@credibledata/cred-cli 0.0.103 → 0.0.105

package/dist/index.js

@@ -13,8 +13,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+/* eslint-disable @typescript-eslint/no-explicit-any */
 const axios_1 = __importDefault(require("axios"));
 const commander_1 = require("commander");
+const logger_1 = require("./logger");
 const kleur_1 = __importDefault(require("kleur"));
 const omelette_1 = __importDefault(require("omelette"));
 const package_json_1 = __importDefault(require("../package.json"));
@@ -25,6 +27,9 @@ const list_1 = require("./commands/list");
 const login_1 = require("./commands/misc/login");
 const logout_1 = require("./commands/misc/logout");
 const set_access_token_1 = require("./commands/misc/set-access-token");
+const setup_1 = require("./commands/misc/setup");
+const status_1 = require("./commands/misc/status");
+const token_1 = require("./commands/misc/token");
 const listpackages_1 = require("./commands/package/listpackages");
 const publish_1 = require("./commands/package/publish");
 const listenvironments_1 = require("./commands/environment/listenvironments");
@@ -35,6 +40,30 @@ const archive_unarchive_version_1 = require("./commands/version/archive-unarchiv
 const rerun_1 = require("./commands/materialization/rerun");
 const cancelrun_1 = require("./commands/materialization/cancelrun");
 const constants_1 = require("./constants");
+const folderconfig_1 = require("./setup-core/folderconfig");
+const host_1 = require("./setup-core/host");
+const credstore_1 = require("./setup-core/credstore");
+const session_1 = require("./session");
+const utils_1 = require("./utils");
+const versioncheck_1 = require("./versioncheck");
+// First, before anything reads argv or the store: the flag is spliced out so
+// everything below sees the line without it. Under `status --json` the error
+// keeps the JSON contract an agent parses.
+try {
+    (0, utils_1.takeCellFlag)(process.argv);
+}
+catch (error) {
+    if ((0, utils_1.invokedCommand)(process.argv) === "status" &&
+        process.argv.includes("--json")) {
+        (0, status_1.printStatusError)(error);
+    }
+    else {
+        console.error(error instanceof Error ? error.message : String(error));
+    }
+    process.exit(1);
+}
+if ((0, utils_1.cellFlag)())
+    clientconfiguration_1.ClientConfiguration.scopeCommand({ deployment: (0, utils_1.cellFlag)() });
 const clientConfig = new clientconfiguration_1.ClientConfiguration();
 // `cred login` is the documented recovery path for a corrupt `~/.cred`, and the
 // one command whose job is to (re)establish config. The startup reads below —
@@ -45,15 +74,169 @@ const clientConfig = new clientconfiguration_1.ClientConfiguration();
 // command stays fail-loud (the thrown error still names `cred login` as the
 // fix) so a stray read never silently resets a user's tokens.
 if ((0, login_1.isLoginInvocation)(process.argv)) {
-    clientConfig.recoverIfCorrupt();
+    // Report it. `recoverIfCorrupt` returns the backup path instead of logging,
+    // because setup-core owns no logger — which makes saying so the caller's job.
+    // Dropping it would reset a user's tokens and move their file with no output
+    // at all, which is the silent-loss-of-state that #5133 exists to prevent.
+    const backupPath = clientConfig.recoverIfCorrupt();
+    if (backupPath) {
+        console.error(`Your credential file was unreadable, so it has been reset to defaults. ` +
+            `The previous one is at ${backupPath}.`);
+    }
+}
+// Every other command reads ~/.cred at startup too (the axios baseURL and the
+// command registration below), so a corrupt file throws here, before Commander
+// has parsed anything. Read it once up front and answer then: `status --json`
+// with the JSON error an agent parses, anything else with the message, which
+// names `cred login` as the fix. Either beats a stack trace.
+try {
+    clientConfig.loadConfig();
+}
+catch (error) {
+    if ((0, utils_1.invokedCommand)(process.argv) === "status" &&
+        process.argv.includes("--json")) {
+        (0, status_1.printStatusError)(error);
+        process.exit(1);
+    }
+    if (!(error instanceof credstore_1.InvalidConfigError))
+        throw error;
+    console.error(error.message);
+    process.exit(1);
+}
+const targetLines = [];
+// Before anything below reads the store: in a directory `cred init` pinned,
+// every org- and environment-scoped command acts on the pin, as publish does.
+// Without this, `cred ls connections` there listed the global organization's
+// connections under a `cred status` that named the pinned one.
