@indecisivedev/openplan 0.2.0-alpha.2

package/dist/celld-quickstart.js

@@ -0,0 +1,1175 @@
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createInterface } from "node:readline/promises";
+import { normalizeApiUrl } from "./cli-endpoint.js";
+import { CredentialStore, CredentialError, validateApiKey } from "./cli-credentials.js";
+import { createEnrollmentApiClient } from "./cli-api-client.js";
+export const QUICKSTART_STAGES = [
+    "preflight",
+    "prepare",
+    "deploy",
+    "activate",
+    "migrate",
+    "prove"
+];
+const DEFAULT_COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 20 * 1000;
+const READINESS_TIMEOUT_MS = 60 * 1000;
+const READINESS_RETRY_DELAY_MS = 1 * 1000;
+const MAX_CAPTURED_OUTPUT = 128 * 1024;
+const MAX_PROBE_RESPONSE_BYTES = 256 * 1024;
+const SECRET_KEYS = [
+    "BOOTSTRAP_API_KEY",
+    "SESSION_SECRET",
+    "OPENPLAN_SHARE_SECRET",
+    "OPENPLAN_RECONCILE_SECRET",
+    "DRAFTS_S3_ACCESS_KEY_ID",
+    "DRAFTS_S3_SECRET_ACCESS_KEY"
+];
+/** Safe, actionable diagnostics: never include raw transport or child errors. */
+export class QuickstartError extends Error {
+    constructor(message) { super(message); this.name = "QuickstartError"; }
+}
+export async function runCelldQuickstart(options) {
+    const io = options.io || defaultIo();
+    const executor = options.executor || createDefaultExecutor();
+    const inputs = await resolveInputs(options, io);
+    const dryRun = options.dryRun === true;
+    if (inputs.nodeHosts.length > 0 && !inputs.remoteVarsFile) {
+        throw new QuickstartError("Remote nodes require --remote-vars-file so the protected Worker variables can be copied without printing them.");
+    }
+    // Read and validate retained effective credentials even for --reset. A reset
+    // is never authority to rotate or rebind a key to a new target.
+    const recordedState = readState(inputs.stateFile);
+    const previousState = options.reset ? null : recordedState;
+    if (previousState && !sameStateInputs(previousState.inputs, inputs)) {
+        throw new QuickstartError(`Quickstart state belongs to different inputs: ${inputs.stateFile}. Review the effective bootstrap origin before using --reset.`);
+    }
+    // A completed resume does not enroll old credentials or rewrite any file.
+    if (previousState?.completedStages.includes("prove") && !dryRun) {
+        io.log(`Openplan celld quickstart is already complete; state: ${inputs.stateFile}`);
+        return;
+    }
+    const prepared = prepareConfig(inputs, recordedState);
+    io.log(`Target: ${inputs.publicUrl}. After the full private-sample proof, enroll this origin's bootstrap credential and replace the CLI default endpoint; other origins' credentials are preserved.`);
+    // All target/binding/config validation above is read-only, including reset.
+    if (!dryRun) {
+        if (options.reset)
+            removeStateFile(inputs.stateFile);
+        if (!recordedState && prepared.vars.path !== inputs.varsFile && !fs.existsSync(prepared.vars.path)) {
+            ensureDirectory(path.dirname(prepared.vars.path), 0o700);
+            writeText(prepared.vars.path, serializeVars(prepared.vars.values), 0o600);
+        }
+    }
+    const state = previousState || {
+        version: 2,
+        inputs: stateInputs(inputs),
+        effectiveVarsFile: prepared.vars.path,
+        completedStages: [],
+        updatedAt: new Date().toISOString()
+    };
+    if (state.effectiveVarsFile !== prepared.vars.path) {
+        throw new QuickstartError(`The protected variables file recorded by quickstart is missing or changed: ${state.effectiveVarsFile}. Re-run with --reset after reviewing it.`);
+    }
+    // Incomplete retries recheck the fleet and activation before any pending migration.
+    if (!dryRun && !state.completedStages.includes("prove")) {
+        state.completedStages = state.completedStages.filter(stage => stage !== "preflight" &&
+            !(stage === "activate" && !state.completedStages.includes("migrate")));
+    }
+    const stages = dryRun
+        ? QUICKSTART_STAGES
+        : QUICKSTART_STAGES.filter((stage) => !state.completedStages.includes(stage));
+    if (stages.length === 0) {
+        io.log(`Openplan celld quickstart is already complete; state: ${inputs.stateFile}`);
+        return;
+    }
+    for (const stage of stages) {
+        io.log(`\n== ${stage} ==`);
+        switch (stage) {
+            case "preflight": {
+                const minor = await preflight(inputs, prepared.vars, executor, io, dryRun, options.fetchImpl || fetch);
+                if (state.completedStages.includes("deploy") && state.celldMinor && minor !== state.celldMinor) {
+                    throw new QuickstartError("The celld version changed after publication. Review the deployed configuration before starting a new run with --reset.");
+                }
+                state.celldMinor = minor;
+                break;
+            }
+            case "prepare":
+                await prepare(inputs, executor, io, dryRun);
+                break;
+            case "deploy":
+                state.deploymentVersion = await deploy(inputs, prepared.vars, executor, io, dryRun, options.yes === true, state);
+                break;
+            case "activate":
+                await activate(inputs, executor, io, dryRun, options.fetchImpl || fetch, state);
+                break;
+            case "migrate":
+                await migrate(inputs, executor, io, dryRun, state);
+                break;
+            case "prove":
+                await prove(inputs, prepared.apiKey, options.homeDir || os.homedir(), options.fetchImpl || fetch, io, dryRun);
+                break;
+        }
+        if (!dryRun) {
+            if (stage === "preflight")
+                state.detectedFleetMode = "dedicated";
+            if (!state.completedStages.includes(stage))
+                state.completedStages.push(stage);
+            state.updatedAt = new Date().toISOString();
+            try {
+                writeState(inputs.stateFile, state);
+            }
+            catch {
+                if (stage === "prove") {
+                    throw new QuickstartError("Proof and CLI credential/default commit succeeded, but the completion checkpoint failed. The connection remains saved; inspect local status before retrying. Retrying may create another private sample.");
+                }
+                throw new QuickstartError("Quickstart progress checkpoint failed. Inspect the local state file and completed deployment actions before retrying.");
+            }
+            io.log(`PASS: ${stage}`);
+        }
+    }
+    if (dryRun) {
+        io.log("\nDry-run complete; no fleet mutation, CLI credential write, or sample upload was performed.");
+    }
+    else {
+        io.log("\nOpenplan celld quickstart completed successfully.");
+    }
+}
+export function createDefaultExecutor() {
+    return {
+        run(file, args, options = {}) {
+            return new Promise((resolve, reject) => {
+                const child = spawn(file, args, {
+                    cwd: options.cwd,
+                    shell: false,
+                    stdio: ["ignore", "pipe", "pipe"]
+                });
+                let stdout = "";
+                let stderr = "";
+                let settled = false;
+                let timer;
+                const finish = (result) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    if (timer)
+                        clearTimeout(timer);
+                    resolve(result);
+                };
+                child.stdout.setEncoding("utf8");
+                child.stderr.setEncoding("utf8");
+                child.stdout.on("data", (chunk) => {
