@meistrari/tela-cli 0.6.0 → 0.7.4

package/src/config.ts

@@ -1,799 +0,0 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { isAbsolute, join } from 'node:path'
-import { listOrganizations, provisionForgejoUser } from './agent-api.ts'
-import type { FetchLike } from './auth.ts'
-import { createUserFacingError } from './errors.ts'
-import {
-    createGitSshKey,
-    ensureForgejoUserAccess,
-    inferSshPrivateKeyPath,
-    listDiscoveredSshPublicKeys,
-    loadSshPublicKey,
-    resolveSshPrivateKeyPath,
-    validateSshPrivateKeyPath,
-    validateSshPublicKeyPath,
-    type SelectedSshPublicKey,
-} from './forgejo.ts'
-import type {
-    TelaCliAuthState,
-    TelaCliConfig,
-    TelaCliForgejoOrganization,
-    TelaCliGitSshKey,
-    TelaEnvironment,
-} from './types.ts'
-
-const CONFIG_FILENAME = 'tela-cli.json'
-const DEFAULT_CLONE_ROOT_SEGMENTS = ['Code', 'Tela']
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-
-const PLACEHOLDER_APPLICATION_IDS = new Set([
-    '00000000-0000-4000-8000-000000000001',
-    '00000000-0000-4000-8000-000000000002',
-    '00000000-0000-4000-8000-000000000003',
-    '00000000-0000-4000-8000-000000000004',
-])
-
-export const DEFAULT_SETUP_AUTH_TIMEOUT_MS = 15 * 60 * 1000
-export const DEVICE_FLOW_BROWSER_HELP = 'Tela sign-in uses a browser-based device flow and continues polling until you approve the request.'
-const CUSTOM_SSH_KEY_OPTION = '__custom__'
-
-export interface SetupEnvironmentConfig {
-    environment: TelaEnvironment
-    agentApiUrl: string
-    authApiUrl: string
-    authDashboardUrl: string
-    telaApiUrl: string
-    requesterApplicationId: string
-    targetApplicationId: string
-}
-
-export const ENVIRONMENT_PRESETS: Record<Exclude<TelaEnvironment, 'custom'>, Omit<SetupEnvironmentConfig, 'environment'>> = {
-    production: {
-        agentApiUrl: 'https://agent-api-production-81c9.up.railway.app',
-        authApiUrl: 'https://auth.tela.com',
-        authDashboardUrl: 'https://accounts.tela.com',
-        telaApiUrl: 'https://api.tela.com',
-        requesterApplicationId: '860d5506-cab2-4b8b-b08b-fb4222b65bb2',
-        targetApplicationId: 'fe9fa028-4d34-407c-b27a-2ecc4779ae69',
-    },
-    staging: {
-        agentApiUrl: 'https://agent-api.telastaging.com',
-        authApiUrl: 'https://auth-api.telastaging.com',
-        authDashboardUrl: 'https://accounts.telastaging.com',
-        telaApiUrl: 'https://api.telastaging.com',
-        requesterApplicationId: 'c5cda347-835e-497c-bdeb-a464f5a1beb0',
-        targetApplicationId: '1c021ec1-b7d1-4d72-8733-ac69d930b2df',
-    },
-}
-
-export interface TextPromptOptions {
-    message: string
-    defaultValue?: string
-    placeholder?: string
-    validate?: (value: string) => string | undefined
-}
-
-export interface Option<T> {
-    value: T
-    label: string
-    hint?: string
-}
-
-export interface SelectOptions<T> {
-    message: string
-    options: Array<Option<T>>
-    initialValue?: T
-}
-
-export interface ConfigInspection {
-    path: string
-    exists: boolean
-    valid: boolean
-    config?: TelaCliConfig
-    error?: string
-}
-
-export interface PromptModule {
-    intro(message: string): void
-    outro(message: string): void
-    cancel(message: string): void
-    isCancel(value: unknown): boolean
-    note?(message: string, title?: string): void
-    select<T>(options: SelectOptions<T>): Promise<T | symbol>