+try {
+    (0, setup_1.scopeCommandToDirectory)(process.argv
+        .slice(2)
+        .filter((arg) => !arg.startsWith("-"))
+        .slice(0, 2)
+        .join(" ") || undefined, process.cwd(), 
+    // Held until the hook below: the scope has to be set before the commands
+    // register, but the line reads as "about to act", so it waits for a command
+    // that will actually run, not `--help` or one Commander rejects.
+    (line) => targetLines.push(line));
 }
+catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+}
+// A fresh store each time, so a scope set above is the one read.
 const getActiveEnvironment = () => {
-    return clientConfig.getEnvironment();
+    return new clientconfiguration_1.ClientConfiguration().getEnvironment();
 };
 axios_1.default.defaults.baseURL = constants_1.controlPlanesByEnv[getActiveEnvironment()];
 const cli = commander_1.program
+    .name("cred")
     .version(package_json_1.default.version, "-V, --cli-version", "Output the CLI version number")
-    .description(kleur_1.default.green(constants_1.ASCII_TITLE));
+    .option("--non-interactive", "Never prompt. A question that needs an answer exits 2 and names the flag that answers it on stderr. Implied when stdin is not a terminal or CI is set.")
+    .description(kleur_1.default.green(constants_1.ASCII_TITLE))
+    .addHelpText("after", `
+Driving cred from a script or an agent: every question has a flag. Without a
+terminal (piped stdin, CI, --non-interactive) nothing prompts — a command that
+needs an answer exits 2 and names the flag and the options on stderr. Logs go
+to stderr; only data (\`cred status --json\`, \`cred ls ...\`) goes to stdout.
+\`cred init\` writes .mcp.json, which an agent reads only when its session
+starts: read \`cred init --help\` before running it. Each command's --help
+documents it in full (\`cred publish --help\`, \`cred get --help\`).
+
+Cells: credentials are kept per cell (${constants_1.ALL_ENVIRONMENTS.join(", ")}). \`--cell
+<cell>\`, before or after any command, picks the cell for that one command, over
+this directory's pin and your global cell, and is never saved. \`cred set cell
+<cell>\` saves the global cell. \`cred login --force\` signs in again as someone
+else; \`cred logout\` signs out of one cell.`);
+// The agent contract, in one place: a prompt that could not be asked exits 2 —
+// distinct from 1, so a script can tell "needs input" from "failed" — with the
+// flag and the options already on stderr (`NeedsInputError` writes them). This
+// catches the rejections Commander's `parseAsync` does not: actions that fire a
+// promise without awaiting it.
+process.on("unhandledRejection", (reason) => {
+    exitOnFailure(reason);
+});
+// Any other failure prints just its message and exits 1. Under `--debug` (or
+// CRED_LOG_LEVEL=debug) it prints the stack instead, so a TypeError in an
+// action can still be traced.
+function exitOnFailure(error) {
+    if (error instanceof host_1.NeedsInputError) {
+        console.error(error.message);
+        process.exit(error.exitCode);
+    }
+    if (error instanceof Error) {
+        console.error(logger_1.debugRequested && error.stack ? error.stack : error.message);
+    }
+    else {
+        console.error(String(error));
+    }
+    process.exit(1);
+}
+// Refresh the access token before any command runs, rather than at each of the
+// ~25 call sites that read it. Until now the CLI persisted a refresh token and
+// never exchanged it, so every session died at the access token's `exp` and the
+// user saw it as an unexplained 401.
+//
+// These commands are exempt:
+//   - `login` / `set-access-token` establish credentials, and `logout` destroys
+//     them, so refreshing first is pointless or actively wrong;
+//   - `token` runs its own refresh so it can report the outcome on stderr while
+//     keeping stdout to just the token;
+//   - `status` exists to *report* that you are not logged in. Refusing to run it
+//     for the reason it was invoked to explain would be the worst possible
+//     answer to "why isn't this working?";
+//   - `init` / `dev` resolve credentials themselves, and must: this hook exits
+//     the process on `logged-out`, which on a brand-new machine is exactly the
+//     state `cred init` exists to fix. Exiting here would make the one command
+//     a new user is told to type fail with "Run `cred login`" — the error
+//     message `ensureLoggedIn` was written to avoid. They also resolve a
+//     per-directory deployment first, so they need a differently-scoped
+//     credential store than the module-level one this hook holds;
+//   - `set ...` only writes the local config and sends no request, so on dev it
+//     worked with an expired session. Refreshing first would make it exit 1.
+//   - `publish --dry-run` (and `add version --dry-run`) uploads nothing and is
+//     documented as needing no login; see `needsNoSession`.
