@credibledata/cred-cli 0.0.103 → 0.0.105

package/dist/setup-core/flow.js

@@ -0,0 +1,765 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PORT_FLAG = exports.PACKAGE_FLAG = void 0;
+exports.isOwnSessionRunning = isOwnSessionRunning;
+exports.writtenBeforeBoot = writtenBeforeBoot;
+exports.refuseUnanswerable = refuseUnanswerable;
+exports.refuseBesideOtherPublisher = refuseBesideOtherPublisher;
+exports.wireDirectory = wireDirectory;
+exports.startSession = startSession;
+exports.runSetup = runSetup;
+exports.joinNames = joinNames;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const folderconfig_1 = require("./folderconfig");
+const git_1 = require("./git");
+const localpublisherconfig_1 = require("./localpublisherconfig");
+const importconnections_1 = require("./importconnections");
+const host_1 = require("./host");
+const briefing_1 = require("./briefing");
+const mcpconfig_1 = require("./mcpconfig");
+const liveness_1 = require("./liveness");
+const ports_1 = require("./ports");
+const packagemanifest_1 = require("./packagemanifest");
+const publisherconfig_1 = require("./publisherconfig");
+const skills_1 = require("./skills");
+const supervisor_1 = require("./supervisor");
+/**
+ * Where the server keeps `publisher_data/`, one location per modeling directory.
+ *
+ * It must be OUTSIDE the modeling directory, and that is a constraint rather
+ * than a preference: the server mounts a package by copying it into
+ * `publisher_data/`, so a server root inside the package makes the destination a
+ * subdirectory of the source and the mount dies with `ERR_FS_CP_EINVAL: cannot
+ * copy <dir> to a subdirectory of self`. The environment is then skipped, while
+ * both ports still bind.
+ *
+ * Under the home directory rather than a temp dir, and keyed by a hash of the
+ * absolute path so two modeling directories never collide. The server's
+ * database in it is rebuilt from the config at every boot (the supervisor
+ * passes `--init`), so nothing in it has to outlive a session. Keeping runtime state out of the user's
+ * git working tree is a real benefit of this, but not the reason for it.
+ */
+function sessionServerRoot(directory) {
+    const key = crypto_1.default
+        .createHash("sha256")
+        .update(path_1.default.resolve(directory))
+        .digest("hex")
+        .slice(0, 16);
+    return path_1.default.join(os_1.default.homedir(), ".credible", "sessions", key);
+}
+function ensureServerRoot(directory) {
+    const serverRoot = sessionServerRoot(directory);
+    // 0700: this directory holds `publisher.config.json`, which carries a live
+    // warehouse access token while a session runs. The file itself is written
+    // 0600, and the mode here means no other account can even list the path.
+    // Set explicitly as well: `mkdirSync` leaves an existing directory's mode
+    // as it found it.
+    fs_1.default.mkdirSync(serverRoot, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32")
+        fs_1.default.chmodSync(serverRoot, 0o700);
+    return serverRoot;
+}
+/**
+ * Where the config the server reads lives — and why it is not in the user's
+ * directory.
+ *
+ * The file has to carry a live warehouse access token: the server takes one in
+ * the connection entry and has no refresh hook, so the supervisor rewrites the
+ * file with a current token at every spawn and every renewal. That makes it a
+ * credential, and a credential must not sit in a git working tree, where
+ * `git add -A` in another tab commits it and any other account on the machine
+ * can read it.
+ *
+ * Nothing forces it to live next to the model code: the server is launched with
+ * an absolute `--config`, and the package `location` inside the config is
+ * absolute too (see {@link buildPublisherConfig}), so no path in the file
+ * resolves relative to it. So it goes in the session directory beside
+ * `publisher_data/`, which is already private, already per-directory, and
+ * already outside the repo.
+ */
+function sessionConfigPath(directory) {
+    return path_1.default.join(sessionServerRoot(directory), "publisher.config.json");
+}
+/**
+ * Is this directory's own session running — not merely something answering on
+ * its pinned port?
+ *
+ * All three must hold: the session's stamped config and pid file exist (the
+ * supervisor removes both when the server exits), the pid is alive, and the
+ * port answers. The files alone were not enough: a `kill -9`, a reboot or a
+ * closed terminal leaves them behind, and two directories wired one after the
+ * other both pin 4000/4040, so the other directory's publisher answered and
+ * this one was reported as running.
+ */
+function isOwnSessionRunning(directory, uiPort) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!fs_1.default.existsSync(sessionConfigPath(directory)))
+            return false;
+        const pidFile = path_1.default.join(sessionServerRoot(directory), supervisor_1.SESSION_PID_FILE);
+        // Written before the last boot means the process it names is gone, and
+        // after a reboot its pid can belong to something else that is alive.