-    text(options: TextPromptOptions): Promise<string | symbol>
-}
-
-export interface SetupConfigInput extends SetupEnvironmentConfig {
-    cloneRoot: string
-}
-
-export type SetupAuthenticateFn = (
-    input: SetupConfigInput,
-    notify: (message: string, title?: string) => void,
-) => Promise<TelaCliAuthState>
-
-export const ENVIRONMENT_PRESET_OPTIONS: Array<Option<TelaEnvironment>> = [
-    {
-        value: 'production',
-        label: 'Production',
-        hint: ENVIRONMENT_PRESETS.production.agentApiUrl,
-    },
-    {
-        value: 'staging',
-        label: 'Staging',
-        hint: ENVIRONMENT_PRESETS.staging.agentApiUrl,
-    },
-    {
-        value: 'custom',
-        label: 'Custom',
-        hint: 'Enter custom Tela service URLs and app IDs',
-    },
-]
-
-function promptValue<T>(value: T | symbol): T {
-    return value as T
-}
-
-function ensureNonEmpty(value: string, label: string): string {
-    const normalized = value.trim()
-    if (!normalized) {
-        throw new Error(`${label} is required`)
-    }
-
-    return normalized
-}
-
-function ensureEnvironment(value: string): TelaEnvironment {
-    if (value === 'production' || value === 'staging' || value === 'custom') {
-        return value
-    }
-
-    throw new Error('Environment must be production, staging, or custom')
-}
-
-function ensureAbsoluteUrl(value: string, label: string): string {
-    let url: URL
-    try {
-        url = new URL(value)
-    }
-    catch {
-        throw new Error(`${label} must be a valid URL`)
-    }
-
-    return url.toString().replace(/\/$/, '')
-}
-
-function ensureUuid(value: string, label: string): string {
-    const normalized = ensureNonEmpty(value, label)
-    if (!UUID_PATTERN.test(normalized)) {
-        throw new Error(`${label} must be a UUID`)
-    }
-
-    return normalized
-}
-
-function normalizeAuth(auth: TelaCliConfig['auth']): TelaCliConfig['auth'] {
-    if (!auth) {
-        return null
-    }
-
-    const user = auth.user ?? {} as TelaCliAuthState['user']
-    const workspace = auth.workspace ?? {} as TelaCliAuthState['workspace']
-    const session = auth.session ?? {} as TelaCliAuthState['session']
-
-    const expiresAt = Number(session.expiresAt)
-    if (!Number.isFinite(expiresAt) || expiresAt <= 0) {
-        throw new Error('Auth session expiration must be a valid timestamp')
-    }
-
-    return {
-        user: {
-            id: ensureNonEmpty(String(user.id ?? ''), 'Authenticated user ID'),
-            email: ensureNonEmpty(String(user.email ?? ''), 'Authenticated user email'),
-            name: ensureNonEmpty(String(user.name ?? user.email ?? ''), 'Authenticated user name'),
-        },
-        workspace: {
-            id: ensureNonEmpty(String(workspace.id ?? ''), 'Authenticated workspace ID'),
-            title: ensureNonEmpty(String(workspace.title ?? ''), 'Authenticated workspace title'),
-        },
-        session: {
-            accessToken: ensureNonEmpty(String(session.accessToken ?? ''), 'Auth access token'),
-            refreshToken: ensureNonEmpty(String(session.refreshToken ?? ''), 'Auth refresh token'),
-            expiresAt,
-        },
-    }
-}
-
-function normalizeForgejoOrganization(
-    organization: TelaCliConfig['forgejoOrganization'],
-): TelaCliForgejoOrganization | null {
-    if (!organization) {