+                    stdout = appendOutput(stdout, chunk);
+                });
+                child.stderr.on("data", (chunk) => {
+                    stderr = appendOutput(stderr, chunk);
+                });
+                child.once("error", (error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    if (timer)
+                        clearTimeout(timer);
+                    reject(error);
+                });
+                child.once("close", (exitCode) => finish({ exitCode, stdout, stderr }));
+                if (options.timeoutMs && options.timeoutMs > 0) {
+                    timer = setTimeout(() => {
+                        child.kill();
+                        finish({ exitCode: null, stdout, stderr: `${stderr}\nTimed out after ${options.timeoutMs}ms.` });
+                    }, options.timeoutMs);
+                }
+            });
+        }
+    };
+}
+async function resolveInputs(options, io) {
+    const repoRoot = path.resolve(options.repoRoot);
+    const homeDir = path.resolve(options.homeDir || os.homedir());
+    const stateFile = path.resolve(options.stateFile || path.join(homeDir, ".openplan", "celld-quickstart.json"));
+    assertOutsideCheckout(stateFile, repoRoot, "state file");
+    let varsFile = options.varsFile || process.env.CELLD_VARS_FILE || "";
+    if (!varsFile) {
+        varsFile = await promptForValue("protected Worker variables file", "--vars-file", options.nonInteractive === true, io);
+    }
+    varsFile = path.resolve(varsFile);
+    assertOutsideCheckout(varsFile, repoRoot, "variables file");
+    const rawVars = readVars(varsFile);
+    let fleetBucket = options.fleetBucket || process.env.CELLD_BUCKET || rawVars.values.CELLD_BUCKET || "";
+    if (!fleetBucket) {
+        fleetBucket = await promptForValue("celld fleet bucket", "--fleet-bucket", options.nonInteractive === true, io);
+    }
+    let publicUrl = options.publicUrl || process.env.OPENPLAN_PUBLIC_URL || rawVars.values.PUBLIC_BASE_URL || "";
+    if (!publicUrl) {
+        publicUrl = await promptForValue("public Openplan URL", "--public-url", options.nonInteractive === true, io);
+    }
+    const nodeHosts = uniqueHosts([...(options.nodes || []), ...(options.remoteHosts || [])]);
+    for (const host of nodeHosts)
+        validateHost(host);
+    const remoteVarsFile = options.remoteVarsFile ? validateRemotePath(options.remoteVarsFile) : null;
+    const restartProgram = options.restartProgram || defaultRestartProgram(nodeHosts.length > 0);
+    const restartArgs = options.restartArgs && options.restartArgs.length > 0
+        ? [...options.restartArgs]
+        : defaultRestartArgs(restartProgram);
+    const fleetMode = options.fleetMode || "auto";
+    if (fleetMode !== "auto" && fleetMode !== "dedicated" && fleetMode !== "shared") {
+        throw new QuickstartError("Unknown fleet mode. Use auto, dedicated, or shared.");
+    }
+    validateFleetBucket(fleetBucket);
+    const normalizedPublicUrl = normalizeApiUrl(publicUrl, "Public URL");
+    validateProtectedFile(varsFile);
+    validateRepository(repoRoot);
+    return {
+        repoRoot,
+        fleetBucket,
+        publicUrl: normalizedPublicUrl,
+        varsFile,
+        stateFile,
+        fleetMode,
+        nodeHosts,
+        remoteVarsFile,
+        operatorUrls: (options.operatorUrls || []).map(normalizeOperatorUrl),
+        restartProgram,
+        restartArgs,
+        commandTimeoutMs: positiveNumber(options.commandTimeoutMs, DEFAULT_COMMAND_TIMEOUT_MS),
+        requestTimeoutMs: positiveNumber(options.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS),
+        cliVersion: options.cliVersion || "quickstart",
+        homeDir
+    };
+}
+function prepareConfig(inputs, previousState) {
+    if (previousState) {
+        if (!fs.existsSync(previousState.effectiveVarsFile)) {
+            throw new QuickstartError(`Protected variables file from quickstart state does not exist: ${previousState.effectiveVarsFile}`);
+        }
+        const vars = readVars(previousState.effectiveVarsFile);
+        validateVars(vars, inputs.publicUrl);
+        return { vars, apiKey: readApiKey(vars) };
+    }
+    // A failed preflight can leave generated effective variables before the first
+    // checkpoint exists. They are retained credentials too, not disposable output.
+    const retainedVarsPath = path.join(path.dirname(inputs.stateFile), `${path.basename(inputs.stateFile)}.vars`);
+    if (fs.existsSync(retainedVarsPath)) {
+        const vars = readVars(retainedVarsPath);
+        validateVars(vars, inputs.publicUrl);
+        return { vars, apiKey: readApiKey(vars) };
+    }
+    const source = readVars(inputs.varsFile);
+    validateBootstrapBinding(source, inputs.publicUrl);
+    const values = { ...source.values };
+    let changed = false;
+    const setValue = (key, value) => {
+        if (values[key] !== value) {
+            values[key] = value;
+            changed = true;
+        }
+    };
+    setValue("CELLD_BUCKET", inputs.fleetBucket);
+    setValue("PUBLIC_BASE_URL", inputs.publicUrl);
+    if (!values.OPENPLAN_DRAFT_ACCESS)
+        setValue("OPENPLAN_DRAFT_ACCESS", "link");
+    if (!values.OPENPLAN_ALLOW_ANONYMOUS_UPLOADS)
+        setValue("OPENPLAN_ALLOW_ANONYMOUS_UPLOADS", "false");
+    if (!values.OPENPLAN_PASSWORD_ITERATIONS)
+        setValue("OPENPLAN_PASSWORD_ITERATIONS", "210000");
+    const bootstrap = values.BOOTSTRAP_API_KEY || values.OPENPLAN_BOOTSTRAP_API_KEY;
+    setValue("BOOTSTRAP_API_KEY", bootstrap || `op_${randomBytes(32).toString("base64url")}`);
+    if (!bootstrap)
+        setValue("OPENPLAN_BOOTSTRAP_API_KEY_ORIGIN", inputs.publicUrl);
+    setValue("SESSION_SECRET", values.SESSION_SECRET || randomBytes(32).toString("hex"));
+    setValue("OPENPLAN_SHARE_SECRET", values.OPENPLAN_SHARE_SECRET || randomBytes(32).toString("hex"));
+    setValue("OPENPLAN_RECONCILE_SECRET", values.OPENPLAN_RECONCILE_SECRET || randomBytes(32).toString("hex"));
+    const varsPath = changed
+        ? path.join(path.dirname(inputs.stateFile), `${path.basename(inputs.stateFile)}.vars`)
+        : inputs.varsFile;
+    if (changed) {
+        assertOutsideCheckout(varsPath, inputs.repoRoot, "generated variables file");
+    }
+    const vars = { path: varsPath, values };
+    validateVars(vars, inputs.publicUrl, !changed);
+    return { vars, apiKey: readApiKey(vars) };
+}
+async function preflight(inputs, vars, executor, io, dryRun, fetchImpl) {
+    validateVars(vars, inputs.publicUrl, !dryRun || fs.existsSync(vars.path));
+    await requireCommand(executor, executable("npm"), inputs.commandTimeoutMs, "npm");
+    const remote = inputs.nodeHosts.length > 0;
+    if (remote) {
+        await requireCommand(executor, executable("ssh"), inputs.commandTimeoutMs, "ssh");
+        await requireCommand(executor, executable("scp"), inputs.commandTimeoutMs, "scp");
+    }
+    else {
+        await requireCommand(executor, executable("celld"), inputs.commandTimeoutMs, "celld");
+    }
+    const version = await runFleetCommand(inputs, executor, ["--version"], io, "celld version");
+    const versionMatch = `${version.stdout}\n${version.stderr}`.match(/celld\s+v?(\d+)\.(\d+)\.(\d+)([^\s]*)/i);
+    if (!versionMatch)
+        throw new QuickstartError("Preflight could not determine the celld version.");
+    if (versionMatch[1] !== "0" || !(versionMatch[2] === "3" || versionMatch[2] === "4" || (versionMatch[2] === "5" && versionMatch[3] === "1" && !versionMatch[4]))) {
+        throw new QuickstartError(`This quickstart supports celld 0.3.x and 0.4.x, plus pinned 0.5.1; found ${versionMatch[1]}.${versionMatch[2]}.${versionMatch[3]}.`);
+    }
+    if (versionMatch[2] === "5" && remote) {