+        if (writtenBeforeBoot(pidFile))
+            return false;
+        const pid = Number.parseInt(readOrEmpty(pidFile), 10);
+        if (!Number.isInteger(pid) || pid <= 0 || !isAlive(pid))
+            return false;
+        return (0, liveness_1.isPublisherServing)(uiPort);
+    });
+}
+/** True when `file` is older than this machine's last boot. */
+function writtenBeforeBoot(file, now = Date.now()) {
+    try {
+        return fs_1.default.statSync(file).mtimeMs < now - os_1.default.uptime() * 1000;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function readOrEmpty(file) {
+    try {
+        return fs_1.default.readFileSync(file, "utf-8");
+    }
+    catch (_a) {
+        return "";
+    }
+}
+/** Signal 0 checks for a process without touching it. EPERM means it exists. */
+function isAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+/** The question `--skills` answers, naming the first few skills found. */
+function skillsQuestion(foreign) {
+    const shown = foreign.slice(0, 4).join(", ") + (foreign.length > 4 ? ", …" : "");
+    return `Found ${foreign.length} skill${foreign.length === 1 ? "" : "s"} already in ${skills_1.SKILLS_DIR}/ that cred did not install (${shown}). What should happen to them?`;
+}
+/**
+ * Refuse, before anything is written, the questions `cred init` could not ask.
+ *
+ * Without a terminal a question exits 2. Asked in order, the connections and
+ * skills questions came after the environment was created and selected, so an
+ * agent that stopped at the exit 2 left an empty environment behind and
+ * `~/.cred` pointing at it. Checked up front, exit 2 means nothing happened,
+ * which is what a caller re-running with the flag assumes. A misspelled
+ * `--connections` name is refused here for the same reason.
+ */
+function refuseUnanswerable(directory, options, interactive) {
+    var _a;
+    // The package picker, and a `--package` that names nothing listed. Asked
+    // after login and the environment, so an agent that stopped at it left
+    // `~/.cred` written and maybe an environment created.
+    const remembered = (0, folderconfig_1.findFolderConfig)(directory);
+    const decided = decidePackageDir(directory, {
+        flag: options.package,
+        pinned: (remembered === null || remembered === void 0 ? void 0 : remembered.root) === path_1.default.resolve(directory)
+            ? remembered.config.package
+            : undefined,
+    });
+    if (!interactive && "listed" in decided) {
+        throw new host_1.NeedsInputError(PACKAGE_QUESTION, {
+            flag: `${exports.PACKAGE_FLAG} <dir>`,
+            options: decided.names,
+        });
+    }
+    const local = (0, importconnections_1.findLocalPublisherConfig)(directory);
+    // Named connections with no readable file to find them in is the silent
+    // skip `checkSelection` exists to prevent, one step earlier.
+    if (!local && Array.isArray(options.connections)) {
+        throw new host_1.SetupError((0, importconnections_1.localPublisherConfigProblem)(directory), `run this in the directory that has the connections, or drop ${importconnections_1.CONNECTIONS_FLAG}.`);
+    }
+    if (local && options.connections !== "none") {
+        (0, importconnections_1.checkSelection)(local, options.connections);
+        if (!interactive &&
+            options.connections === undefined &&
+            local.candidates.length > 0) {
+            throw new host_1.NeedsInputError(importconnections_1.CONNECTIONS_QUESTION, {
+                flag: importconnections_1.CONNECTIONS_FLAG,
+                options: local.candidates.map((c) => c.name),
+            });
+        }
+    }
+    if (!interactive && !options.skills) {
+        const pinned = (_a = (0, folderconfig_1.findFolderConfig)(directory)) === null || _a === void 0 ? void 0 : _a.config;
+        const foreign = (pinned === null || pinned === void 0 ? void 0 : pinned.skills) || (pinned === null || pinned === void 0 ? void 0 : pinned.skillsPolicy) === "none"
+            ? []
+            : (0, skills_1.foreignSkills)(directory);
+        if (foreign.length) {
+            throw new host_1.NeedsInputError(skillsQuestion(foreign), {
+                flag: skills_1.SKILLS_FLAG,
+                options: ["replace", "keep", "none"],
+            });
+        }
+    }
+}
+/**
+ * Steps 1–4 and 7: everything that leaves files on disk, without starting
+ * anything.
+ *
+ * Split from the spawn so `--no-start` is a real mode rather than an early
+ * return, and so `cred dev` can re-derive the same wiring on a later day and
+ * pick up connection changes made in Credible since.