-        return null
-    }
-
-    return {
-        id: ensureNonEmpty(String(organization.id ?? ''), 'Forgejo organization ID'),
-        name: ensureNonEmpty(String(organization.name ?? ''), 'Forgejo organization name'),
-    }
-}
-
-function normalizeGitSshKey(gitSshKey: TelaCliConfig['gitSshKey']): TelaCliGitSshKey | null {
-    if (!gitSshKey) {
-        return null
-    }
-
-    return {
-        title: ensureNonEmpty(String(gitSshKey.title ?? ''), 'Git SSH key title'),
-        publicKeyPath: expandHome(ensureNonEmpty(String(gitSshKey.publicKeyPath ?? ''), 'Git SSH public key path')),
-        privateKeyPath: expandHome(ensureNonEmpty(String(gitSshKey.privateKeyPath ?? ''), 'Git SSH private key path')),
-    }
-}
-
-function normalizeConfig(config: TelaCliConfig): TelaCliConfig {
-    const environment = ensureEnvironment(config.environment)
-    const auth = normalizeAuth(config.auth)
-
-    return {
-        environment,
-        agentApiUrl: ensureAbsoluteUrl(config.agentApiUrl, 'Agent API origin URL'),
-        authApiUrl: ensureAbsoluteUrl(config.authApiUrl, 'Auth API URL'),
-        authDashboardUrl: ensureAbsoluteUrl(config.authDashboardUrl, 'Auth dashboard URL'),
-        telaApiUrl: ensureAbsoluteUrl(config.telaApiUrl, 'Tela API URL'),
-        cloneRoot: resolveCloneRoot(config.cloneRoot),
-        requesterApplicationId: ensureUuid(config.requesterApplicationId, 'Requester application ID'),
-        targetApplicationId: ensureUuid(config.targetApplicationId, 'Target application ID'),
-        auth,
-        forgejoOrganization: auth ? normalizeForgejoOrganization(config.forgejoOrganization) : null,
-        forgejoUserRegistered: Boolean(config.forgejoUserRegistered),
-        gitSshKey: normalizeGitSshKey(config.gitSshKey),
-    }
-}
-
-function parseJsonConfig(input: string): TelaCliConfig {
-    const parsed = JSON.parse(input) as Partial<Record<keyof TelaCliConfig, unknown>> & {
-        auth?: Partial<Record<'user' | 'workspace' | 'session', unknown>> | null
-    }
-
-    const auth = parsed.auth == null
-        ? null
-        : {
-            user: parsed.auth.user as TelaCliAuthState['user'],
-            workspace: parsed.auth.workspace as TelaCliAuthState['workspace'],
-            session: parsed.auth.session as TelaCliAuthState['session'],
-        }
-
-    return normalizeConfig({
-        environment: String(parsed.environment ?? '') as TelaEnvironment,
-        agentApiUrl: String(parsed.agentApiUrl ?? ''),
-        authApiUrl: String(parsed.authApiUrl ?? ''),
-        authDashboardUrl: String(parsed.authDashboardUrl ?? ''),
-        telaApiUrl: String(parsed.telaApiUrl ?? ''),
-        cloneRoot: String(parsed.cloneRoot ?? ''),
-        requesterApplicationId: String(parsed.requesterApplicationId ?? ''),
-        targetApplicationId: String(parsed.targetApplicationId ?? ''),
-        auth,
-        forgejoOrganization: parsed.forgejoOrganization as TelaCliConfig['forgejoOrganization'] ?? null,
-        forgejoUserRegistered: Boolean(parsed.forgejoUserRegistered ?? false),
-        gitSshKey: parsed.gitSshKey as TelaCliConfig['gitSshKey'] ?? null,
-    })
-}
-
-function tryLoadConfig(): TelaCliConfig | null {
-    try {
-        return loadConfig()
-    }
-    catch {
-        return null
-    }
-}
-
-function cancelSetup(prompts: PromptModule): never {
-    prompts.cancel('Setup cancelled.')