+const COMMANDS_WITHOUT_REFRESH = new Set([
+    "login",
+    "logout",
+    "token",
+    "set-access-token",
+    "status",
+    "init",
+    "dev",
+]);
+cli.hook("preAction", (_thisCommand, actionCommand) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    for (const line of targetLines.splice(0))
+        console.error(line);
+    // Before the exemptions below: `init`, `dev` and `status` are the commands
+    // most worth a notice. On stderr, so `cred token` and `--json` stay clean.
+    const { notice } = (0, versioncheck_1.checkForUpdate)({ current: package_json_1.default.version });
+    if (notice)
+        console.error(notice);
+    if (COMMANDS_WITHOUT_REFRESH.has(actionCommand.name()) ||
+        ((_a = actionCommand.parent) === null || _a === void 0 ? void 0 : _a.name()) === "set") {
+        return;
+    }
+    // `add connection`, not `connection`: the name alone is shared by `get`,
+    // `rm` and the other groups.
+    const parent = actionCommand.parent;
+    const commandPath = parent && parent !== cli
+        ? `${parent.name()} ${actionCommand.name()}`
+        : actionCommand.name();
+    if ((0, setup_1.needsNoSession)(commandPath, actionCommand.opts()))
+        return;
+    try {
+        (0, setup_1.refuseWriteUnderIgnoredPin)(commandPath, process.cwd());
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+    yield (0, session_1.refreshSessionOrExit)(
+    // A fresh store, not the module-level one built before the scope was
+    // set: a scoped command sends the pinned deployment's token.
+    (0, setup_1.credStoreToRefresh)(commandPath, process.cwd(), new clientconfiguration_1.ClientConfiguration()));
+}));
 // Nested CRUD commands for resource management
 (0, get_1.registerGetCommands)(cli, getActiveEnvironment());
 (0, list_1.registerListCommands)(cli, getActiveEnvironment());
@@ -62,35 +245,85 @@ const cli = commander_1.program
 (0, add_1.registerAddCommands)(cli, getActiveEnvironment());
 (0, set_1.registerSetCommands)(cli);
 // Root commands
-cli.command("publish")
-    .description("Publish a new version of the package.")
+// Every command against a Credible resource reads `cred <verb> <resource>`, the
+// way the API is `<method> /…/<resource>`: publish is `add version` (POST a
+// package version), archive is `update version --archived` (PATCH its
+// archiveStatus), rerun is `add run`, cancel is `update run --cancel`. The verb
+// set is the one `get`/`ls`/`add`/`update`/`rm` already use, so a new resource
+// needs no new verb. The old top-level verbs (publish, archive, unarchive,
+// rerun, cancel-run) stay exactly as they were, listed and without a warning:
+// scripts, skills and docs use them, and each new form runs the same code.
+const findGroup = (name) => {
+    const group = cli.commands.find((command) => command.name() === name);
+    if (!group)
+        throw new Error(`no '${name}' command group registered`);
+    return group;
+};
+const addGroup = findGroup("add");
+const updateGroup = findGroup("update");
+const publishOptions = (command) => command
     .option("--debug")
     .option("-y, --yes", "Skip confirmation.")
     .option("--replication <replication_count>", "The number of replicas to create.", (v) => (v === undefined ? undefined : parseInt(v)), undefined)
-    .option("--set-latest", "Set this version as the latest version of the package.", false)
-    .action((options) => {
-    (0, publish_1.publish)(constants_1.controlPlanesByEnv[getActiveEnvironment()], options.replicationCount, options.debug, options.yes, options.setLatest);
-});
-cli.command("archive")
-    .description("Archive a version of a package.")
-    .argument("<packageName>", "The name of the package to archive the version of.")
-    .argument("<versionId>", "The id of the version to archive.")
-    .option("--debug")
-    .option("-y, --yes", "Skip confirmation.")
-    .action((packageName, versionId, options) => {
-    (0, archive_unarchive_version_1.archiveVersion)(constants_1.controlPlanesByEnv[getActiveEnvironment()], packageName, versionId, options.debug, options.yes);
-});
-cli.command("unarchive")
-    .description("Unarchive a version of a package.")
-    .argument("<packageName>", "The name of the package to unarchive the version of.")
-    .argument("<versionId>", "The id of the version to unarchive.")
+    .option("--set-latest", "Make this version latest now, before its indexes and materialized tables are built. Without it, a package with auto-promote on (the default) makes it latest once they are built.", false)
+    .option("--dry-run", "List the files that would be uploaded and the ones left out, and upload nothing. Needs no login.", false)
+    .option("--json", "Machine-readable: one JSON document on stdout (the link, whether it became latest, what was left out).", false)
+    .addHelpText("after", (0, publish_1.publishHelpText)());
+const publishAction = (options) => {
+    // Publish where this directory is pinned, not where the last unrelated
+    // command left the global deployment.
