dev --environment other-bars` is a request to change the
+        // environment, and answering an organization picker to do it would be a
+        // question the user has already answered once for this directory.
+        const organization = (_b = (_a = flags.organization) !== null && _a !== void 0 ? _a : (mode === "confirm" ? resolved.organization.value : undefined)) !== null && _b !== void 0 ? _b : 
+        // `cred init` and `cred dev` both take `--organization`; the default
+        // hint names `cred login <organization>`, a different command.
+        (yield (0, login_1.resolveOrganization)(undefined, controlPlane, credStore, "--organization <name>"));
+        credStore.setOrganization(organization);
+        // Both front doors take `--create-environment`. `dev` once pointed at
+        // `cred add environment` instead, which creates on the pin's organization:
+        // wrong after `cred dev -o other-org`, where this is the one that is meant.
+        const hints = setenvironment_1.INIT_ENVIRONMENT_HINTS;
+        // The name we asked for, when we named one, for the message below. Left
+        // undefined for the picker, whose answer we do not know in advance.
+        let requested;
+        let accepted;
+        if (flags.environment) {
+            // Validated rather than trusted: `setEnvironment` refuses a name the
+            // organization does not have, and a typo caught here is one that does not
+            // reach the publisher config as a dead connectionUri.
+            requested = flags.environment;
+            accepted = yield (0, setenvironment_1.setEnvironment)(flags.environment, credStore, {
+                createIfMissing: flags.createEnvironment,
+                hints,
+            });
+        }
+        else if (mode === "always-ask" || !resolved.environment.value) {
+            // Cleared first so the picker is a real choice rather than a confirmation
+            // of a stale value. `undefined`, not `""`: an empty string survives
+            // `getProject() ?? "Not set"` in `cred status` and prints a blank line,
+            // so an interrupted setup would report differently from every other
+            // unset-environment path.
+            const current = credStore.getProject();
+            credStore.setProject(undefined);
+            accepted = yield (0, setenvironment_1.setEnvironment)(undefined, credStore, {
+                current,
+                hints,
+            });
+        }
+        else {
+            requested = resolved.environment.value;
+            accepted = yield (0, setenvironment_1.setEnvironment)(requested, credStore, {
+                hints,
+            });
+        }
+        // Asked, not inferred from the store. `setEnvironment` refuses a name by
+        // returning without writing, and the store can still hold that same name
+        // from before: `cred dev --organization other-org` keeps the pin's
+        // environment name, and when other-org lacks it the old value matched and
+        // the directory was re-pinned to an environment its organization does not
+        // have.
+        const chosen = credStore.getProject();
+        if (!accepted) {
+            // `setEnvironment` has already logged what went wrong and how to fix it,
+            // in this front door's own hints; saying it again printed two errors.
+            throw new host_1.ReportedSetupError("Setup needs a Credible environment.");
+        }
+        if (!chosen) {
+            throw new host_1.SetupError("Setup needs a Credible environment.", requested
+                ? `check the name '${requested}', or pass --create-environment to create it.`
+                : `re-run \`cred ${mode === "confirm" ? "dev" : "init"}\` and pick or create one, or pass --environment <name> [--create-environment].`);
+        }
+        return { organization, credibleEnvironment: chosen };
+    });
+}
+/** Record the settled pair globally, and hand it back for the flow to pin. */
+function persist(credStore, organization, credibleEnvironment) {
+    credStore.setOrganization(organization);
+    credStore.setProject(credibleEnvironment);
+    return { organization, credibleEnvironment };
+}
+/** Parse `--skills`. A value outside the three is refused, never guessed at. */
+function parseSkillsFlag(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === "replace" || value === "keep" || value === "none")
+        return value;
+    throw new host_1.UsageError(`${skills_1.SKILLS_FLAG} was given '${value}'.`, "pass replace, keep, or none.");
+}
+/**
+ * Parse `--port`. Refused unless it is a whole number whose MCP partner, 40
+ * above it, is a valid port too; never rounded or clamped into one.
+ */
+function parsePortFlag(value) {
+    if (value === undefined)
+        return undefined;
+    const port = Number(value);
+    if (!/^\d+$/.test(value) || port < ports_1.MIN_UI_PORT || port > ports_1.MAX_UI_PORT) {
+        throw new host_1.UsageError(`${flow_1.PORT_FLAG} was given '${value}'.`, `pass a whole number from ${ports_1.MIN_UI_PORT} to ${ports_1.MAX_UI_PORT}; the MCP server takes the port ${ports_1.MCP_OFFSET} above it. Example: ${flow_1.PORT_FLAG} 4100.`);
+    }
+    return port;
+}
+function setup(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f;
+        let target;
+        try {
+            target = resolveTarget((_a = options.directory) !== null && _a !== void 0 ? _a : process.cwd());
+        }
+        catch (error) {
+            reportAndExit(error);
+        }
+        const { deployment, credStore } = target;
+        try {
+            // Before logging in or choosing an environment, both of which write.
+            (0, flow_1.refuseUnanswerable)(path_1.default.resolve((_b = options.directory) !== null && _b !== void 0 ? _b : process.cwd()), {
+                connections: parseConnectionsFlag(options.connections),
+                skills: parseSkillsFlag(options.skills),
+                package: options.package,
+            }, (0, utils_1.isInteractive)());
+            const port = parsePortFlag(options.port);
+            // A chosen --port is checked even with --no-start: it rewrites the pin
+            // and .mcp.json, so a busy or conflicting pair is refused up front.