-    throw new Error('Setup cancelled')
-}
-
-async function promptForSshPublicKey(prompts: PromptModule): Promise<SelectedSshPublicKey> {
-    const discoveredKeys = listDiscoveredSshPublicKeys()
-    if (discoveredKeys.length === 0) {
-        prompts.note?.('No SSH public keys were found under ~/.ssh. Enter a custom public key path to continue.', 'SSH key')
-    }
-
-    const selection = await prompts.select<string>({
-        message: 'SSH public key to send',
-        initialValue: discoveredKeys[0]?.path ?? CUSTOM_SSH_KEY_OPTION,
-        options: [
-            ...discoveredKeys.map(key => ({
-                value: key.path,
-                label: key.title,
-                hint: key.path,
-            })),
-            {
-                value: CUSTOM_SSH_KEY_OPTION,
-                label: 'Custom path…',
-                hint: 'Load another public key file',
-            },
-        ],
-    })
-    if (prompts.isCancel(selection)) {
-        cancelSetup(prompts)
-    }
-
-    const selectedValue = promptValue(selection)
-    if (selectedValue !== CUSTOM_SSH_KEY_OPTION) {
-        return discoveredKeys.find(key => key.path === selectedValue) ?? loadSshPublicKey(selectedValue)
-    }
-
-    const customPath = await prompts.text({
-        message: 'SSH public key path',
-        placeholder: '~/.ssh/id_ed25519.pub',
-        validate: validateSshPublicKeyPath,
-    })
-    if (prompts.isCancel(customPath)) {
-        cancelSetup(prompts)
-    }
-
-    return loadSshPublicKey(promptValue(customPath))
-}
-
-async function promptForSshPrivateKeyPath(
-    prompts: PromptModule,
-    sshKey: SelectedSshPublicKey,
-): Promise<string> {
-    const privateKeyPath = await prompts.text({
-        message: 'SSH private key path',
-        defaultValue: inferSshPrivateKeyPath(sshKey.path),
-        placeholder: sshKey.path.endsWith('.pub')
-            ? sshKey.path.slice(0, -4)
-            : '~/.ssh/id_ed25519',
-        validate: validateSshPrivateKeyPath,
-    })
-    if (prompts.isCancel(privateKeyPath)) {
-        cancelSetup(prompts)
-    }
-
-    return resolveSshPrivateKeyPath(promptValue(privateKeyPath))
-}
-
-function getHomeDir(): string {
-    return process.env.HOME || homedir()
-}
-
-function getTelaDir(): string {
-    return join(getHomeDir(), '.tela')
-}
-
-export function getConfigPath(): string {
-    return join(getTelaDir(), CONFIG_FILENAME)
-}
-
-export function expandHome(input: string): string {
-    if (input === '~') {
-        return getHomeDir()
-    }
-
-    if (input.startsWith('~/')) {
-        return join(getHomeDir(), input.slice(2))
-    }
-
-    return input
-}
-
-export function getDefaultCloneRoot(): string {
-    return join(getHomeDir(), ...DEFAULT_CLONE_ROOT_SEGMENTS)
-}
-
-export function resolveCloneRoot(value: string): string {
-    const expanded = expandHome(ensureNonEmpty(value, 'Clone root'))
-    return isAbsolute(expanded) ? expanded : join(process.cwd(), expanded)
-}
-
-export function validateCloneRoot(value: string): string | undefined {
-    try {
-        resolveCloneRoot(value)
-        return undefined
-    }
-    catch (error) {
-        return error instanceof Error ? error.message : 'Invalid directory'
-    }
-}
-
-export function validateAgentApiUrl(value: string): string | undefined {
-    try {
-        ensureAbsoluteUrl(value, 'Agent API origin URL')
-        return undefined
-    }
-    catch (error) {
-        return error instanceof Error ? error.message : 'Invalid URL'
-    }
-}
-
-export function validateAuthApiUrl(value: string): string | undefined {
-    try {
-        ensureAbsoluteUrl(value, 'Auth API URL')
-        return undefined
-    }
-    catch (error) {
-        return error instanceof Error ? error.message : 'Invalid URL'