+        throw new QuickstartError("For celld 0.5.1, run celld on this CLI machine with fleet credentials and one --operator-url per node. SSH --node publication is only supported on 0.3/0.4.");
+    }
+    if (versionMatch[2] === "5" && Object.keys(process.env).some(name => name === "CELLD_VARS_FILE" || name.startsWith("CELLD_VAR_"))) {
+        throw new QuickstartError("celld 0.5.1 removed CELLD_VARS_FILE and CELLD_VAR_* overrides. Unset them in this shell and node services, then pass the protected input with --vars-file; the quickstart publishes Wrangler bindings.");
+    }
+    for (const host of inputs.nodeHosts.slice(1)) {
+        const peer = await runCommand(executor, executable("ssh"), sshArgs(host, executable("celld"), ["--version"]), inputs, io, "celld node version");
+        const match = `${peer.stdout}\n${peer.stderr}`.match(/celld\s+v?(\d+)\.(\d+)\.(\d+)/i);
+        if (!match || match[1] !== versionMatch[1] || match[2] !== versionMatch[2]) {
+            throw new QuickstartError("Every intended node must use the same supported celld minor version. Do not mix celld 0.3 and 0.4 or 0.5 in one fleet.");
+        }
+    }
+    const diagnose = await runFleetCommand(inputs, executor, ["diagnose", "--bucket", inputs.fleetBucket, "--read-only"], io, "celld fleet diagnose");
+    const mode = classifyFleet(`${diagnose.stdout}\n${diagnose.stderr}`);
+    if (mode === "shared") {
+        throw new QuickstartError("Preflight detected a shared celld fleet. The generic quickstart stops here; use an operator-specific named-service workflow.");
+    }
+    if (inputs.fleetMode === "shared") {
+        throw new QuickstartError("--fleet-mode shared is not supported by the generic quickstart; use a named-service workflow instead.");
+    }
+    if (inputs.fleetMode === "auto" && mode !== "dedicated") {
+        throw new QuickstartError("Preflight could not prove that the fleet is dedicated. Review the read-only diagnose output and re-run with --fleet-mode dedicated.");
+    }
+    const leaseCount = `${diagnose.stdout}\n${diagnose.stderr}`.match(/\bfleet:?\s+(\d+)\s+node lease(?:\(s\)|s)? enumerated/i);
+    if (!leaseCount) {
+        throw new QuickstartError("Preflight could not verify active nodes from celld diagnose. Run the displayed read-only diagnosis and confirm a healthy running fleet before retrying.");
+    }
+    if (Number(leaseCount[1]) === 0) {
+        throw new QuickstartError("The fleet has no running node leases. Start a celld node for this dedicated fleet and verify its read-only diagnosis before retrying; D1 migrations require a running node. No deployment was performed.");
+    }
+    if (versionMatch[2] !== "3") {
+        if (inputs.operatorUrls.length !== Number(leaseCount[1]) ||
+            new Set(inputs.operatorUrls).size !== inputs.operatorUrls.length) {
+            throw new QuickstartError("celld 0.4/0.5.1 requires one distinct --operator-url per node lease, reachable from this CLI through a trusted private connection or local tunnel.");
+        }
+        for (const url of inputs.operatorUrls)
+            await readOperatorState(inputs, url, fetchImpl);
+    }
+    io.log(`Detected celld ${versionMatch[1]}.${versionMatch[2]}.${versionMatch[3]} on a dedicated fleet with ${leaseCount[1]} node lease(s).`);
+    return versionMatch[2];
+}
+async function prepare(inputs, executor, io, dryRun) {
+    if (dryRun) {
+        describeCommand(executable("npm"), ["ci"], io, "DRY-RUN");
+        describeCommand(executable("npm"), ["run", "worker:build"], io, "DRY-RUN");
+    }
+    else {
+        await runLocalCommand(executor, inputs, ["ci"], io, "npm ci");
+        await runLocalCommand(executor, inputs, ["run", "worker:build"], io, "npm run worker:build");
+    }
+    const manifest = fs.readFileSync(path.join(inputs.repoRoot, "worker", "wrangler.jsonc"), "utf8");
+    for (const marker of ["\"main\"", "\"d1_databases\"", "\"migrations_dir\""]) {
+        if (!manifest.includes(marker)) {
+            throw new QuickstartError(`Prepare could not validate worker/wrangler.jsonc; missing ${marker}.`);
+        }
+    }
+    if (dryRun)
+        io.log("Prepared local dependencies and Worker build for the deployment preview.");
+}
+async function deploy(inputs, vars, executor, io, dryRun, confirmed, state) {
+    const project = state.celldMinor === "5" ? privateWorkerProject(inputs) : "worker";
+    const deployArgs = ["deploy", project, "--bucket", inputs.fleetBucket, "--json"];
+    if (dryRun) {
+        if (state.celldMinor === "5") {
+            io.log(`DRY-RUN: create protected Worker project at ${project}; variables become fleet deployment bindings. Every fleet-storage reader can read these secrets.`);
+        }
+        else
+            await distributeVars(inputs, vars.path, executor, io, true);
+        describeFleetCommand(inputs, deployArgs, io, "DRY-RUN");
+        return "preview";
+    }
+    if (!confirmed) {
+        const approved = await io.confirm(`Deploy, activate the Worker, and apply D1 migrations to this dedicated fleet; then, after full proof, enroll the bootstrap credential for ${inputs.publicUrl} and replace the CLI default endpoint? [y/N] `);
+        if (!approved)
+            throw new QuickstartError("Deployment cancelled before mutation.");
+    }
+    if (state.celldMinor === "5") {
+        state.workerProjectDigest = preparePrivateWorkerProject(inputs, vars);
+        io.log("Protected Worker snapshot prepared outside the checkout. Worker variables are stored in the fleet deployment; restrict fleet-storage readers accordingly.");
+    }
+    else
+        await distributeVars(inputs, vars.path, executor, io, false);
+    const result = await runFleetCommand(inputs, executor, deployArgs, io, "celld Worker deploy");
+    let output;
+    try {
+        output = JSON.parse(result.stdout);
+    }
+    catch { /* reject without echoing child output */ }
+    if (!isRecord(output) || typeof output.version !== "string" || !/^[a-f0-9]{16}$/i.test(output.version)) {
+        throw new QuickstartError("Worker was published but celld returned no valid deployment version. Inspect deployment diagnostics before retrying.");
+    }
+    return output.version;
+}
+async function distributeVars(inputs, varsFile, executor, io, dryRun) {
+    const hosts = inputs.nodeHosts.length > 0 ? inputs.nodeHosts : [null];
+    for (const host of hosts) {
+        const label = host || "local node";
+        if (host && inputs.remoteVarsFile) {
+            const copyArgs = ["-q", varsFile, `${host}:${inputs.remoteVarsFile}`];
+            if (dryRun)
+                describeCommand(executable("scp"), copyArgs, io, "DRY-RUN");
+            else {
+                await runCommand(executor, executable("scp"), copyArgs, inputs, io, `copy protected variables to ${label}`);
+            }
+            const chmodArgs = sshArgs(host, "chmod", ["600", inputs.remoteVarsFile]);
+            if (dryRun)
+                describeCommand(executable("ssh"), chmodArgs, io, "DRY-RUN");
+            else
+                await runCommand(executor, executable("ssh"), chmodArgs, inputs, io, `protect variables on ${label}`);
+        }
+        else if (!host) {
+            io.log(`Using protected variables file for local node: ${varsFile}`);
+        }
+    }
+    io.log("Service configuration must already load this effective CELLD_VARS_FILE; the quickstart does not edit or verify service-manager settings.");
+}
+function privateWorkerProject(inputs) {
+    const project = `${inputs.stateFile}.worker`;
+    assertOutsideCheckout(project, inputs.repoRoot, "protected Worker project");
+    return project;
+}
+/** 0.5 removed node-local variable overrides. Keep secret bindings and the
+ * exact build/migration inputs in a protected snapshot outside the source tree.
