@osva-ai/cli 1.1.1 → 1.1.2

package/dist/setup/materialize-install.js

@@ -0,0 +1,108 @@
+import { mkdir, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { CLI_VERSION } from "../version.js";
+import { writeFileAtomic } from "./atomic-write.js";
+import { buildInstallEnvValues, detectShellEnvConflicts, readInstallEnvFile, renderInstallEnvFile, } from "./env-file.js";
+import { assessInstallDirectory, INSTALLATION_MARKER_RELATIVE, renderInstallationMarker, } from "./installation-state.js";
+import { resolveSetupImageRef } from "./acceptance-install.js";
+import { deriveComposeProjectName } from "./compose-project.js";
+import { generateSecretHex } from "./secrets.js";
+export async function materializeInstallation(input) {
+    const installDir = input.options.installDir;
+    const assessment = await assessInstallDirectory(installDir);
+    if (assessment.kind === "foreign") {
+        throw new MaterializeInstallError("foreign_directory", `Installation directory contains unrelated files: ${assessment.foreignEntries.join(", ")}`);
+    }
+    if (assessment.foreignEntries.length > 0) {
+        throw new MaterializeInstallError("foreign_directory", `Installation directory contains unrelated files: ${assessment.foreignEntries.join(", ")}`);
+    }
+    await mkdir(installDir, { recursive: true });
+    await mkdir(path.join(installDir, ".osva"), { recursive: true });
+    const envPath = path.join(installDir, ".env");
+    const composePath = path.join(installDir, "compose.yml");
+    const markerPath = path.join(installDir, INSTALLATION_MARKER_RELATIVE);
+    const existingEnv = await readInstallEnvFile(envPath);
+    const preservedSecrets = existingEnv !== undefined;
+    const composeProjectName = deriveComposeProjectName(installDir);
+    const envValues = buildInstallEnvValues({
+        imageRef: resolveSetupImageRef({
+            distributionImageRef: input.distribution.manifest.imageRef,
+            processEnv: input.processEnv,
+        }),
+        composeProjectName,
+        webPort: input.options.webPort,
+        mcpPort: input.options.mcpPort,
+        consolePort: input.options.consolePort,
+        existing: existingEnv,
+        generateSecret: () => generateSecretHex(32),
+    });
+    const conflicts = detectShellEnvConflicts(envValues, input.processEnv);
+    if (conflicts.length > 0) {
+        const keys = conflicts.map((conflict) => conflict.key).join(", ");
+        throw new MaterializeInstallError("env_conflict", `Host environment variables override installation secrets and differ from ${path.basename(envPath)}: ${keys}. Unset them or align values before retrying.`);
+    }
+    const wroteCompose = await writeComposeIfNeeded(composePath, input.distribution.composeYaml, assessment, input.options.authorizeExisting);
+    const wroteEnv = await writeEnvIfNeeded(envPath, envValues, existingEnv);
+    const marker = renderInstallationMarker({
+        platformVersion: input.distribution.manifest.platformVersion,
+        imageRef: envValues.OSVA_IMAGE,
+        cliVersion: CLI_VERSION,
+        installDir,
+        composeProjectName: envValues.COMPOSE_PROJECT_NAME,
+        existing: assessment.marker,
+    });
+    await writeFileAtomic(markerPath, `${JSON.stringify(marker, null, 2)}\n`, {
+        restrictPermissions: true,
+    });
+    return {
+        assessment,
+        envValues,
+        envPath,
+        composePath,
+        markerPath,
+        preservedSecrets,
+        wroteCompose,
+        wroteEnv,
+    };
+}
+async function writeComposeIfNeeded(composePath, composeYaml, assessment, authorizeExisting) {
+    const exists = await pathExists(composePath);
+    if (exists && assessment.kind === "osva_installation" && !authorizeExisting) {
+        return false;
+    }
+    await writeFileAtomic(composePath, composeYaml);
+    return true;
+}
+async function writeEnvIfNeeded(envPath, values, existing) {
+    const rendered = renderInstallEnvFile(values);
+    if (existing !== undefined) {
+        try {
+            const current = await readFile(envPath, "utf8");
+            if (current === rendered) {
+                return false;
+            }
+        }
+        catch {
+            // write below
+        }
+    }
+    await writeFileAtomic(envPath, rendered, { restrictPermissions: true });
+    return true;
+}
+async function pathExists(targetPath) {
+    try {
+        await stat(targetPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export class MaterializeInstallError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+//# sourceMappingURL=materialize-install.js.map