+    const target = (0, setup_1.resolveTarget)(process.cwd());
+    const identity = (0, setup_1.pinnedIdentity)(process.cwd(), target.credStore);
+    // Always, not only for a pin: see `describeIdentity`. An upload is not a
+    // step to take on an unstated assumption about which environment it is
+    // going to. stderr, because stdout is the command's data.
+    console.error(`Publishing to ${(0, setup_1.describeIdentity)(target.deployment, identity, identity.from, target.from)}`);
+    (0, publish_1.publish)(constants_1.controlPlanesByEnv[target.deployment], 
+    // Known bug, kept as dev has it: `--replication` lands on
+    // `options.replication`, so this is always undefined and the flag is
+    // ignored. Honoring it made a local publish with `--replication 2` hang
+    // and roll back, so fixing it is its own change.
+    options.replicationCount, options.debug, options.yes, options.setLatest, target.credStore, identity, {
+        deployment: target.deployment,
+        dryRun: options.dryRun,
+        json: options.json,
+    });
+};
+publishOptions(addGroup
+    .command("version")
+    .description("Publish a new version of the package. Same as `cred publish`.")).action(publishAction);
+publishOptions(cli.command("publish").description("Publish a new version of the package.")).action(publishAction);
+const archiveAction = (archived) => (packageName, versionId, options) => (archived ? archive_unarchive_version_1.archiveVersion : archive_unarchive_version_1.unarchiveVersion)(constants_1.controlPlanesByEnv[getActiveEnvironment()], packageName, versionId, options.debug, options.yes);
+updateGroup
+    .command("version")
+    .description("Update a version of a package: archive it, or bring it back.")
+    .argument("<packageName>", "The package the version belongs to.")
+    .argument("<versionId>", "The version to update (e.g. 0.1.21).")
+    .option("--archived", "Archive the version.")
+    .option("--no-archived", "Unarchive the version.")
     .option("--debug")
     .option("-y, --yes", "Skip confirmation.")
     .action((packageName, versionId, options) => {
-    (0, archive_unarchive_version_1.unarchiveVersion)(constants_1.controlPlanesByEnv[getActiveEnvironment()], packageName, versionId, options.debug, options.yes);
+    if (options.archived === undefined) {
+        logger_1.logger.error("Nothing to update. Pass --archived to archive the version, or --no-archived to unarchive it.");
+        process.exitCode = 1;
+        return;
+    }
+    return archiveAction(options.archived)(packageName, versionId, options);
 });
-cli.command("rerun")
-    .description("Trigger an on-demand run (rebuild/refresh) for a package version. Defaults to a full run (all sources, indexes and pre-aggregations); use --source/--dimension/--measure/--model-file to scope it to a single unit.")
+for (const [verb, archived] of [
+    ["archive", true],
+    ["unarchive", false],
+]) {
+    cli.command(verb)
+        .description(`${verb === "archive" ? "Archive" : "Unarchive"} a version of a package.`)
+        .argument("<packageName>", `The name of the package to ${verb} the version of.`)
+        .argument("<versionId>", `The id of the version to ${verb}.`)
+        .option("--debug")
+        .option("-y, --yes", "Skip confirmation.")
+        .action(archiveAction(archived));
+}
+const runOptions = (command) => command
     .argument("<packageName>", "The name of the package to run.")
     .argument("<versionId>", "The version to (re)build (e.g. 0.1.21).")
     .option("--debug")
@@ -99,15 +332,36 @@ cli.command("rerun")
     .option("--dimension <dimension>", "Scope the run to a single indexed dimension.")
     .option("--measure <measure>", "Scope the run to a single pre-aggregated measure. Rebuilds the rollup serving it; add --source when the measure is declared at more than one grain.")
     .option("--model-file <modelFilePath>", "Disambiguate a dimension/source defined in more than one model file.")