+ * Deploy and migration both consume this snapshot; retries never rebuild it. */
+function preparePrivateWorkerProject(inputs, vars) {
+    const project = privateWorkerProject(inputs);
+    let manifest;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(inputs.repoRoot, "worker/wrangler.jsonc"), "utf8"));
+        if (!isRecord(parsed) || !Array.isArray(parsed.d1_databases) || parsed.d1_databases.length !== 1 ||
+            !isRecord(parsed.d1_databases[0]) || parsed.d1_databases[0].migrations_dir !== "migrations")
+            throw new Error();
+        manifest = { ...parsed, main: "index.js", no_bundle: true,
+            vars: { ...(isRecord(parsed.vars) ? parsed.vars : {}), ...vars.values } };
+    }
+    catch {
+        throw new QuickstartError("celld 0.5.1 quickstart requires the supplied JSON-formatted Worker manifest with one D1 database and migrations_dir=migrations.");
+    }
+    const sourceBundle = path.join(inputs.repoRoot, "worker/dist/index.js");
+    if (!fs.existsSync(sourceBundle))
+        throw new QuickstartError("Worker build produced no worker/dist/index.js; no deployment was performed.");
+    const migrations = path.join(inputs.repoRoot, "worker/migrations");
+    const names = fs.readdirSync(migrations).sort();
+    if (!names.length || names.some(name => !/^\d+_[A-Za-z0-9_-]+\.sql$/.test(name) || !fs.lstatSync(path.join(migrations, name)).isFile())) {
+        throw new QuickstartError("Worker migrations must be a nonempty directory of ordered SQL files; no deployment was performed.");
+    }
+    // Refuse redirected paths rather than chmod/copy through a symlink into a
+    // checkout or another user's directory. The parent may be an existing home.
+    const parent = path.dirname(project);
+    fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+    assertOutsideCheckout(fs.realpathSync(parent), fs.realpathSync(inputs.repoRoot), "protected Worker project parent");
+    for (const directory of [project, path.join(project, "migrations")]) {
+        if (fs.existsSync(directory))
+            validatePrivateDirectory(directory);
+        else
+            fs.mkdirSync(directory, { mode: 0o700 });
+    }
+    // Refuse stale extra files rather than carrying unknown migration inputs into
+    // a new deployment. An interrupted publication may reuse this exact shape.
+    const expected = new Set(["index.js", "wrangler.json", ...names.map(name => `migrations/${name}`)]);
+    if (privateProjectFiles(project).some(name => !expected.has(name))) {
+        throw new QuickstartError("Protected Worker project contains unexpected files. Review and move it aside before retrying with --reset.");
+    }
+    writeText(path.join(project, "index.js"), fs.readFileSync(sourceBundle, "utf8"), 0o600);
+    for (const name of names)
+        writeText(path.join(project, "migrations", name), fs.readFileSync(path.join(migrations, name), "utf8"), 0o600);
+    writeText(path.join(project, "wrangler.json"), JSON.stringify(manifest, null, 2) + "\n", 0o600);
+    return privateProjectDigest(project);
+}
+function validatePrivateDirectory(directory) {
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || (process.platform !== "win32" && (stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0))) {
+        throw new QuickstartError("Protected Worker project must use owner-only directories without symlinks.");
+    }
+}
+function privateProjectFiles(project) {
+    validatePrivateDirectory(project);
+    const files = [];
+    for (const name of fs.readdirSync(project).sort()) {
+        const file = path.join(project, name);
+        if (name === "migrations") {
+            validatePrivateDirectory(file);
+            for (const migration of fs.readdirSync(file).sort()) {
+                validateProtectedFile(path.join(file, migration));
+                files.push(`migrations/${migration}`);
+            }
+        }
+        else {
+            validateProtectedFile(file);
+            files.push(name);
+        }
+    }
+    return files.sort();
+}
+function privateProjectDigest(project) {
+    const digest = createHash("sha256");
+    for (const name of privateProjectFiles(project)) {
+        const contents = fs.readFileSync(path.join(project, name));
+        digest.update(`${name}\0${contents.length}\0`).update(contents);
+    }
+    return digest.digest("hex");
+}
+function verifyPrivateWorkerProject(inputs, state) {
+    try {
+        const project = privateWorkerProject(inputs);
+        assertOutsideCheckout(fs.realpathSync(project), fs.realpathSync(inputs.repoRoot), "protected Worker project");
+        if (!state.workerProjectDigest || privateProjectDigest(project) !== state.workerProjectDigest)
+            throw new Error();
+    }
+    catch {
+        throw new QuickstartError("Protected Worker snapshot is missing, changed, or no longer private. Restore the exact published snapshot before resuming; no migrations were started.");
+    }
+}
+async function activate(inputs, executor, io, dryRun, fetchImpl, state) {
+    const hosts = inputs.nodeHosts.length > 0 ? inputs.nodeHosts : [null];
+    if (state.celldMinor === "3" && !inputs.restartProgram) {
+        if (dryRun) {
+            io.warn("DRY-RUN: no default restart program exists on this platform; pass --restart-program and repeat --restart-arg for activation.");
+        }
+        else {
+            throw new QuickstartError("Activation needs an explicit restart program on this platform. Pass --restart-program and repeat --restart-arg; the local runner does not wrap it in a shell.");
+        }
+    }
+    for (const host of hosts) {
+        const label = host || "local node";
+        if (state.celldMinor === "3" && inputs.restartProgram) {
+            if (host) {
+                const args = sshArgs(host, inputs.restartProgram, inputs.restartArgs);
+                if (dryRun)
+                    describeCommand(executable("ssh"), args, io, `DRY-RUN restart ${label}`);
+                else
+                    await runCommand(executor, executable("ssh"), args, inputs, io, `restart ${label}`);
+            }
+            else if (dryRun) {
+                describeCommand(inputs.restartProgram, inputs.restartArgs, io, "DRY-RUN restart local node");
+            }
+            else {
+                await runCommand(executor, inputs.restartProgram, inputs.restartArgs, inputs, io, "restart local node");
+            }
+        }
+    }
+    if (state.celldMinor === "4" || state.celldMinor === "5") {
+        if (!dryRun && state.celldMinor === "5")
+            verifyPrivateWorkerProject(inputs, state);
+        for (const url of inputs.operatorUrls) {
+            if (dryRun) {