+ */
+const OTHER_PUBLISHER_MESSAGE = `Another Publisher, not one this directory's cred session started, is running on ports ${ports_1.DEFAULT_UI_PORT}/${ports_1.DEFAULT_MCP_PORT}.`;
+function otherPublisherError(free) {
+    return new host_1.SetupError(OTHER_PUBLISHER_MESSAGE, `stop it and run this again to serve this directory on ${ports_1.DEFAULT_UI_PORT}/${ports_1.DEFAULT_MCP_PORT}, or leave it running and ${portFix(free)}`);
+}
+/** The flag that moves this directory to a free pair, with the pair to pass. */
+function portFix(free) {
+    return free
+        ? `re-run with ${exports.PORT_FLAG} ${free.uiPort} (free now; MCP takes ${free.mcpPort}). cred remembers it and points .mcp.json there.`
+        : `re-run with ${exports.PORT_FLAG} <port>, a port that is free along with the one 40 above it. cred remembers it and points .mcp.json there.`;
+}
+/**
+ * Whether someone else's publisher holds the default pair this directory would
+ * use: in the "I already run a publisher" journey, the user's own, started from
+ * this same directory. Moving to a derived pair rewrote `.mcp.json` away from
+ * the one server the agent could reach. Not this directory's own session; the
+ * caller checks that first.
+ */
+function otherPublisherOnDefaults(directory, pinnedPorts) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // Only the journey this exists for: a directory with its own
+        // publisher.config.json, whose own server is the likely holder. Anywhere
+        // else the holder is usually another directory's `cred dev`, and the
+        // derived pair in ports.ts is the right answer, not a refusal.
+        if (!fs_1.default.existsSync(path_1.default.join(directory, "publisher.config.json"))) {
+            return false;
+        }
+        const onDefaults = !pinnedPorts ||
+            (pinnedPorts.uiPort === ports_1.DEFAULT_UI_PORT &&
+                pinnedPorts.mcpPort === ports_1.DEFAULT_MCP_PORT);
+        return onDefaults && (yield (0, liveness_1.isPublisherServing)(ports_1.DEFAULT_UI_PORT));
+    });
+}
+/**
+ * Refuse to start beside someone else's publisher, before login and the
+ * environment lookup. Checked only inside `wireDirectory`, the refusal came
+ * after both, 25 seconds and more on a slow deployment.
+ */
+function refuseBesideOtherPublisher(directory, port) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const found = (0, folderconfig_1.findFolderConfig)(directory);
+        const pinned = (found === null || found === void 0 ? void 0 : found.root) === directory ? found.config : undefined;
+        const ownSessionRunning = Boolean((pinned === null || pinned === void 0 ? void 0 : pinned.ports) &&
+            (yield isOwnSessionRunning(directory, pinned.ports.uiPort)));
+        if (port !== undefined) {
+            // The same check `wireDirectory` repeats when it takes the pair; made
+            // here too so a busy pair is refused before login and any import.
+            yield chosenPair(directory, port, {
+                ownSessionRunning,
+                pinned: pinned === null || pinned === void 0 ? void 0 : pinned.ports,
+            });
+            return;
+        }
+        if (ownSessionRunning)
+            return;
+        if (yield otherPublisherOnDefaults(directory, pinned === null || pinned === void 0 ? void 0 : pinned.ports)) {
+            throw otherPublisherError(yield (0, ports_1.suggestFreePair)(directory));
+        }
+    });
+}
+function wireDirectory(context, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const { organization, credibleEnvironment } = options;
+        if (!organization) {
+            throw new host_1.SetupError("No organization is selected.", "run `cred login` and pick one, or pass --organization.");
+        }
+        if (!credibleEnvironment) {
+            throw new host_1.SetupError("No Credible environment is selected.", "run `cred set environment` and pick one, or pass --environment.");
+        }
+        // Setup adopts a directory; it never fetches code. Someone who keeps their
+        // models in a repo clones it with git and runs setup inside the result, which
+        // is what `git clone` is for — wrapping it in a prompt added a step, a second
+        // way to get the destination wrong, and no capability. Cloning the
+        // environment's MANAGED repo is a different proposition (Credible knows the
+        // URL and authenticates it) and is still to come; see
+        // `git-synced-modeling.md` gate 1.
+        //
+        // Resolved once, here, because this value is an identity rather than just a
+        // path: it is sha256'd for the session directory, hashed for the derived
+        // port pair, and compared against `findFolderConfig`'s always-absolute
+        // `root` to find the ports this directory used last. A relative
+        // `--directory` reached all three as a different string, so `cred init -d
+        // sub` re-derived its ports every run and rewrote `.mcp.json` with a URL the
+        // agent's saved config no longer matched. Everything downstream can then
+        // treat it as absolute.
+        const directory = path_1.default.resolve((_a = options.directory) !== null && _a !== void 0 ? _a : context.cwd);
+        const remembered = (0, folderconfig_1.findFolderConfig)(directory);
+        const pinned = (remembered === null || remembered === void 0 ? void 0 : remembered.root) === directory ? remembered.config : undefined;
+        // A second session for the same directory would find the pinned ports busy
+        // — held by the first — fall through to another pair, rewrite `.mcp.json`
+        // to it and start a second server, leaving the first serving on the URL any
+        // open agent still has.