-    }
-}
-
-export function validateAuthDashboardUrl(value: string): string | undefined {
-    try {
-        ensureAbsoluteUrl(value, 'Auth dashboard URL')
-        return undefined
-    }
-    catch (error) {
-        return error instanceof Error ? error.message : 'Invalid URL'
-    }
-}
-
-export function validateTelaApiUrl(value: string): string | undefined {
-    try {
-        ensureAbsoluteUrl(value, 'Tela API URL')
-        return undefined
-    }
-    catch (error) {
-        return error instanceof Error ? error.message : 'Invalid URL'
-    }
-}
-
-export function validateApplicationId(value: string, label = 'Application ID'): string | undefined {
-    try {
-        ensureUuid(value, label)
-        return undefined
-    }
-    catch (error) {
-        return error instanceof Error ? error.message : 'Invalid application ID'
-    }
-}
-
-export function redactSecret(secret: string): string {
-    const trimmed = secret.trim()
-    if (!trimmed) {
-        return '<missing>'
-    }
-
-    if (trimmed.length <= 8) {
-        return `${trimmed.slice(0, 2)}***${trimmed.slice(-2)}`
-    }
-
-    return `${trimmed.slice(0, 4)}***${trimmed.slice(-4)}`
-}
-
-export function resolveEnvironmentConfigForPreset(
-    environment: TelaEnvironment,
-    custom: Partial<Omit<SetupEnvironmentConfig, 'environment'>> = {},
-): SetupEnvironmentConfig {
-    if (environment === 'custom') {
-        return {
-            environment,
-            agentApiUrl: ensureAbsoluteUrl(String(custom.agentApiUrl ?? ''), 'Agent API origin URL'),
-            authApiUrl: ensureAbsoluteUrl(String(custom.authApiUrl ?? ''), 'Auth API URL'),
-            authDashboardUrl: ensureAbsoluteUrl(String(custom.authDashboardUrl ?? ''), 'Auth dashboard URL'),
-            telaApiUrl: ensureAbsoluteUrl(String(custom.telaApiUrl ?? ''), 'Tela API URL'),
-            requesterApplicationId: ensureUuid(String(custom.requesterApplicationId ?? ''), 'Requester application ID'),
-            targetApplicationId: ensureUuid(String(custom.targetApplicationId ?? ''), 'Target application ID'),
-        }
-    }
-
-    const preset = ENVIRONMENT_PRESETS[environment]
-    return {
-        environment,
-        ...preset,
-    }
-}
-
-export function isPlaceholderApplicationId(value: string): boolean {
-    return PLACEHOLDER_APPLICATION_IDS.has(value.trim())
-}
-
-export function hasSavedAuth(config: TelaCliConfig | null | undefined): boolean {
-    return Boolean(config?.auth?.session.accessToken && config.auth?.session.refreshToken)
-}
-
-export function loadConfig(): TelaCliConfig | null {
-    const configPath = getConfigPath()
-    if (!existsSync(configPath)) {
-        return null
-    }
-
-    return parseJsonConfig(readFileSync(configPath, 'utf-8'))
-}
-
-export function inspectSavedConfig(): ConfigInspection {
-    const path = getConfigPath()
-
-    if (!existsSync(path)) {
-        return {
-            path,
-            exists: false,
-            valid: false,
-        }
-    }
-
-    try {
-        const config = loadConfig()
-        return {
-            path,
-            exists: true,
-            valid: Boolean(config),
-            config: config ?? undefined,
-        }
-    }
-    catch (error) {
-        return {
-            path,
-            exists: true,
-            valid: false,
-            error: error instanceof Error ? error.message : String(error),
-        }
-    }
-}
-
-export function saveConfig(config: TelaCliConfig): void {
-    const telaDir = getTelaDir()
-    mkdirSync(telaDir, { recursive: true, mode: 0o700 })
-
-    const normalized = normalizeConfig(config)
-    const configPath = getConfigPath()
-    writeFileSync(configPath, `${JSON.stringify(normalized, null, 2)}\n`, { mode: 0o600 })