+                io.log(`DRY-RUN: POST ${url}/reload; GET ${url}/state must match the published deployment version.`);
+                continue;
+            }
+            const result = await operatorJson(inputs, `${url}/reload`, "POST", fetchImpl);
+            if (!isRecord(result) || result.ok !== true ||
+                !["adopted", "unchanged"].includes(String(result.outcome)) || result.version !== state.deploymentVersion) {
+                throw new QuickstartError("celld reload did not confirm the published version. Inspect the node's logs and Worker variable configuration, then retry; migrations were not started.");
+            }
+            const loaded = await readOperatorState(inputs, url, fetchImpl);
+            if (loaded.version !== state.deploymentVersion) {
+                throw new QuickstartError("celld still serves a different deployment after reload. Inspect the node's logs, then retry; migrations were not started.");
+            }
+            io.log("PASS: node adopted the published Worker version.");
+        }
+    }
+}
+async function migrate(inputs, executor, io, dryRun, state) {
+    const project = state.celldMinor === "5" ? privateWorkerProject(inputs) : "worker";
+    if (!dryRun && state.celldMinor === "5")
+        verifyPrivateWorkerProject(inputs, state);
+    const database = state.celldMinor === "5" && !dryRun
+        ? JSON.parse(fs.readFileSync(path.join(project, "wrangler.json"), "utf8")).d1_databases[0].database_name
+        : "openplan";
+    if (typeof database !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(database)) {
+        throw new QuickstartError("The protected Worker snapshot has an unsupported D1 database name.");
+    }
+    for (const [args, label] of [
+        [["d1", "execute", database, "--command", "SELECT 1", project, "--bucket", inputs.fleetBucket], "D1 availability probe"],
+        [["d1", "migrations", "apply", database, project, "--bucket", inputs.fleetBucket], "D1 migrations"]
+    ]) {
+        if (dryRun)
+            describeFleetCommand(inputs, [...args], io, "DRY-RUN");
+        else
+            await runFleetCommand(inputs, executor, [...args], io, label);
+    }
+}
+async function operatorJson(inputs, url, method, fetchImpl) {
+    try {
+        return await fetchJson(fetchImpl, url, { method, redirect: "error" }, inputs.requestTimeoutMs, "celld operator request");
+    }
+    catch {
+        // Operator responses and transport errors can contain configuration values.
+        throw new QuickstartError("celld operator request failed. Check the private operator connection and node logs, then retry the same quickstart; no migrations will run until activation succeeds.");
+    }
+}
+async function readOperatorState(inputs, url, fetchImpl) {
+    const result = await operatorJson(inputs, `${url}/state`, "GET", fetchImpl);
+    if (!isRecord(result) || !isRecord(result.deployment) || typeof result.deployment.version !== "string") {
+        throw new QuickstartError("celld operator state has no deployment version. Check that --operator-url reaches the celld 0.4/0.5.1 internal listener.");
+    }
+    return { version: result.deployment.version };
+}
+async function prove(inputs, apiKey, homeDir, fetchImpl, io, dryRun) {
+    if (dryRun) {
+        io.log(`DRY-RUN: GET ${routeUrl(inputs.publicUrl, "healthz")}`);
+        io.log(`DRY-RUN: GET ${routeUrl(inputs.publicUrl, "readyz")}`);
+        io.log("DRY-RUN: authenticate the CLI, upload a private sample, verify owner access metadata and signed-out denial (no public sharing mutation).");
+        return;
+    }
+    await waitForReadiness(inputs, io, "proof readiness", fetchImpl);
+    const client = createEnrollmentApiClient(inputs.publicUrl, apiKey, {
+        fetchImpl, timeoutMs: inputs.requestTimeoutMs, userAgent: `openplan/${inputs.cliVersion}`
+    });
+    const apiMe = await client.me();
+    io.log("CLI authentication verified in memory; local connection is unchanged until full proof succeeds.");
+    const sample = "<!doctype html>\n<html lang=\"en\">\n<head><meta charset=\"utf-8\"><title>Openplan ready</title></head>\n<body><main><h1>Openplan is ready</h1><p>This draft was published through the celld quickstart.</p></main></body>\n</html>\n";
+    const uploadBody = await client.upload({
+        html: sample,
+        filename: "openplan-quickstart.html",
+        metadata: { cliVersion: inputs.cliVersion, fileSha256: createHash("sha256").update(sample).digest("hex") }
+    });
+    if (!isRecord(uploadBody) || typeof uploadBody.draftId !== "string" ||
+        !/^[a-z0-9]{12}$/.test(uploadBody.draftId) || uploadBody.versionNumber !== 1) {
+        throw new QuickstartError("Sample upload returned an invalid new draft identity.");
+    }
+    // Derive routes from the configured endpoint, never send the owner's key to
+    // a server-returned URL. This proof intentionally does not make anything public.
+    for (const version of [undefined, 1]) {
+        const overview = await client.getAccess(uploadBody.draftId, version ?? "access");
+        if (!isRecord(overview) || !isRecord(overview.access) ||
+            overview.access.mode !== "private" || overview.access.legacy !== false ||
+            typeof overview.access.policyId !== "string" || !overview.access.policyId) {
+            throw new QuickstartError("The new sample does not have a persisted private access policy.");
+        }
+    }
+    for (const alias of ["", "/raw", "/v/1", "/v/1/raw"]) {
+        for (const method of ["GET", "HEAD"]) {
+            const body = await fetchWithTimeout(fetchImpl, routeUrl(inputs.publicUrl, `d/${uploadBody.draftId}${alias}`), { method, redirect: "manual" }, inputs.requestTimeoutMs, "signed-out private sample check", [302, 401, 403, 404]);
+            if ((method === "HEAD" && body.length !== 0) ||
+                body.includes("Openplan is ready") || body.includes("Openplan ready") ||
+                body.includes("This draft was published through the celld quickstart")) {
+                throw new QuickstartError("A signed-out response disclosed private sample content or returned a HEAD body.");
+            }
+        }
+    }
+    io.log(`Private sample verified: ${routeUrl(inputs.publicUrl, `d/${uploadBody.draftId}`)}`);
+    io.log("Owner access metadata and signed-out denial verified; the sample remains private. Sign in and link the CLI account to verify browser access and exact document bytes. This check does not prove browser identity or byte-for-byte readback.");
+    // The proof may deploy/create a sample, but must never alter local connection
+    // state until every check has passed. Save the origin binding before default.