package/dist/setup/materialize-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize-install.js","sourceRoot":"","sources":["../../src/setup/materialize-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,GAEzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAcjD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,oDAAoD,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,oDAAoD,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAEvE,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAG,WAAW,KAAK,SAAS,CAAC;IACnD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,qBAAqB,CAAC;QACtC,QAAQ,EAAE,oBAAoB,CAAC;YAC7B,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ;YAC1D,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QACF,kBAAkB;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;QAC9B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;KAC5C,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4EAA4E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,+CAA+C,CAC3J,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,WAAW,EACX,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B,UAAU,EACV,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAChC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe;QAC5D,QAAQ,EAAE,SAAS,CAAC,UAAU;QAC9B,UAAU,EAAE,WAAW;QACvB,UAAU;QACV,kBAAkB,EAAE,SAAS,CAAC,oBAAoB;QAClD,QAAQ,EAAE,UAAU,CAAC,MAAM;KAC5B,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACxE,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,SAAS;QACT,OAAO;QACP,WAAW;QACX,UAAU;QACV,gBAAgB;QAChB,YAAY;QACZ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,WAAmB,EACnB,WAAmB,EACnB,UAAsC,EACtC,iBAA0B;IAE1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,MAAM,IAAI,UAAU,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAe,EACf,MAAwB,EACxB,QAAyC;IAEzC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAuC;IAEpD,YAAY,IAA0C,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/setup/probe-spawn.d.ts

@@ -0,0 +1,16 @@
+export interface ProbeSpawnResult {
+    readonly status: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly error: NodeJS.ErrnoException | undefined;
+}
+export type ProbeSpawnFn = (executable: string, args: readonly string[], timeoutMs: number, processEnv?: NodeJS.ProcessEnv) => ProbeSpawnResult;
+/** Cap Docker probe output buffering (spawnSync default is 1 MiB). */
+export declare const PROBE_SPAWN_MAX_BUFFER_BYTES: number;
+export declare function defaultProbeSpawn(executable: string, args: readonly string[], timeoutMs: number, processEnv?: NodeJS.ProcessEnv): ProbeSpawnResult;
+/** Stream subprocess stdout/stderr with bounded chunk-safe secret redaction. */
+export declare function spawnStreamingCommand(executable: string, args: readonly string[], processEnv?: NodeJS.ProcessEnv): Promise<{
+    readonly exitCode: number | null;
+    readonly signal: NodeJS.Signals | null;
+}>;
+//# sourceMappingURL=probe-spawn.d.ts.map

package/dist/setup/probe-spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-spawn.d.ts","sourceRoot":"","sources":["../../src/setup/probe-spawn.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,MAAM,YAAY,GAAG,CACzB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,KAC3B,gBAAgB,CAAC;AAEtB,sEAAsE;AACtE,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAEvD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC1C,gBAAgB,CA0BlB;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC1C,OAAO,CAAC;IACT,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;CACxC,CAAC,CAyDD"}