+        const ownSessionRunning = Boolean((pinned === null || pinned === void 0 ? void 0 : pinned.ports) &&
+            (yield isOwnSessionRunning(directory, pinned.ports.uiPort)));
+        if (options.start && ownSessionRunning) {
+            throw new host_1.SetupError(`A local Publisher for this directory is already running at http://localhost:${pinned.ports.uiPort}.`, "use that one (`cred status --json` reports it), or stop it — Ctrl-C in its terminal — and run this again.");
+        }
+        // Someone else's publisher on the default pair — in the "I already run a
+        // publisher" journey, the user's own, started from this same directory.
+        // Moving to a derived pair rewrote `.mcp.json` away from the one server the
+        // agent could reach, to a port nothing served until `cred dev`. Staying on
+        // the default pair keeps that URL; the old server has to stop first.
+        const otherPublisher = options.port === undefined &&
+            !ownSessionRunning &&
+            (yield otherPublisherOnDefaults(directory, pinned === null || pinned === void 0 ? void 0 : pinned.ports));
+        if (otherPublisher && options.start) {
+            throw otherPublisherError(yield (0, ports_1.suggestFreePair)(directory));
+        }
+        if (otherPublisher) {
+            context.host.log("warn", `${OTHER_PUBLISHER_MESSAGE} This directory stays on them: stop that one before \`cred dev\`, which serves here through Credible. Or keep it running and move this directory: ${portFix(yield (0, ports_1.suggestFreePair)(directory))}`);
+        }
+        const packageDir = yield resolvePackageDir(directory, context.host, {
+            flag: options.package,
+            pinned: pinned === null || pinned === void 0 ? void 0 : pinned.package,
+        });
+        // Before listing: a connection adopted now should appear in the config this
+        // run writes, rather than needing a second `cred dev` to show up.
+        if (context.createConnection && !options.skipConnectionImport) {
+            const local = (0, importconnections_1.findLocalPublisherConfig)(directory);
+            if (local) {
+                yield (0, importconnections_1.importLocalConnections)(local, context.host, credibleEnvironment, context.createConnection, {
+                    selection: options.connections,
+                    existingNames: () => __awaiter(this, void 0, void 0, function* () {
+                        return (yield context.listConnections(organization, credibleEnvironment))
+                            .map((c) => c.name)
+                            .filter((name) => Boolean(name));
+                    }),
+                });
+            }
+        }
+        const connections = yield context.listConnections(organization, credibleEnvironment);
+        // Otherwise this looks like success: the server starts, serves the package,
+        // and every query fails. The only sign was the server's own "Loaded 0
+        // connections" line.
+        if (connections.length === 0) {
+            context.host.log("warn", `The Credible environment '${credibleEnvironment}' has no connections, so the local Publisher will have nothing to query. To fix it, ${briefing_1.NO_CONNECTIONS_NEXT_STEP}.`);
+        }
+        // A directory of `.malloy` files is not yet a package; without a manifest the
+        // server loads the environment and then fails the package.
+        const manifest = (0, packagemanifest_1.ensurePackageManifest)(packageDir, (0, publisherconfig_1.packageNameFromDirectory)(path_1.default.basename(packageDir)));
+        if (manifest.action === "created") {
+            context.host.log("info", `Wrote ${packagemanifest_1.PACKAGE_MANIFEST_FILE} so ${packageDir === directory ? "this directory" : path_1.default.relative(directory, packageDir)} loads as the package '${manifest.name}'.`);
+        }
+        else if (manifest.missingVersion) {
+            // The scaffolder writes `{ "name": … }` only. The publisher serves it
+            // fine; `cred publish` will not send it. Said here, once, where the
+            // user is looking, rather than at publish time.
+            context.host.log("warn", `${path_1.default.relative(directory, manifest.filePath) || packagemanifest_1.PACKAGE_MANIFEST_FILE} has no "version". The local publisher does not need one; \`cred publish\` does — add "version": "0.0.1" before publishing.`);
+        }
+        const retrieval = (0, publisherconfig_1.readLocalRetrieval)(directory);
+        if (retrieval && "problem" in retrieval) {
+            context.host.log("warn", retrieval.problem);
+        }
+        else if (retrieval) {
+            context.host.log("info", "Using the retrieval settings in this directory's publisher.config.json.");
+        }
+        const config = (0, publisherconfig_1.buildPublisherConfig)({
+            deployment: context.deployment,
+            organization,
+            credibleEnvironment,
+            connections,
+            // Already absolute (see `directory` above); the server rejects "." and a
+            // bare name, and skips the environment without failing the boot when it
+            // does.