+    try {
+        await new CredentialStore(homeDir).save(client.origin, apiKey, apiMe);
+    }
+    catch (error) {
+        if (error instanceof CredentialError && error.code === "PERSISTENCE_UNCERTAIN") {
+            throw new QuickstartError("Proof succeeded, but credential persistence is uncertain after replacement. The CLI default was not changed. Inspect local auth status before retrying.");
+        }
+        throw new QuickstartError("Proof succeeded, but credential commit failed; the CLI default was not changed. Inspect local credential state before retrying.");
+    }
+    try {
+        persistCliDefault(homeDir, client.origin);
+    }
+    catch {
+        throw new QuickstartError("Proof succeeded; partial commit: the origin-bound credential was saved, but updating the CLI default failed. Inspect endpoint and auth status before retrying.");
+    }
+    io.log("Origin-bound CLI credential saved with owner-only permissions; CLI default endpoint updated.");
+}
+async function checkReadiness(inputs, io, label, fetchImpl, deadline) {
+    for (const route of ["healthz", "readyz"]) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            throw new QuickstartError(`${label} exhausted its readiness deadline.`);
+        const body = await fetchWithTimeout(fetchImpl, routeUrl(inputs.publicUrl, route), undefined, Math.min(inputs.requestTimeoutMs, remaining), `${label} (${route})`);
+        if (!body.replace(/\s/g, "").includes('"ok":true')) {
+            throw new QuickstartError(`${label} (${route}) returned a non-ready response.`);
+        }
+        io.log(`PASS: ${route}`);
+    }
+}
+async function waitForReadiness(inputs, io, label, fetchImpl) {
+    const deadline = Date.now() + READINESS_TIMEOUT_MS;
+    let lastError;
+    while (Date.now() < deadline) {
+        try {
+            await checkReadiness(inputs, io, label, fetchImpl, deadline);
+            return;
+        }
+        catch (error) {
+            lastError = error;
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            break;
+        await new Promise((resolve) => setTimeout(resolve, Math.min(READINESS_RETRY_DELAY_MS, remaining)));
+    }
+    if (lastError instanceof QuickstartError)
+        throw lastError;
+    throw new QuickstartError(`${label} did not succeed within ${READINESS_TIMEOUT_MS}ms.`);
+}
+async function fetchJson(fetchImpl, url, init, timeoutMs, label) {
+    const body = await fetchWithTimeout(fetchImpl, url, init, timeoutMs, label);
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new QuickstartError(`${label} returned invalid JSON.`);
+    }
+}
+async function fetchWithTimeout(fetchImpl, url, init, timeoutMs, label, expectedStatuses) {
+    const controller = new AbortController();
+    let response;
+    let reader;
+    let complete = false;
+    let timer;
+    // Race the entire fetch/read operation, not just response headers. This also
+    // bounds injected transports that fail to honor cancellation promptly.
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new QuickstartError(`${label} exceeded its request deadline.`));
+        }, timeoutMs);
+    });
+    const consume = async () => {
+        response = await fetchImpl(url, { ...init, signal: controller.signal });
+        if (controller.signal.aborted) {
+            void response.body?.cancel().catch(() => { });
+            throw new QuickstartError(`${label} exceeded its request deadline.`);
+        }
+        if (expectedStatuses ? !expectedStatuses.includes(response.status) : !response.ok) {
+            throw new QuickstartError(`${label} returned HTTP ${response.status}.`);
+        }
+        const declaredLength = response.headers.get("Content-Length");
+        if (declaredLength !== null && Number(declaredLength) > MAX_PROBE_RESPONSE_BYTES) {
+            throw new QuickstartError(`${label} exceeded the response byte limit.`);
+        }
+        if (!response.body)
+            return "";
+        reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let bytes = 0;
+        let body = "";
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > MAX_PROBE_RESPONSE_BYTES)
+                throw new QuickstartError(`${label} exceeded the response byte limit.`);
+            body += decoder.decode(chunk.value, { stream: true });
+        }
+        return body + decoder.decode();
+    };
+    try {
+        const body = await Promise.race([consume(), timeout]);
+        complete = true;
+        return body;
+    }
+    catch (error) {
+        if (error instanceof QuickstartError)
+            throw error;
+        throw new QuickstartError(`${label} failed. Check the connection and service diagnostics locally, then retry.`);
+    }
+    finally {
+        clearTimeout(timer);
+        if (!complete)
+            controller.abort();
+        if (reader) {
+            const ownedReader = reader;
+            if (!complete) {
+                // Do not await an untrusted stream's cancel hook past the deadline.
+                void ownedReader.cancel().catch(() => { });
+                try {
+                    ownedReader.releaseLock();
+                }
+                catch { /* cancellation settles any pending read */ }
+            }
+            else
+                ownedReader.releaseLock();
+        }
+        else if (!complete)
+            void response?.body?.cancel().catch(() => { });
+    }
+}
+async function runFleetCommand(inputs, executor, args, io, label) {
+    if (inputs.nodeHosts.length > 0) {
+        const commandArgs = sshArgs(inputs.nodeHosts[0], executable("celld"), args);
+        return runCommand(executor, executable("ssh"), commandArgs, inputs, io, label);
+    }
+    return runCommand(executor, executable("celld"), args, inputs, io, label);
+}
+async function runLocalCommand(executor, inputs, args, io, label) {
+    return runCommand(executor, executable("npm"), args, inputs, io, label);
+}
+async function runCommand(executor, file, args, inputs, io, label) {
+    describeCommand(file, args, io, "RUN");
+    let result;
+    try {
+        result = await executor.run(file, args, { cwd: inputs.repoRoot, timeoutMs: inputs.commandTimeoutMs });
+    }
+    catch (error) {
+        throw new QuickstartError(`${label} could not start. Check the executable and its local configuration, then retry.`);
+    }
+    if (result.exitCode !== 0) {
+        const output = `${result.stdout}\n${result.stderr}`;
+        // Map known diagnostic classes to fixed messages; child output can include
+        // credentials and must not be copied verbatim into shared logs.
+        const hint = /no node leases|needs a running fleet/i.test(output)
+            ? "Start a celld node for this dedicated fleet, verify the read-only diagnosis, then retry. D1 migrations require a running node."
+            : /esbuild.*(?:not found|not installed)|(?:not found|not installed).*esbuild/i.test(output)
+                ? "Install project dependencies and ensure the checkout's esbuild executable is available to celld."
+                : /AccessDenied|InvalidAccessKeyId|SignatureDoesNotMatch|NoCredentialProviders/i.test(output)
+                    ? "Check the celld fleet storage credentials and endpoint in the command environment; draft-storage variables are separate."