-    chmodSync(configPath, 0o600)
-}
-
-export function clearSavedAuth(config: TelaCliConfig): TelaCliConfig {
-    const cleared = normalizeConfig({
-        ...config,
-        auth: null,
-        forgejoOrganization: null,
-        forgejoUserRegistered: false,
-    })
-    saveConfig(cleared)
-    return cleared
-}
-
-function createMissingForgejoOrganizationsError(workspaceTitle: string): ReturnType<typeof createUserFacingError> {
-    return createUserFacingError({
-        code: 'workspace_organization_required',
-        summary: 'No Forgejo organizations are registered for this workspace.',
-        details: `Tela authenticated successfully for ${workspaceTitle}, but the workspace does not have any registered organizations yet.`,
-        fixes: [
-            'Ask the Tela team to register at least one organization for this workspace, then rerun `tela setup`.',
-        ],
-    })
-}
-
-export function getPreferredForgejoOrganization(
-    existingConfig: TelaCliConfig | null | undefined,
-    auth: TelaCliAuthState,
-    organizations: TelaCliForgejoOrganization[],
-): TelaCliForgejoOrganization | null {
-    if (!existingConfig?.forgejoOrganization) {
-        return null
-    }
-
-    if (existingConfig.auth?.workspace.id !== auth.workspace.id) {
-        return null
-    }
-
-    return organizations.find(organization => organization.id === existingConfig.forgejoOrganization?.id) ?? null
-}
-
-async function resolveForgejoOrganizationInteractive(options: {
-    prompts: PromptModule
-    existingConfig: TelaCliConfig | null
-    auth: TelaCliAuthState
-    config: TelaCliConfig
-    fetchFn?: FetchLike
-}): Promise<TelaCliForgejoOrganization> {
-    const organizations = await listOrganizations(options.config, options.fetchFn)
-    if (organizations.length === 0) {
-        throw createMissingForgejoOrganizationsError(options.auth.workspace.title)
-    }
-
-    const preferredOrganization = getPreferredForgejoOrganization(
-        options.existingConfig,
-        options.auth,
-        organizations,
-    )
-
-    if (organizations.length === 1) {
-        const organization = organizations[0]!
-        options.prompts.note?.(`Using workspace organization ${organization.name}.`, 'Organization')
-        return organization
-    }
-
-    const selection = await options.prompts.select<string>({
-        message: 'Forgejo organization',
-        initialValue: preferredOrganization?.id ?? organizations[0]?.id,
-        options: organizations.map(organization => ({
-            value: organization.id,
-            label: organization.name,
-            hint: organization.id === preferredOrganization?.id ? 'saved from previous setup' : undefined,
-        })),
-    })
-    if (options.prompts.isCancel(selection)) {
-        cancelSetup(options.prompts)
-    }
-
-    const selectedId = promptValue(selection)
-    const selectedOrganization = organizations.find(organization => organization.id === selectedId)
-    if (!selectedOrganization) {
-        throw new Error(`Unknown organization selection: ${selectedId}`)
-    }
-
-    options.prompts.note?.(`Selected workspace organization ${selectedOrganization.name}.`, 'Organization')
-    return selectedOrganization
-}
-
-export async function setupConfigInteractive(options: {
-    prompts?: PromptModule
-    existingConfig?: TelaCliConfig | null
-    skipLifecycle?: boolean
-    authenticate: SetupAuthenticateFn
-    fetchFn?: FetchLike
-    provisionForgejoUser?: typeof provisionForgejoUser
-}): Promise<TelaCliConfig> {
-    const prompts = options.prompts
-    if (!prompts) {
-        throw new Error('Interactive prompts are not available without a prompt implementation.')