+            if (options.start || port !== undefined) {
+                yield (0, flow_1.refuseBesideOtherPublisher)(path_1.default.resolve((_c = options.directory) !== null && _c !== void 0 ? _c : process.cwd()), port);
+            }
+            const { pin, ignoredPin } = pinFor((_d = options.directory) !== null && _d !== void 0 ? _d : process.cwd(), deployment);
+            if (ignoredPin) {
+                logger_1.logger.info(`re-pinning this directory from ${ignoredPin} to ${deployment}`);
+            }
+            yield ensureLoggedIn(credStore, (_e = options.organization) !== null && _e !== void 0 ? _e : pin === null || pin === void 0 ? void 0 : pin.organization);
+            const identity = yield chooseTarget(credStore, deployment, "always-ask", {
+                organization: options.organization,
+                environment: options.environment,
+                createEnvironment: options.createEnvironment,
+            }, (_f = options.directory) !== null && _f !== void 0 ? _f : process.cwd());
+            const context = buildContext(deployment, credStore, options.open, identity);
+            const { wired, running } = yield (0, flow_1.runSetup)(context, Object.assign(Object.assign(Object.assign({}, options), identity), { connections: parseConnectionsFlag(options.connections), skills: parseSkillsFlag(options.skills), port }));
+            if (!running)
+                return;
+            // The one next step, printed once, immediately before the server's own
+            // output takes over the tab.
+            logger_1.logger.info(hasConnections(wired)
+                ? `Publisher is serving ${kleur_1.default.cyan(running.uiUrl)} — now open ${kleur_1.default.bold("claude")} in another tab.`
+                : servingWithoutConnections(running.uiUrl));
+            yield waitUntilStopped(running);
+        }
+        catch (error) {
+            reportAndExit(error);
+        }
+    });
+}
+function dev(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const cwd = process.cwd();
+        const found = (0, folderconfig_1.findFolderConfig)(cwd);
+        if (!found) {
+            logger_1.logger.error("This directory is not set up for Credible yet. Run `cred init` here first.");
+            process.exit(1);
+        }
+        let target;
+        try {
+            target = resolveTarget(cwd);
+        }
+        catch (error) {
+            reportAndExit(error);
+        }
+        const { deployment, credStore, from } = target;
+        // The same line every scoped command prints, so `cred dev` is checked the
+        // same way. The pin's organization and environment, before any `-o`/`-e`.
+        const pinned = pinnedIdentity(cwd, credStore);
+        try {
+            // Before login: wiring would rewrite .mcp.json and the briefing too.
+            refuseIgnoredPin("dev", pinned.ignoredPin, deployment);
+        }
+        catch (error) {
+            reportAndExit(error);
+        }
+        logger_1.logger.info(`Using ${describeIdentity(deployment, pinned, pinned.from, from)}`);
+        try {
+            // The same gate as init's, before login and the environment write. `dev`
+            // never imports connections, so there is no connections question to ask.
+            (0, flow_1.refuseUnanswerable)(found.root, {
+                connections: "none",
+                skills: parseSkillsFlag(options.skills),
+                package: options.package,
+            }, (0, utils_1.isInteractive)());
+            const port = parsePortFlag(options.port);
+            yield (0, flow_1.refuseBesideOtherPublisher)(found.root, port);
+            yield ensureLoggedIn(credStore, (_a = options.organization) !== null && _a !== void 0 ? _a : (_b = pinFor(cwd, deployment).pin) === null || _b === void 0 ? void 0 : _b.organization);
+            const identity = yield chooseTarget(credStore, deployment, "confirm", {
+                organization: options.organization,
+                environment: options.environment,
+                createEnvironment: options.createEnvironment,
+                yes: options.yes,
+            }, found.root);
+            const context = buildContext(deployment, credStore, options.open, identity);
+            // Re-wire rather than replay: connections may have changed in Credible
+            // since setup ran, and picking that up is cheaper than making the user
+            // notice a missing connection and re-run setup.
+            const wired = yield (0, flow_1.wireDirectory)(context, Object.assign(Object.assign({ directory: found.root }, identity), { skipConnectionImport: true, package: options.package, skills: parseSkillsFlag(options.skills), port, start: true, open: options.open }));
+            const running = yield (0, flow_1.startSession)(context, wired, {
+                open: options.open,
+            });
+            logger_1.logger.info(hasConnections(wired)
+                ? `Publisher is serving ${kleur_1.default.cyan(running.uiUrl)}.`
+                : servingWithoutConnections(running.uiUrl));
+            yield waitUntilStopped(running);
+        }
+        catch (error) {
+            reportAndExit(error);
+        }
+    });
+}
+/**
+ * Hold the terminal until the server exits.
+ *
+ * Foreground is the v1 lifecycle on purpose: it is also the only channel where a
+ * human sees watch mode's deliberately-swallowed compile failures. Ctrl-C is the
+ * supervisor's to handle — it subscribed through the host when it spawned the
+ * server, so the same handler covers the boot wait and the session.
+ */
+function waitUntilStopped(running) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const code = yield running.waitForExit();
+        // A requested stop is not a failure, but it is not a clean finish either:
+        // 130 is the shell's code for Ctrl-C, which a waiting script can tell from
+        // the 1 a dead server gives. Said aloud so the cleanup is visible.
+        if ((_a = running.interrupted) === null || _a === void 0 ? void 0 : _a.call(running)) {
+            logger_1.logger.info("Stopped the local Publisher and removed this session's token file.");
+            process.exitCode = 130;
+            return;
+        }
+        if (code && code !== 0) {
+            logger_1.logger.error(`The publisher exited with code ${code}.`);
+            process.exitCode = code;
+        }
+    });
+}
+//# sourceMappingURL=setup.js.map