-    .option("--include-upstream", "Also force-rebuild the target's upstream persisted closure (only meaningful with --source/--dimension/--measure).", false)
-    .action((packageName, versionId, options) => {
-    (0, rerun_1.rerun)(constants_1.controlPlanesByEnv[getActiveEnvironment()], packageName, versionId, {
-        source: options.source,
-        dimension: options.dimension,
-        measure: options.measure,
-        modelFile: options.modelFile,
-        includeUpstream: options.includeUpstream,
-    }, options.debug, options.yes);
+    .option("--include-upstream", "Also force-rebuild the target's upstream persisted closure (only meaningful with --source/--dimension/--measure).", false);
+const runAction = (packageName, versionId, options) => (0, rerun_1.rerun)(constants_1.controlPlanesByEnv[getActiveEnvironment()], packageName, versionId, {
+    source: options.source,
+    dimension: options.dimension,
+    measure: options.measure,
+    modelFile: options.modelFile,
+    includeUpstream: options.includeUpstream,
+}, options.debug, options.yes);
+runOptions(addGroup
+    .command("run")
+    .description("Start a run (rebuild/refresh) of a package version. Defaults to a full run (all sources, indexes and pre-aggregations); use --source/--dimension/--measure/--model-file to scope it to a single unit.")).action(runAction);
+runOptions(cli
+    .command("rerun")
+    .description("Trigger an on-demand run (rebuild/refresh) for a package version. Defaults to a full run (all sources, indexes and pre-aggregations); use --source/--dimension/--measure/--model-file to scope it to a single unit.")).action(runAction);
+const cancelAction = (packageName, runId, options) => (0, cancelrun_1.cancelRun)(constants_1.controlPlanesByEnv[getActiveEnvironment()], packageName, runId, options.debug, options.yes);
+updateGroup
+    .command("run")
+    .description("Update a run: cancel it while it is in flight.")
+    .argument("<packageName>", "The name of the package that owns the run.")
+    .argument("<runId>", "The id of the run.")
+    .option("--cancel", "Cancel the run.")
+    .option("--debug")
+    .option("-y, --yes", "Skip confirmation.")
+    .action((packageName, runId, options) => {
+    if (!options.cancel) {
+        logger_1.logger.error("Nothing to update. Pass --cancel to cancel the run.");
+        process.exitCode = 1;
+        return;
+    }
+    return cancelAction(packageName, runId, options);
 });
 cli.command("cancel-run")
     .description("Cancel an in-flight (non-terminal) run.")
@@ -115,61 +369,161 @@ cli.command("cancel-run")
     .argument("<runId>", "The id of the run to cancel.")
     .option("--debug")
     .option("-y, --yes", "Skip confirmation.")
-    .action((packageName, runId, options) => {
-    (0, cancelrun_1.cancelRun)(constants_1.controlPlanesByEnv[getActiveEnvironment()], packageName, runId, options.debug, options.yes);
-});
+    .action(cancelAction);
 cli.command("login")
     .description("Login into Credible service.")
-    .argument("<organizationName>", "The organization to login to.")
+    .argument("[organizationName]", "The organization to login to. Omit it to pick from the organizations you belong to after signing in.")
     .option("-c, --cluster <cluster>", "Target cluster: 'gcp' or 'aws'. Defaults to the org's default cluster (gcp for most orgs).")
-    .action((organizationName, options) => {
-    var _a;
-    const orgConfig = (0, constants_1.getCliOrgConfig)(organizationName);
-    const currentEnv = clientConfig.getEnvironment();
-    // Determine the target cluster. Precedence:
-    //   1. Explicit -c/--cluster flag.
-    //   2. The org's defaultCluster (from CliOrgConfig), if registered.
-    //   3. The cluster of the current activeEnvironment — i.e. don't touch
-    //      anything. Unregistered orgs with no flag stay wherever the user
-    //      already set themselves via ms2ad set-env.
-    let cluster;
-    if (options.cluster !== undefined) {
-        const requested = String(options.cluster).toLowerCase();
-        if (requested !== "gcp" && requested !== "aws") {
-            console.error(`Invalid --cluster value '${options.cluster}'. Must be 'gcp' or 'aws'.`);
-            process.exit(1);
-        }
-        cluster = requested;
+    .option("--no-browser", "Print the sign-in URL without opening a browser. Implied without a terminal.")
+    .option("--force", "Sign in again even if you are already signed in to this cell, to sign in as someone else.")
+    .action((organizationName, options) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    // `--cell`, then the directory's pin, then the global value. A login in a directory pinned to another deployment signs
+    // in to that deployment, so the tokens land where that directory reads.
+    const resolved = (0, folderconfig_1.resolveDeployment)({
+        cwd: process.cwd(),
+        globalDefault: clientConfig.getEnvironment(),
+        flag: (0, utils_1.cellFlag)(),
+    });
+    const currentEnv = resolved.deployment;
+    let target;
+    try {
+        target = (0, login_1.resolveLoginTarget)(currentEnv, organizationName, options.cluster === undefined ? undefined : String(options.cluster), 
+        // The pin says which deployment is meant, so an org's own default
+        // cluster must not pick another one.