+                    : "Run the command displayed above directly to inspect its diagnostics locally, then retry the quickstart to resume.";
+        throw new QuickstartError(`${label} failed with exit code ${result.exitCode === null ? "unknown" : result.exitCode}. ${hint}`);
+    }
+    return result;
+}
+async function requireCommand(executor, command, timeoutMs, label) {
+    const probe = process.platform === "win32" ? "where.exe" : "which";
+    let result;
+    try {
+        result = await executor.run(probe, [command], { timeoutMs });
+    }
+    catch {
+        throw new QuickstartError(`Preflight could not find ${label}.`);
+    }
+    if (result.exitCode !== 0)
+        throw new QuickstartError(`Preflight could not find ${label}.`);
+}
+function describeFleetCommand(inputs, args, io, prefix) {
+    if (inputs.nodeHosts.length > 0) {
+        describeCommand(executable("ssh"), sshArgs(inputs.nodeHosts[0], executable("celld"), args), io, prefix);
+    }
+    else {
+        describeCommand(executable("celld"), args, io, prefix);
+    }
+}
+function describeCommand(file, args, io, prefix) {
+    io.log(`${prefix}: ${[file, ...args].map(displayArg).join(" ")}`);
+}
+function sshArgs(host, file, args) {
+    return ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", host, file, ...args];
+}
+function classifyFleet(output) {
+    const lower = output.toLowerCase();
+    if (/(^|[^a-z])(shared|multi[- ]application|multiple applications|existing workload)([^a-z]|$)/u.test(lower)) {
+        return "shared";
+    }
+    if (/(^|[^a-z])dedicated([^a-z]|$)/u.test(lower))
+        return "dedicated";
+    return "unknown";
+}
+function validateRepository(repoRoot) {
+    for (const relative of ["package.json", "package-lock.json", "worker/wrangler.jsonc", "worker/src/index.ts"]) {
+        if (!fs.existsSync(path.join(repoRoot, relative))) {
+            throw new QuickstartError(`Required repository file is missing: ${relative}.`);
+        }
+    }
+}
+function validateVars(vars, publicUrl, checkFile = true) {
+    if (checkFile)
+        validateProtectedFile(vars.path);
+    validateBootstrapBinding(vars, publicUrl);
+    const required = [
+        "DRAFTS_S3_ENDPOINT",
+        "DRAFTS_S3_REGION",
+        "DRAFTS_S3_BUCKET",
+        "DRAFTS_S3_ACCESS_KEY_ID",
+        "DRAFTS_S3_SECRET_ACCESS_KEY"
+    ];
+    for (const key of required) {
+        const value = vars.values[key];
+        if (!value || isPlaceholder(value))
+            throw new QuickstartError(`Protected variables file needs a real ${key} value.`);
+    }
+    const access = vars.values.OPENPLAN_DRAFT_ACCESS || "link";
+    if (!["link", "authenticated", "owner"].includes(access)) {
+        throw new QuickstartError("OPENPLAN_DRAFT_ACCESS must be link, authenticated, or owner (legacy fallback only).");
+    }
+    const anonymous = vars.values.OPENPLAN_ALLOW_ANONYMOUS_UPLOADS || "false";
+    if (anonymous !== "false")
+        throw new QuickstartError("The quickstart refuses anonymous uploads; set OPENPLAN_ALLOW_ANONYMOUS_UPLOADS=false.");
+    if (vars.values.PUBLIC_BASE_URL !== publicUrl)
+        throw new QuickstartError("PUBLIC_BASE_URL does not match --public-url.");
+    if (!readApiKey(vars))
+        throw new QuickstartError("Protected variables file needs BOOTSTRAP_API_KEY or OPENPLAN_BOOTSTRAP_API_KEY.");
+    for (const key of SECRET_KEYS) {
+        if (!vars.values[key] && key !== "BOOTSTRAP_API_KEY")
+            throw new QuickstartError(`Protected variables file needs ${key}.`);
+    }
+}
+function validateBootstrapBinding(vars, publicUrl) {
+    const primary = vars.values.BOOTSTRAP_API_KEY;
+    const alias = vars.values.OPENPLAN_BOOTSTRAP_API_KEY;
+    if (primary && alias && primary !== alias) {
+        throw new QuickstartError("Conflicting BOOTSTRAP_API_KEY and OPENPLAN_BOOTSTRAP_API_KEY aliases; explicitly configure one bootstrap credential.");
+    }
+    const origin = vars.values.OPENPLAN_BOOTSTRAP_API_KEY_ORIGIN;
+    if (!primary && !alias) {
+        if (origin !== undefined)
+            throw new QuickstartError("OPENPLAN_BOOTSTRAP_API_KEY_ORIGIN requires a bootstrap key; remove the orphan declaration before generating a new pair.");
+        return;
+    }
+    readApiKey(vars);
+    if (!origin)
+        throw new QuickstartError("An existing bootstrap key requires independent OPENPLAN_BOOTSTRAP_API_KEY_ORIGIN in the protected variables file; --yes and target selection do not authorize rebinding.");
+    if (normalizeApiUrl(origin, "OPENPLAN_BOOTSTRAP_API_KEY_ORIGIN") !== publicUrl) {
+        throw new QuickstartError("OPENPLAN_BOOTSTRAP_API_KEY_ORIGIN does not match the selected public origin; no mutation was performed.");
+    }
+}
+function readApiKey(vars) {
+    const value = vars.values.BOOTSTRAP_API_KEY || vars.values.OPENPLAN_BOOTSTRAP_API_KEY || "";
+    if (!value || isPlaceholder(value))
+        throw new QuickstartError("Protected variables file needs a real bootstrap API key.");
+    validateApiKey(value);
+    return value;
+}
+function readVars(file) {
+    if (!fs.existsSync(file))
+        throw new QuickstartError(`Protected variables file does not exist: ${file}`);
+    let content;
+    try {
+        content = fs.readFileSync(file, "utf8");
+    }
+    catch (error) {
+        throw new QuickstartError("Could not read the protected variables file. Check its ownership and permissions locally.");
+    }
+    const values = {};
+    for (const [index, sourceLine] of content.split(/\r?\n/u).entries()) {
+        const line = sourceLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const assignment = line.startsWith("export ") ? line.slice(7) : line;
+        const separator = assignment.indexOf("=");
+        if (separator <= 0)
+            throw new QuickstartError(`Invalid variables file line ${index + 1}; expected KEY=value.`);
+        const key = assignment.slice(0, separator).trim();
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key))
+            throw new QuickstartError(`Invalid variables file key on line ${index + 1}.`);
+        values[key] = unquoteEnvValue(assignment.slice(separator + 1).trim());
+    }
+    return { path: file, values };
+}
+function serializeVars(values) {
+    return Object.entries(values)
+        .map(([key, value]) => `${key}=${quoteEnvValue(value)}`)
+        .join("\n") + "\n";
+}
+function unquoteEnvValue(value) {
+    if (value.length >= 2 && ((value.startsWith("\"") && value.endsWith("\"")) || (value.startsWith("'") && value.endsWith("'")))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+function quoteEnvValue(value) {
+    return /^[A-Za-z0-9_./:@+,-]+$/u.test(value) ? value : JSON.stringify(value);
+}
+function validateProtectedFile(file) {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || (process.platform !== "win32" && stat.uid !== process.getuid?.()))
+        throw new QuickstartError(`Protected variables path is not a regular file: ${file}`);
+    if (process.platform !== "win32" && (stat.mode & 0o077) !== 0) {
+        throw new QuickstartError(`Protected variables file is readable by other users; chmod 600 ${file} and retry.`);
+    }
+}
+function persistCliDefault(homeDir, apiUrl) {
+    const directory = path.join(homeDir, ".openplan");
+    ensureDirectory(directory, 0o700);
+    const configPath = path.join(directory, "config.json");
+    let config = {};
+    if (fs.existsSync(configPath)) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(configPath, "utf8"));
+            if (!isRecord(parsed))
+                throw new Error("not an object");
+            config = parsed;
+        }
+        catch {
+            throw new QuickstartError(`Openplan config is not valid JSON: ${configPath}`);
+        }
+    }
+    writeText(configPath, `${JSON.stringify({ ...config, apiUrl }, null, 2)}\n`, 0o600);
+}
+function writeState(file, state) {
+    ensureDirectory(path.dirname(file), 0o700);
+    writeText(file, `${JSON.stringify(state, null, 2)}\n`, 0o600);
+}
+function readState(file) {
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (!isRecord(parsed) || (parsed.version !== 1 && parsed.version !== 2) || !isRecord(parsed.inputs) || !Array.isArray(parsed.completedStages)) {
+            throw new Error("invalid state shape");
+        }
+        if (parsed.completedStages.some(stage => !QUICKSTART_STAGES.includes(stage)))
+            throw new Error("invalid stage");
+        if (parsed.version === 1) {
+            // Legacy deploy combined publication and migration, with no version identity.