package/dist/setup/probe-spawn.js

@@ -0,0 +1,87 @@
+import { spawn, spawnSync, } from "node:child_process";
+import { createStreamingSecretRedactor } from "../doctor/streaming-redact.js";
+/** Cap Docker probe output buffering (spawnSync default is 1 MiB). */
+export const PROBE_SPAWN_MAX_BUFFER_BYTES = 256 * 1024;
+export function defaultProbeSpawn(executable, args, timeoutMs, processEnv = process.env) {
+    let result;
+    try {
+        result = spawnSync(executable, [...args], {
+            encoding: "utf8",
+            stdio: "pipe",
+            shell: false,
+            timeout: timeoutMs,
+            maxBuffer: PROBE_SPAWN_MAX_BUFFER_BYTES,
+            env: processEnv,
+        });
+    }
+    catch (error) {
+        const errno = error;
+        return {
+            status: null,
+            stdout: "",
+            stderr: errno.message ?? String(error),
+            error: errno,
+        };
+    }
+    return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        error: result.error,
+    };
+}
+/** Stream subprocess stdout/stderr with bounded chunk-safe secret redaction. */
+export function spawnStreamingCommand(executable, args, processEnv = process.env) {
+    return new Promise((resolve, reject) => {
+        let child;
+        try {
+            child = spawn(executable, [...args], {
+                stdio: ["ignore", "pipe", "pipe"],
+                shell: false,
+                env: processEnv,
+            });
+        }
+        catch (error) {
+            reject(error);
+            return;
+        }
+        const stdoutRedactor = createStreamingSecretRedactor((text) => {
+            process.stdout.write(text);
+        });
+        const stderrRedactor = createStreamingSecretRedactor((text) => {
+            process.stderr.write(text);
+        });
+        child.stdout?.on("data", (chunk) => {
+            stdoutRedactor.write(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderrRedactor.write(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+        });
+        const onInterrupt = () => {
+            if (child.killed) {
+                return;
+            }
+            if (process.platform === "win32") {
+                child.kill();
+            }
+            else {
+                child.kill("SIGTERM");
+            }
+        };
+        process.on("SIGINT", onInterrupt);
+        process.on("SIGTERM", onInterrupt);
+        child.on("error", (error) => {
+            process.off("SIGINT", onInterrupt);
+            process.off("SIGTERM", onInterrupt);
+            reject(error);
+        });
+        child.on("close", (exitCode, signal) => {
+            stdoutRedactor.flush();
+            stderrRedactor.flush();
+            process.off("SIGINT", onInterrupt);
+            process.off("SIGTERM", onInterrupt);
+            resolve({ exitCode, signal });
+        });
+    });
+}
+//# sourceMappingURL=probe-spawn.js.map

package/dist/setup/probe-spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-spawn.js","sourceRoot":"","sources":["../../src/setup/probe-spawn.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,SAAS,GAGV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAgB9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,GAAG,IAAI,CAAC;AAEvD,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,IAAuB,EACvB,SAAiB,EACjB,aAAgC,OAAO,CAAC,GAAG;IAE3C,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,4BAA4B;YACvC,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,KAA8B,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;YACtC,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,IAAuB,EACvB,aAAgC,OAAO,CAAC,GAAG;IAK3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACnC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,KAAK,EAAE,KAAK;gBACZ,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,6BAA6B,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,6BAA6B,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAClD,cAAc,CAAC,KAAK,CAClB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAClD,cAAc,CAAC,KAAK,CAClB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAClC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAEnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACrC,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACpC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/setup/read-options.d.ts

@@ -0,0 +1,15 @@
+export interface SetupOptions {
+    readonly webPort: number;
+    readonly mcpPort: number;
+    readonly consolePort: number;
+    readonly installDir: string;
+    readonly preflightOnly: boolean;
+    readonly authorizeExisting: boolean;
+    readonly adminEmail: string;
+    readonly adminName: string;
+    readonly organizationName: string;
+    readonly workspaceName: string;
+}
+export declare function readSetupOptions(flags: Readonly<Record<string, string | boolean>>, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SetupOptions;
+export declare function parsePortNumber(raw: string, flagName: string): number;
+//# sourceMappingURL=read-options.d.ts.map

package/dist/setup/read-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-options.d.ts","sourceRoot":"","sources":["../../src/setup/read-options.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EACjD,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,YAAY,CAgEd;AAkCD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAarE"}