+        { pinned: resolved.from !== "global" });
     }
-    else if (orgConfig) {
-        cluster = orgConfig.defaultCluster;
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
     }
-    else {
-        cluster = constants_1.CLUSTER_BY_ENVIRONMENT[currentEnv];
+    // A login to another deployment would store its tokens in a slot nothing
+    // in this directory reads, since the pin keeps naming its own. It looked
+    // like it worked, and every command here still said "not logged in".
+    if (resolved.from === "flag" && target.targetEnv !== currentEnv) {
+        console.error(`--cell ${currentEnv} names the cell, so a login to ${target.targetEnv} would not be used by it. Drop --cell, or drop -c / pass an organization that lives on ${currentEnv}.`);
+        process.exit(1);
     }
-    // Unregistered orgs implicitly support only gcp; registered orgs declare
-    // their cluster list. Reject anything else.
-    const supportedClusters = (_a = orgConfig === null || orgConfig === void 0 ? void 0 : orgConfig.supportedClusters) !== null && _a !== void 0 ? _a : [
-        "gcp",
-    ];
-    if (!supportedClusters.includes(cluster)) {
-        console.error(`Organization '${organizationName}' is not available on the ${cluster} cluster.`);
+    if (resolved.from === "folder" && target.targetEnv !== currentEnv) {
+        const root = (_b = (_a = (0, folderconfig_1.findFolderConfig)(process.cwd())) === null || _a === void 0 ? void 0 : _a.root) !== null && _b !== void 0 ? _b : process.cwd();
+        console.error(`This directory is pinned to the ${currentEnv} deployment, so a login to ${target.targetEnv} here would not be used by anything in it. ` +
+            `Run the login from outside ${root}, or, to move this directory to ${target.targetEnv}, set "deployment": "${target.targetEnv}" in ${root}/.credible/config.json and run \`cred init\` there.`);
         process.exit(1);
     }
-    // Respect a previously-set activeEnvironment if it's already on the chosen
-    // cluster (e.g. `ms2ad set-env staging && cred login demo` stays on staging).
-    // Only flip envs when the current one is on a different cluster.
-    const targetEnv = constants_1.CLUSTER_BY_ENVIRONMENT[currentEnv] === cluster
-        ? currentEnv
-        : constants_1.DEFAULT_ENVIRONMENT_BY_CLUSTER[cluster];
-    if (targetEnv !== currentEnv) {
-        clientConfig.setEnvironment(targetEnv);
+    // `resolveLoginTarget` has already refused everything it can refuse, so
+    // this write only happens for a login that is going to be attempted — and
+    // only when the deployment came from the global value: a directory pin
+    // must not move every other terminal's default.
+    if (resolved.from === "global" && target.targetEnv !== currentEnv) {
+        clientConfig.setEnvironment(target.targetEnv);
     }
-    (0, login_1.login)(organizationName, constants_1.controlPlanesByEnv[targetEnv], undefined, cluster);
-});
+    // Awaited, with its own catch. The `unhandledRejection` handler above
+    // would still report a rejection here with the right exit code, so this
+    // is not the difference between working and broken — it is the
+    // difference between a failure handled where it happened and one handled
+    // by a global net. Two things follow from awaiting. `parseAsync`
+    // otherwise returns while login is still running, because an action body
+    // that fires a promise without returning it resolves immediately; and
+    // login is the command with partial state to reason about (tokens are
+    // persisted before the organization is resolved), so its error path
+    // deserves to be visible next to that, not several files away.
+    try {
+        yield (0, login_1.login)(organizationName, constants_1.controlPlanesByEnv[target.targetEnv], undefined, target.cluster, 
+        // Explicit rather than inherited from the write above, so where the
+        // tokens land does not depend on that statement having run.
+        target.targetEnv, { force: options.force });
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exit(error instanceof host_1.NeedsInputError ? 2 : 1);
+    }
+    if (resolved.from === "flag") {
+        const warning = (0, login_1.bareCellWarning)(currentEnv, (0, folderconfig_1.resolveDeployment)({
+            cwd: process.cwd(),
+            globalDefault: clientConfig.getGlobalEnvironment(),
+        }));
+        if (warning)
+            console.error(warning);
+    }
+}));
+cli.command("token")
+    .description("Print a fresh access token on stdout, refreshing it first if needed. Machine-facing: nothing else is written to stdout.")
+    .action(() => __awaiter(void 0, void 0, void 0, function* () {
+    yield (0, token_1.printToken)();
+}));
+cli.command("init")
+    .description("Set up this directory for local Malloy modeling: log in if needed, wire the directory to a Credible environment, and start a local Publisher serving it.")
+    .option("--no-start", "Write the configuration but do not start the publisher.")
+    .option("--no-open", "Start the publisher but do not open a browser.")
+    .option("-d, --directory <path>", "Set up this directory instead of the current one.")