+            // Preserve credentials/build preparation; replay publication and activation
+            // on interrupted runs so we can establish the new ordering safely.
+            const complete = parsed.completedStages.includes("prove");
+            parsed.completedStages = complete ? [...QUICKSTART_STAGES] :
+                parsed.completedStages.filter(stage => stage === "preflight" || stage === "prepare");
+            parsed.version = 2;
+        }
+        return parsed;
+    }
+    catch {
+        throw new QuickstartError(`Quickstart state is not valid JSON: ${file}`);
+    }
+}
+function removeStateFile(file) {
+    if (fs.existsSync(file))
+        fs.rmSync(file, { force: true });
+}
+function stateInputs(inputs) {
+    return {
+        fleetBucket: inputs.fleetBucket,
+        publicUrl: inputs.publicUrl,
+        varsFile: inputs.varsFile,
+        fleetMode: inputs.fleetMode,
+        nodeHosts: [...inputs.nodeHosts],
+        remoteVarsFile: inputs.remoteVarsFile,
+        operatorUrls: [...inputs.operatorUrls],
+        restartProgram: inputs.restartProgram,
+        restartArgs: [...inputs.restartArgs]
+    };
+}
+function sameStateInputs(previous, inputs) {
+    return JSON.stringify({ ...previous, operatorUrls: undefined }) === JSON.stringify({ ...stateInputs(inputs), operatorUrls: undefined }) &&
+        JSON.stringify(previous.operatorUrls || []) === JSON.stringify(inputs.operatorUrls);
+}
+function defaultRestartProgram(remote) {
+    return process.platform === "linux" || remote ? (remote ? "systemctl" : executable("systemctl")) : null;
+}
+function defaultRestartArgs(program) {
+    return program && /(?:^|[\\/])systemctl(?:\.exe)?$/u.test(program) ? ["--user", "restart", "celld"] : [];
+}
+function validateFleetBucket(value) {
+    if (!/^(?:s3|gs|az):\/\/[^\s/]+(?:\/[^\s]*)?$/u.test(value)) {
+        throw new QuickstartError("Fleet bucket must use an explicit s3://, gs://, or az:// URI.");
+    }
+}
+function normalizeListenerUrl(value) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new QuickstartError("Public URL must be an absolute http:// or https:// URL.");
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        throw new QuickstartError("Public URL must use http:// or https://.");
+    if (parsed.username || parsed.password || parsed.search || parsed.hash)
+        throw new QuickstartError("Public URL must not contain credentials, a query, or a fragment.");
+    if (!parsed.hostname)
+        throw new QuickstartError("Public URL must contain a hostname.");
+    return parsed.origin + (parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/+$/u, ""));
+}
+function normalizeOperatorUrl(value) {
+    const url = normalizeListenerUrl(value);
+    if (new URL(url).pathname !== "/")
+        throw new QuickstartError("--operator-url must be the internal listener origin, without a path.");
+    return url;
+}
+function validateHost(host) {
+    if (!host || host.startsWith("-") || !/^[A-Za-z0-9._@:-]+$/u.test(host)) {
+        throw new QuickstartError("Remote node host contains unsupported characters.");
+    }
+}
+function validateRemotePath(value) {
+    if (!value || /[\s\0]/u.test(value) || (!value.startsWith("/") && !/^[A-Za-z]:[\\/]/u.test(value))) {
+        throw new QuickstartError("--remote-vars-file must be an absolute path without whitespace.");
+    }
+    return value;
+}
+function assertOutsideCheckout(file, repoRoot, label) {
+    const relative = path.relative(repoRoot, file);
+    if (relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative))) {
+        throw new QuickstartError(`The ${label} must be outside the repository checkout: ${file}`);
+    }
+}
+function ensureDirectory(directory, mode) {
+    fs.mkdirSync(directory, { recursive: true, mode });
+    if (process.platform !== "win32")
+        fs.chmodSync(directory, mode);
+}
+function writeText(file, content, mode) {
+    const temporary = `${file}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, content, { encoding: "utf8", mode });
+        if (process.platform !== "win32")
+            fs.chmodSync(temporary, mode);
+        fs.renameSync(temporary, file);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+    }
+}
+async function promptForValue(label, option, nonInteractive, _io) {
+    if (nonInteractive || !process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new QuickstartError(`Missing ${label}; provide ${option} in non-interactive mode.`);
+    }
+    const readline = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const value = (await readline.question(`${label}: `)).trim();
+        if (!value)
+            throw new QuickstartError(`Missing ${label}; provide ${option}.`);
+        return value;
+    }
+    finally {
+        readline.close();
+    }
+}
+function uniqueHosts(hosts) {
+    return [...new Set(hosts.map((host) => host.trim()).filter(Boolean))];
+}
+function positiveNumber(value, fallback) {
+    return value !== undefined && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+function executable(name) {
+    if (process.platform !== "win32")
+        return name;
+    if (name === "npm")
+        return "npm.cmd";
+    if (name === "celld" || name === "ssh" || name === "scp" || name === "systemctl")
+        return `${name}.exe`;
+    return name;
+}
+function appendOutput(current, chunk) {
+    if (current.length >= MAX_CAPTURED_OUTPUT)
+        return current;
+    return `${current}${chunk}`.slice(0, MAX_CAPTURED_OUTPUT);
+}
+function displayArg(value) {
+    return /^[A-Za-z0-9_./:@+=,-]+$/u.test(value) ? value : JSON.stringify(value);
+}
+function isPlaceholder(value) {
+    return /replace-with|example\.invalid|<[^>]+>|your[-_]/iu.test(value);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function routeUrl(base, route) {
+    const parsed = new URL(base);
+    const prefix = parsed.pathname === "/" ? "/" : `${parsed.pathname.replace(/\/+$/u, "")}/`;
+    parsed.pathname = `${prefix}${route.replace(/^\/+/, "")}`;
+    return parsed.toString();
+}
+function defaultIo() {
+    return {
+        log: (message) => console.log(message),
+        warn: (message) => console.warn(message),
+        confirm: async (message) => {
+            const readline = createInterface({ input: process.stdin, output: process.stdout });
+            try {
+                const answer = await readline.question(message);
+                return /^(?:y|yes)$/iu.test(answer.trim());
+            }
+            finally {
+                readline.close();
+            }
+        }
+    };
+}
+//# sourceMappingURL=celld-quickstart.js.map