+            packageLocation: packageDir,
+            packageName: manifest.name,
+            environmentName: (0, publisherconfig_1.localEnvironmentName)(credibleEnvironment),
+            retrieval: retrieval && "settings" in retrieval ? retrieval.settings : undefined,
+        });
+        // Reuse this directory's remembered ports so an agent's saved `.mcp.json` URL
+        // keeps resolving across sessions. While this directory's own session holds
+        // them (`--no-start` beside a running `cred dev`) they are busy because they
+        // are in use, so they are kept rather than probed: probing found them busy
+        // and moved `.mcp.json` to a pair nothing was listening on.
+        const ports = options.port !== undefined
+            ? yield chosenPair(directory, options.port, {
+                ownSessionRunning,
+                pinned: pinned === null || pinned === void 0 ? void 0 : pinned.ports,
+            })
+            : ownSessionRunning && (pinned === null || pinned === void 0 ? void 0 : pinned.ports)
+                ? Object.assign(Object.assign({}, pinned.ports), { derived: false }) : otherPublisher
+                ? {
+                    uiPort: ports_1.DEFAULT_UI_PORT,
+                    mcpPort: ports_1.DEFAULT_MCP_PORT,
+                    derived: false,
+                }
+                : yield (0, ports_1.allocatePortPair)(directory, {
+                    preferred: pinned === null || pinned === void 0 ? void 0 : pinned.ports,
+                });
+        const { installed: skills, declined: skillsDeclined } = yield syncSkills(context, directory, remembered === null || remembered === void 0 ? void 0 : remembered.config.skills, (_b = options.skills) !== null && _b !== void 0 ? _b : remembered === null || remembered === void 0 ? void 0 : remembered.config.skillsPolicy);
+        const configPath = sessionConfigPath(directory);
+        const mcp = (0, mcpconfig_1.writeMcpConfig)({
+            directory,
+            mcpPort: ports.mcpPort,
+            deployment: context.deployment,
+            organization,
+        });
+        if (mcp.preserved.length) {
+            context.host.log("info", `Kept your other MCP servers in .mcp.json: ${mcp.preserved.join(", ")}.`);
+        }
+        if (mcp.retired.length) {
+            // A server vanishing from `.mcp.json` looks like something went wrong
+            // unless we say it was ours to remove.
+            context.host.log("info", `Removed ${mcp.retired.join(", ")} from .mcp.json — setup no longer registers it; the local publisher's own search_database_schema covers it.`);
+        }
+        if (mcp.displaced) {
+            // Said as a warning, not an aside: nothing in the previous file survived
+            // the rewrite, and the user may not consider it broken — an agent reading
+            // `.mcp.json` tolerates things `JSON.parse` refuses.
+            context.host.log("warn", `Could not read your existing .mcp.json, so its contents were replaced. The original is at ${mcp.displaced} — copy any servers you had back across.`);
+        }
+        if (mcp.changed) {
+            // An agent reads `.mcp.json` when its session starts, so one already open
+            // in this directory — including the one that just ran `cred init` — has
+            // no `malloy` tools until it restarts. Said only when the file actually
+            // changed: ports are stable per directory, so a later `cred dev` normally
+            // rewrites nothing and this line would be noise.
+            context.host.log("info", `Wrote .mcp.json. An agent already running in this directory will not see the new MCP servers until it restarts — for Claude Code, exit and start \`claude\` here again; it asks once to trust the project's servers.`);
+        }
+        (0, briefing_1.writeBriefing)(directory, {
+            organization,
+            credibleEnvironment,
+            localEnvironment: config.environments[0].name,
+            connectionNames: config.environments[0].connections.map((c) => c.name),
+            publisherUrl: `http://localhost:${ports.uiPort}`,
+            // Observed, not asked. The briefing tells an agent whether `git push`
+            // means anything here, and only the directory itself knows.
+            gitRemote: (0, git_1.detectGitRemote)(directory),
+            skillsInstalled: skills !== undefined,
+            // Importable connections, or ones held back only by an unset variable:
+            // the file can still hold a literal password next to a `${HOST}`, and
+            // counting candidates alone made the briefing change with the shell.
+            localConfigHasConnections: (() => {
+                const local = (0, importconnections_1.findLocalPublisherConfig)(directory);
+                return Boolean(local &&
+                    (local.candidates.length > 0 ||
+                        local.skipped.some((entry) => entry.fix)));
+            })(),
+            packagePath: packageDir === directory
+                ? undefined
+                : path_1.default.relative(directory, packageDir),
+            host: "cli",
+        });
+        // The pin records the deployment always, production included. Leaving it
+        // out for production meant the directory followed the global deployment,
+        // so once `~/.cred` moved to staging (`ms2ad set-env`, or a login to
+        // another cluster), a production directory's publish and `cred dev` ran
+        // with staging's credentials against the production organization it
+        // remembers.
+        (0, folderconfig_1.writeFolderConfig)(directory, Object.assign(Object.assign({ organization, environment: credibleEnvironment, ports: { uiPort: ports.uiPort, mcpPort: ports.mcpPort }, 
+            // `undefined`, not an omitted key: `writeFolderConfig` merges over the
+            // file's raw contents, so an omitted key keeps whatever the file had, and
+            // a directory that stopped serving a subpackage would keep pointing at it.