+    .option("-o, --organization <name>", "Use this organization instead of asking. Also re-pins the directory.")
+    .option("-e, --environment <name>", "Use this Credible environment instead of asking. Also re-pins the directory.")
+    .option("--create-environment", "With --environment: create the environment if the organization does not have it yet.", false)
+    .option("--skills <replace|keep|none>", "What to do with skills already in .claude/skills/ that cred did not install (a create-malloy-package directory): replace them with Credible's set, keep both, or install none. Asked once when omitted.")
+    .option("--package <dir>", "In a directory whose publisher.config.json lists several packages (a create-malloy-package workspace), which one the local publisher serves. Remembered for cred dev.")
+    .option("--debug", "Show all of the local Publisher's output here, not only its errors.")
+    .option("--port <number>", "Serve on this port, and MCP on the port 40 above it, instead of the remembered pair or 4000/4040. Remembered, and .mcp.json follows. Use it when another Publisher holds the ports.")
+    .option("--connections <all|none|names>", "Which connections from a local publisher.config.json to copy into Credible: all, none, or a comma-separated list. Naming them is the consent to send their credentials, so no question is asked.")
+    .addHelpText("after", `
+init writes .mcp.json, CLAUDE.md and AGENTS.md here. An agent reads those only
+when its session starts, so one already running here gets no local \`malloy\`
+tools from this run. Without --no-start, init then runs the publisher in the
+foreground until Ctrl-C.
+
+If you are an agent running init yourself:
+  1. cred init --no-start -e <environment> --connections <all|none|names> --skills <replace|keep|none>
+  2. Ask the user to restart you in this directory (for Claude Code: exit,
+     run \`claude\` here, and trust the project's MCP servers).
+  3. In the new session: \`cred dev --no-open\` in the background, then poll
+     \`cred status --json\` until publisher.ready is true. If it exits saying
+     another Publisher holds the ports, re-run it with the --port it names.
+Simplest of all: the user runs \`cred init\` before starting the agent.`)
+    .action((options) => __awaiter(void 0, void 0, void 0, function* () {
+    yield (0, setup_1.setup)({
+        start: options.start,
+        open: options.open,
+        directory: options.directory,
+        organization: options.organization,
+        environment: options.environment,
+        connections: options.connections,
+        createEnvironment: options.createEnvironment,
+        skills: options.skills,
+        package: options.package,
+        port: options.port,
+    });
+}));
+cli.command("dev")
+    .description("Re-enter the local Publisher session for this directory (foreground; Ctrl-C stops it).")
+    .option("--no-open", "Do not open a browser.")
+    .option("-o, --organization <name>", "Switch this directory to another organization, and remember it.")
+    .option("-e, --environment <name>", "Switch this directory to another Credible environment, and remember it.")
+    .option("--create-environment", "With --environment: create the environment if the organization does not have it yet.", false)
+    .option("--package <dir>", "Serve this listed package instead of the one this directory is pinned to, and remember it.")
+    .option("--skills <replace|keep|none>", "What to do with skills in .claude/skills/ that cred did not install, when it has to ask. none is remembered, and replace or keep undoes it.")
+    .option("--port <number>", "Serve on this port, and MCP on the port 40 above it, instead of the remembered pair or 4000/4040. Remembered, and .mcp.json follows. Use it when another Publisher holds the ports.")
+    .option("-y, --yes", "Use the organization and environment this directory is pinned to without asking. Implied without a terminal.", false)
+    .option("--debug", "Show all of the local Publisher's output here, not only its errors.")
+    .action((options) => __awaiter(void 0, void 0, void 0, function* () {
+    yield (0, setup_1.dev)({
+        open: options.open,
+        organization: options.organization,
+        environment: options.environment,
+        createEnvironment: options.createEnvironment,
+        package: options.package,
+        skills: options.skills,
+        yes: options.yes,
+        port: options.port,
+    });
+}));
 cli.command("logout")
-    .description("Resets Credible service credentials")
-    .action(logout_1.logout);
+    .description("Sign out of one cell: the one --cell names, else this directory's pin, else your global cell. Other cells stay signed in.")
+    .action(() => {
+    (0, logout_1.logout)((0, folderconfig_1.resolveDeployment)({
+        cwd: process.cwd(),
+        globalDefault: clientConfig.getGlobalEnvironment(),
+        flag: (0, utils_1.cellFlag)(),
+    }));
+});
 cli.command("set-access-token")
     .description("Set a service account JWT token for CLI authentication")
     .argument("<jwtToken>", "The JWT token to use for authentication")
@@ -178,22 +532,36 @@ cli.command("set-access-token")
     (0, set_access_token_1.setAccessToken)(jwtToken, options.organization);
 });
 cli.command("status")
-    .description("Shows the cell this CLI targets, and the active organization and environment.")