-    }
-
-    const existingConfig = options.existingConfig ?? tryLoadConfig()
-    if (!options.skipLifecycle) {
-        prompts.intro('Tela CLI setup')
-    }
-
-    prompts.note?.(DEVICE_FLOW_BROWSER_HELP, 'Authentication')
-
-    const environmentResult = await prompts.select<TelaEnvironment>({
-        message: 'Tela environment',
-        initialValue: existingConfig?.environment ?? 'production',
-        options: ENVIRONMENT_PRESET_OPTIONS,
-    })
-    if (prompts.isCancel(environmentResult)) {
-        cancelSetup(prompts)
-    }
-
-    const environment = promptValue(environmentResult)
-    const customDefaults = environment === 'custom' && existingConfig?.environment === 'custom'
-        ? existingConfig
-        : null
-
-    const customValues: Partial<Omit<SetupEnvironmentConfig, 'environment'>> = {}
-    if (environment === 'custom') {
-        const promptsByField: Array<{
-            key: keyof Omit<SetupEnvironmentConfig, 'environment'>
-            message: string
-            placeholder: string
-            defaultValue?: string
-            validate: (value: string) => string | undefined
-        }> = [
-            {
-                key: 'agentApiUrl',
-                message: 'Custom Agent API origin URL',
-                placeholder: 'https://agent-api.example.com',
-                defaultValue: customDefaults?.agentApiUrl,
-                validate: validateAgentApiUrl,
-            },
-            {
-                key: 'authApiUrl',
-                message: 'Custom Auth API URL',
-                placeholder: 'https://auth.example.com',
-                defaultValue: customDefaults?.authApiUrl,
-                validate: validateAuthApiUrl,
-            },
-            {
-                key: 'authDashboardUrl',
-                message: 'Custom Auth dashboard URL',
-                placeholder: 'https://accounts.example.com',
-                defaultValue: customDefaults?.authDashboardUrl,
-                validate: validateAuthDashboardUrl,
-            },
-            {
-                key: 'telaApiUrl',
-                message: 'Custom Tela API URL',
-                placeholder: 'https://api.example.com',
-                defaultValue: customDefaults?.telaApiUrl,
-                validate: validateTelaApiUrl,
-            },
-            {
-                key: 'requesterApplicationId',
-                message: 'Requester application ID',
-                placeholder: '00000000-0000-0000-0000-000000000000',
-                defaultValue: customDefaults?.requesterApplicationId,
-                validate: value => validateApplicationId(value, 'Requester application ID'),
-            },
-            {
-                key: 'targetApplicationId',
-                message: 'Target application ID',
-                placeholder: '00000000-0000-0000-0000-000000000000',
-                defaultValue: customDefaults?.targetApplicationId,
-                validate: value => validateApplicationId(value, 'Target application ID'),
-            },
-        ]
-
-        for (const field of promptsByField) {
-            const response = await prompts.text({
-                message: field.message,
-                placeholder: field.placeholder,
-                defaultValue: field.defaultValue,
-                validate: field.validate,
-            })
-            if (prompts.isCancel(response)) {
-                cancelSetup(prompts)
-            }
-
-            customValues[field.key] = promptValue(response)
-        }
-    }
-
-    const cloneRootResult = await prompts.text({
-        message: 'Clone root directory',
-        defaultValue: existingConfig?.cloneRoot ?? getDefaultCloneRoot(),
-        validate: validateCloneRoot,
-    })
-    if (prompts.isCancel(cloneRootResult)) {
-        cancelSetup(prompts)
-    }
-
-    const sshKey = await promptForSshPublicKey(prompts)
-    const privateKeyPath = await promptForSshPrivateKeyPath(prompts, sshKey)
-
-    const resolvedSetup = {
-        ...resolveEnvironmentConfigForPreset(environment, customValues),
-        cloneRoot: resolveCloneRoot(promptValue(cloneRootResult)),
-    }
-
-    const auth = await options.authenticate(
-        resolvedSetup,
-        (message, title) => {
-            prompts.note?.(message, title)
-        },
-    )
-
-    const config = normalizeConfig({
-        ...resolvedSetup,
-        auth,
-        forgejoOrganization: null,
-        forgejoUserRegistered: false,
-        gitSshKey: createGitSshKey(sshKey, privateKeyPath),
-    })
-    const organization = await resolveForgejoOrganizationInteractive({
-        prompts,
-        existingConfig,
-        auth,
-        config,
-        fetchFn: options.fetchFn,
-    })
-    const provisioned = await ensureForgejoUserAccess({
-        config,
-        organization,
-        sshKey,
-        fetchFn: options.fetchFn,
-        onProgress: (message, title) => {
-            prompts.note?.(message, title)
-        },
-        provisionFn: options.provisionForgejoUser,
-        saveConfig,
-    })
-
-    if (!options.skipLifecycle) {
-        prompts.outro('Tela CLI configured')
-    }
-
-    return provisioned.config
-}
-
-export async function ensureConfigInteractive(): Promise<TelaCliConfig> {
-    const existing = tryLoadConfig()
-    if (existing?.auth) {
-        return existing
-    }
-
-    throw createUserFacingError({
-        code: 'config_required',
-        summary: 'Tela CLI is not authenticated.',
-        fixes: ['Run `tela setup` in an interactive terminal first.'],
-    })
-}