+            // `JSON.stringify` drops an `undefined` value, so this clears it.
+            package: packageDir === directory
+                ? undefined
+                : path_1.default.relative(directory, packageDir), deployment: context.deployment }, (skills ? { skills } : {})), { 
+            // A decision rather than a record of files, so it is written every run:
+            // `replace` or `keep` clears an earlier `none`.
+            skillsPolicy: skillsDeclined ? "none" : undefined }));
+        // The pin is this developer's choice of environment, not a property of the
+        // models, so a teammate must not inherit it by cloning.
+        if ((0, folderconfig_1.ensureConfigIgnored)(directory) === "added") {
+            context.host.log("info", `Added ${folderconfig_1.FOLDER_CONFIG_DIR}/ to .gitignore — it records the environment you chose, which is yours rather than the repository's.`);
+        }
+        if (skills) {
+            // Installer-managed files, regenerated by every setup and pinned in a
+            // gitignored file: derived, like node_modules, not the repository's.
+            (0, folderconfig_1.ensureIgnored)(directory, (0, skills_1.skillsGitignoreEntries)(skills), "modeling skills installed by cred init; re-run it to refresh them");
+        }
+        // Said when the pair is new to this directory, not on every session that
+        // reuses the one it remembered.
+        const portsMoved = ((_c = pinned === null || pinned === void 0 ? void 0 : pinned.ports) === null || _c === void 0 ? void 0 : _c.uiPort) !== ports.uiPort ||
+            ((_d = pinned === null || pinned === void 0 ? void 0 : pinned.ports) === null || _d === void 0 ? void 0 : _d.mcpPort) !== ports.mcpPort;
+        if (options.port !== undefined && portsMoved) {
+            context.host.log("info", `This directory now uses ports ${ports.uiPort}/${ports.mcpPort}, and will keep doing so.`);
+        }
+        else if (ports.derived && portsMoved) {
+            context.host.log("info", `Ports ${ports_1.DEFAULT_UI_PORT}/${ports_1.DEFAULT_MCP_PORT} were busy, so this directory uses ${ports.uiPort}/${ports.mcpPort} and will keep doing so.`);
+        }
+        return {
+            directory,
+            packageDir,
+            organization,
+            credibleEnvironment,
+            config,
+            configPath,
+            serverRoot: ensureServerRoot(directory),
+            uiPort: ports.uiPort,
+            mcpPort: ports.mcpPort,
+        };
+    });
+}
+/**
+ * Which directory is the package.
+ *
+ * Usually the workspace itself. But `create-malloy-package` lays a project out
+ * as a Publisher *server* directory — `publisher.config.json`, `.mcp.json`,
+ * skills at the top, the package in a subdirectory it names — and a user who
+ * runs setup at the top is standing in the workspace, not the package. Treating
+ * the top as the package wrote a second manifest there and served the wrong
+ * directory. So: a workspace with a manifest of its own is the package; one
+ * without, whose `publisher.config.json` names local packages, serves one of
+ * those — `--package`, else the pin's earlier choice, else the only one, else a
+ * picker. The workspace files stay at the top whichever it is.
+ */
+function resolvePackageDir(directory, host, choice) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const decided = decidePackageDir(directory, choice);
+        if ("directory" in decided) {
+            if (decided.note)
+                host.log("info", decided.note);
+            return decided.directory;
+        }
+        return host.select(PACKAGE_QUESTION, decided.listed.map((dir, i) => ({ name: decided.names[i], value: dir })), { flag: `${exports.PACKAGE_FLAG} <dir>`, options: decided.names });
+    });
+}
+const PACKAGE_QUESTION = "This directory's publisher.config.json lists several packages. Which one should the local publisher serve?";
+/**
+ * The package directory, when it can be decided without asking; otherwise the
+ * choices to ask about. Pure, so {@link refuseUnanswerable} can tell up front
+ * that the question would come, and refuse a bad `--package` before anything
+ * is written.