-    .action(() => {
-    const config = new clientconfiguration_1.ClientConfiguration();
-    config.printStatus();
-});
+    .description("Shows the active organization, Credible environment, and token freshness — and, in a directory cred init wired, whether its publisher is running.")
+    .option("--json", "Machine-readable: one JSON document on stdout, nothing else. Poll publisher.ready after starting `cred dev` in the background.", false)
+    .action((options) => __awaiter(void 0, void 0, void 0, function* () {
+    yield (0, status_1.printStatus)({ json: options.json });
+}));
 const complete = (0, omelette_1.default)("credible").tree({
     // CRUD commands
     get: [
         "environment",
         "project",
+        "package",
+        "version",
         "group",
         "permission",
         "materialization",
         "index",
         "run",
     ],
+    list: [
+        "environment",
+        "connection",
+        "package",
+        "version",
+        "materialization",
+        "index",
+        "run",
+        "group",
+        "group-access-token",
+        "permission",
+    ],
     ls: [
         "environment",
         "project",
@@ -207,7 +575,7 @@ const complete = (0, omelette_1.default)("credible").tree({
         "group-access-token",
         "permission",
     ],
-    update: ["environment", "project", "package"],
+    update: ["environment", "project", "package", "version", "run"],
     rm: [
         "environment",
         "project",
@@ -222,15 +590,20 @@ const complete = (0, omelette_1.default)("credible").tree({
         "environment",
         "project",
         "connection",
+        "version",
+        "run",
         "group",
         "member",
         "group-access-token",
         "permission",
     ],
     // Misc commands
-    set: ["environment", "project"],
+    set: ["environment", "project", "cell"],
     login: [],
     logout: [],
+    token: [],
+    init: [],
+    dev: [],
     "set-access-token": [],
     status: [],
     publish: [],
@@ -249,7 +622,10 @@ complete.onAsync("$3", (_a) => __awaiter(void 0, [_a], void 0, function* ({ repl
         "rm project",
     ];
     if (environmentRelatedCommands.some((cmd) => line.includes(cmd))) {
-        reply((0, listenvironments_1.listEnvironments)(constants_1.controlPlanesByEnv[getActiveEnvironment()], false).then((result) => result.projects.map((environment) => environment.name)));
+        reply((0, listenvironments_1.listEnvironments)(constants_1.controlPlanesByEnv[getActiveEnvironment()], false).then((result) => result.environments.map((environment) => environment.name)));
+    }
+    if (line.includes("set cell")) {
+        reply(Promise.resolve(constants_1.ALL_ENVIRONMENTS));
     }
     const packageRelatedCommands = ["rm package", "ls version"];
     if (packageRelatedCommands.some((cmd) => line.includes(cmd))) {
@@ -257,15 +633,36 @@ complete.onAsync("$3", (_a) => __awaiter(void 0, [_a], void 0, function* ({ repl
     }
 }));
 complete.next(() => {
-    commander_1.program.parse(process.argv);
+    // `parseAsync`, not `parse`, now that a `preAction` hook is async. `parse`
+    // does work — Commander still chains the hook before the action — but it
+    // returns before either has finished and hands back nothing to attach a
+    // catch to, so a rejection anywhere in that chain surfaces as an unhandled
+    // promise rejection and a stack dump. `ensureFreshTokens` is written not to
+    // throw, but that is a contract a future edit can break quietly.
+    commander_1.program.parseAsync(process.argv).catch(exitOnFailure);
 });
+// omelette finds the shell init file to edit from $SHELL, and throws when it is
+// unset (a container started without a login shell: CI runner pods, `docker
+// run`) or names a shell other than bash, zsh or fish. The CLI is installed by
+// then and only completion needs the shell, so completion is skipped rather
+// than failing the install.
+function skipCompletionOnError(setup) {
+    try {
+        setup();
+    }
+    catch (error) {
+        console.log(`Skipping shell completion setup: ${error.message}`);
+    }
+}
 if (~process.argv.indexOf("--cleanup")) {
-    complete.cleanupShellInitFile();
+    skipCompletionOnError(() => complete.cleanupShellInitFile());
     process.exit(0);
 }
 if (~process.argv.indexOf("--install")) {
-    complete.setupShellInitFile();
+    // Printed first: setupShellInitFile() exits the process itself once it has
+    // written the init file.
     console.log("CLI installed successfully!");
+    skipCompletionOnError(() => complete.setupShellInitFile());
     process.exit(0);
 }
 complete.init();