+ */
+function decidePackageDir(directory, choice) {
+    if (fs_1.default.existsSync(path_1.default.join(directory, packagemanifest_1.PACKAGE_MANIFEST_FILE))) {
+        if (choice.flag) {
+            throw new host_1.SetupError(`${exports.PACKAGE_FLAG} was given, but this directory is itself a package (it has a ${packagemanifest_1.PACKAGE_MANIFEST_FILE}).`, `drop ${exports.PACKAGE_FLAG}.`);
+        }
+        return { directory };
+    }
+    const listed = listedPackageDirs(directory);
+    const names = listed.map((dir) => path_1.default.relative(directory, dir));
+    if (choice.flag) {
+        const wanted = path_1.default.resolve(directory, choice.flag);
+        if (!listed.includes(wanted)) {
+            throw new host_1.SetupError(`${exports.PACKAGE_FLAG} ${choice.flag} is not a package this directory's publisher.config.json lists.`, names.length
+                ? `pass one of: ${names.join(", ")}.`
+                : `drop ${exports.PACKAGE_FLAG}; this directory lists no local packages.`);
+        }
+        return { directory: wanted };
+    }
+    if (listed.length === 0)
+        return { directory };
+    if (choice.pinned) {
+        const pinned = path_1.default.resolve(directory, choice.pinned);
+        if (listed.includes(pinned))
+            return { directory: pinned };
+    }
+    if (listed.length === 1) {
+        return {
+            directory: listed[0],
+            note: `This is a Publisher server directory; serving the package it lists at ${names[0]}/.`,
+        };
+    }
+    return { listed, names };
+}
+/** The flag that answers {@link resolvePackageDir}'s question. */
+exports.PACKAGE_FLAG = "--package";
+exports.PORT_FLAG = "--port";
+/**
+ * The pair `--port` names, refused when something else holds it.
+ *
+ * Unlike the remembered pair, which quietly gives way to another when busy, a
+ * chosen pair is used as given or not at all: moving off it would point
+ * `.mcp.json` somewhere the user did not ask for. This directory's own running
+ * session holding it is not a conflict (`--no-start` beside `cred dev`). That
+ * session running on a different pair is: moving the pin and `.mcp.json` away
+ * from the live server leaves the agent's URL pointing at nothing, and the
+ * next ownership check would miss the running server.
+ */
+function chosenPair(directory, uiPort, own) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const pair = (0, ports_1.pairForUiPort)(uiPort);
+        const derived = pair.uiPort !== ports_1.DEFAULT_UI_PORT || pair.mcpPort !== ports_1.DEFAULT_MCP_PORT;
+        if (own.ownSessionRunning && own.pinned) {
+            if (own.pinned.uiPort === pair.uiPort &&
+                own.pinned.mcpPort === pair.mcpPort) {
+                return Object.assign(Object.assign({}, pair), { derived });
+            }
+            throw new host_1.SetupError(`This directory's local Publisher is running on ${own.pinned.uiPort}/${own.pinned.mcpPort}, so ${exports.PORT_FLAG} ${uiPort} cannot move it.`, `stop that session (Ctrl-C in its terminal), then run this again with ${exports.PORT_FLAG} ${uiPort}.`);
+        }
+        if (yield (0, ports_1.pairIsFree)(pair)) {
+            return Object.assign(Object.assign({}, pair), { derived });
+        }
+        throw new host_1.SetupError(`Ports ${pair.uiPort}/${pair.mcpPort}, from ${exports.PORT_FLAG} ${uiPort}, are in use.`, portFix(yield (0, ports_1.suggestFreePair)(directory)));
+    });
+}
+/** Local package directories a `publisher.config.json` names, that exist. */
+function listedPackageDirs(directory) {
+    const parsed = (0, localpublisherconfig_1.readLocalPublisherConfig)(directory);
+    const found = [];
+    const environments = parsed === null || parsed === void 0 ? void 0 : parsed.environments;
+    if (!Array.isArray(environments))
+        return found;
+    for (const environment of environments) {
+        const packages = environment === null || environment === void 0 ? void 0 : environment.packages;
+        if (!Array.isArray(packages))
+            continue;
+        for (const entry of packages) {
+            const location = entry === null || entry === void 0 ? void 0 : entry.location;
+            // Only local paths: a GCS/S3/GitHub URI is not a directory to serve.
+            if (typeof location !== "string" ||
+                /^[a-z][a-z0-9+.-]*:\/\//i.test(location)) {
+                continue;
+            }
+            const resolved = path_1.default.resolve(directory, location);
+            if (resolved !== directory && fs_1.default.existsSync(resolved)) {
+                found.push(resolved);
+            }
+        }
+    }
+    return [...new Set(found)];
+}
+/**
+ * Step 4b: install or refresh the skills, when this front door can fetch them.
+ *
+ * Returns the state to pin, or `undefined` when nothing was synced. A failure
+ * here is reported and does not fail setup: the directory still works with the
+ * MCP servers alone, and the next `cred dev` tries again — whereas failing would
+ * take a working publisher down over a docs download.
+ *
+ * Skills already present that we did not install — `create-malloy-package`'s
+ * set, most often — are the one question here, asked once: on a first install
+ * that finds some, and not on later runs, where "not ours" also describes the
+ * user's own skills. `replace` is the recommendation because the served
+ * `malloy-*` skills are the same ones the scaffolder installs, at a pinned
+ * version, plus Credible's — and because it moves them into
+ * `.credible/replaced-skills/` rather than deleting them, since on a first
+ * install they may be the user's own. `keep` installs beside them, except a
+ * skill with the same name as one of ours: two cannot share a directory, and
+ * writing ours over it would record its files as ours and delete them on the
+ * next update. So a same-named one is moved aside as `replace` would, and said
+ * so. `none` leaves the directory alone.
+ *
+ * `declined` is whether the user has turned the skills down, by flag, by the
+ * picker, or earlier (the pin's `skillsPolicy`, passed in as `policy`). The
+ * flow records it in the pin so no later run asks again or installs them.
+ */
+function syncSkills(context, directory, previous, policy) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (policy === "none")
+            return { installed: previous, declined: true };
+        if (!context.fetchSkills)
+            return { declined: false };
+        const foreign = previous ? [] : (0, skills_1.foreignSkills)(directory);
+        let decided = policy !== null && policy !== void 0 ? policy : "keep";
+        if (foreign.length && !policy) {
+            decided = yield context.host.select(skillsQuestion(foreign), [
+                {
+                    // Short enough for an 80-column terminal: inquirer wraps a long
+                    // row, and the half that fell off was the half that mattered.
+                    name: "Replace them with Credible's set — moved aside, not deleted (recommended)",
+                    value: "replace",
+                },
+                {
+                    name: "Keep them, and install Credible's beside them",
+                    value: "keep",
+                },
+                { name: "Do not install skills", value: "none" },
+            ], { flag: skills_1.SKILLS_FLAG, options: ["replace", "keep", "none"] });
+            if (decided === "none")
+                return { declined: true };
+        }
+        let response;
+        try {
+            response = yield context.fetchSkills(skills_1.SKILLS_MANIFEST);
+        }
+        catch (error) {
+            context.host.log("warn", `Could not fetch the modeling skills (${error instanceof Error ? error.message : String(error)}). Continuing without them; the next \`cred dev\` will try again.`);
+            return { declined: false };
+        }
+        if (!response)
+            return { declined: false };
+        if (decided === "replace" && foreign.length) {
+            const movedTo = (0, skills_1.moveForeignSkills)(directory, foreign);
+            context.host.log("info", `Moved ${foreign.length} skill${foreign.length === 1 ? "" : "s"} that cred did not install to ${movedTo}/, as asked. Delete that directory once you are sure nothing in it is yours.`);
+        }
+        else if (decided === "keep" && foreign.length) {
+            // Every skill writeSkillFiles writes: the auto-discovered ones and the
+            // supporting ones they reference.
+            const ours = new Set([...response.auto_discovered, ...response.supporting].map((skill) => skill.name));
+            const colliding = foreign.filter((name) => ours.has(name));
+            if (colliding.length) {
+                const movedTo = (0, skills_1.moveForeignSkills)(directory, colliding);
+                context.host.log("warn", `Kept your existing skills. ${joinNames(colliding)} had the same name${colliding.length === 1 ? "" : "s"} as Credible's, so ${colliding.length === 1 ? "yours was" : "yours were"} moved to ${movedTo}/.`);
+            }
+        }
+        return {
+            installed: (0, skills_1.installSkills)(directory, response, context.host, previous)
+                .state,
+            declined: false,
+        };
+    });
+}
+/** Step 5 and 6: start the server, and open it once it is genuinely serving. */
+function startSession(context, wired, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return (0, supervisor_1.startPublisher)({
+            directory: wired.directory,
+            serverRoot: wired.serverRoot,
+            configPath: wired.configPath,
+            config: wired.config,
+            uiPort: wired.uiPort,
+            mcpPort: wired.mcpPort,
+            watchEnvironment: wired.config.environments[0].name,
+            publisherVersion: context.publisherVersion,
+            host: context.host,
+            credStore: context.credStore,
+            openBrowser: options.open,
+            showAllOutput: context.showAllPublisherOutput,
+        });
+    });
+}
+/**
+ * The whole flow: wire, then run.
+ *
+ * Setup deliberately ends in a running server rather than a printed
+ * instruction. Every step before that is invisible plumbing the user cannot
+ * check, and the Publisher UI is the first artifact that proves the whole chain
+ * — auth, connections, proxy, compile — is actually live. A setup that ends with
+ * "now run `cred dev`" ends on an unverified claim.
+ */
+function runSetup(context, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const wired = yield wireDirectory(context, options);
+        if (!options.start) {
+            context.host.log("info", 
+            // The last line an agent sees, so it repeats the restart: the agent
+            // that ran this has no `malloy` tools until it starts again.
+            `Wired ${wired.directory}. Next: restart any agent session in that directory so it loads .mcp.json, then run \`cred dev\` there to start the publisher.`);
+            return { wired };
+        }
+        const running = yield startSession(context, wired, { open: options.open });
+        return { wired, running };
+    });
+}
+/** "a", "a and b", "a, b and c". */
+function joinNames(names) {
+    return names.length <= 2
+        ? names.join(" and ")
+        : `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}
+//# sourceMappingURL=flow.js.map