package/dist/setup/read-options.js

@@ -0,0 +1,69 @@
+import { resolveInstallDir } from "./install-path.js";
+export function readSetupOptions(flags, env = process.env, platform = process.platform) {
+    const webPort = parsePortFlag(flags["web-port"], env.OSVA_PUBLISH_WEB_PORT, 8080, "web-port");
+    const mcpPort = parsePortFlag(flags["mcp-port"], env.OSVA_PUBLISH_MCP_PORT, 3100, "mcp-port");
+    const consolePort = parsePortFlag(flags["console-port"], env.OSVA_PUBLISH_CONSOLE_PORT, 4174, "console-port");
+    const publishPorts = [
+        { port: webPort, label: "web" },
+        { port: mcpPort, label: "mcp" },
+        { port: consolePort, label: "console" },
+    ];
+    for (let left = 0; left < publishPorts.length; left += 1) {
+        for (let right = left + 1; right < publishPorts.length; right += 1) {
+            const a = publishPorts[left];
+            const b = publishPorts[right];
+            if (a !== undefined && b !== undefined && a.port === b.port) {
+                throw new Error(`Publish ports must be distinct (${a.label} and ${b.label} both use ${String(a.port)}).`);
+            }
+        }
+    }
+    const adminEmail = readOptionalStringFlag(flags["admin-email"], env.OSVA_SETUP_ADMIN_EMAIL);
+    const adminName = readOptionalStringFlag(flags["admin-name"], env.OSVA_SETUP_ADMIN_NAME) ??
+        "Initial Owner";
+    const organizationName = readOptionalStringFlag(flags["organization-name"], env.OSVA_SETUP_ORGANIZATION_NAME) ?? "Default Organization";
+    const workspaceName = readOptionalStringFlag(flags["workspace-name"], env.OSVA_BOOTSTRAP_WORKSPACE_NAME) ?? "Default Workspace";
+    return {
+        webPort,
+        mcpPort,
+        consolePort,
+        installDir: resolveInstallDir(flags, env, platform),
+        preflightOnly: flags["preflight-only"] === true,
+        authorizeExisting: flags.yes === true,
+        adminEmail: adminEmail ?? "",
+        adminName,
+        organizationName,
+        workspaceName,
+    };
+}
+function readOptionalStringFlag(flagValue, envValue) {
+    if (typeof flagValue === "string" && flagValue.trim().length > 0) {
+        return flagValue.trim();
+    }
+    const trimmedEnv = envValue?.trim();
+    return trimmedEnv === undefined || trimmedEnv.length === 0
+        ? undefined
+        : trimmedEnv;
+}
+function parsePortFlag(flagValue, envValue, fallback, flagName) {
+    if (typeof flagValue === "boolean") {
+        throw new Error(`--${flagName} requires a port number.`);
+    }
+    const raw = typeof flagValue === "string" && flagValue.trim().length > 0
+        ? flagValue.trim()
+        : envValue?.trim();
+    if (raw === undefined || raw.length === 0) {
+        return fallback;
+    }
+    return parsePortNumber(raw, flagName);
+}
+export function parsePortNumber(raw, flagName) {
+    if (!/^\d+$/.test(raw)) {
+        throw new Error(`Invalid --${flagName} or OSVA_PUBLISH_* value '${raw}'; use an integer from 1 to 65535.`);
+    }
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new Error(`Invalid --${flagName} or OSVA_PUBLISH_* value '${raw}'; use an integer from 1 to 65535.`);
+    }
+    return port;
+}
+//# sourceMappingURL=read-options.js.map

package/dist/setup/read-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-options.js","sourceRoot":"","sources":["../../src/setup/read-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAetD,MAAM,UAAU,gBAAgB,CAC9B,KAAiD,EACjD,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,OAAO,GAAG,aAAa,CAC3B,KAAK,CAAC,UAAU,CAAC,EACjB,GAAG,CAAC,qBAAqB,EACzB,IAAI,EACJ,UAAU,CACX,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAC3B,KAAK,CAAC,UAAU,CAAC,EACjB,GAAG,CAAC,qBAAqB,EACzB,IAAI,EACJ,UAAU,CACX,CAAC;IACF,MAAM,WAAW,GAAG,aAAa,CAC/B,KAAK,CAAC,cAAc,CAAC,EACrB,GAAG,CAAC,yBAAyB,EAC7B,IAAI,EACJ,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;QAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE;KACxC,CAAC;IACF,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACzD,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,mCAAmC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,aAAa,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CACzF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CACvC,KAAK,CAAC,aAAa,CAAC,EACpB,GAAG,CAAC,sBAAsB,CAC3B,CAAC;IACF,MAAM,SAAS,GACb,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,qBAAqB,CAAC;QACtE,eAAe,CAAC;IAClB,MAAM,gBAAgB,GACpB,sBAAsB,CACpB,KAAK,CAAC,mBAAmB,CAAC,EAC1B,GAAG,CAAC,4BAA4B,CACjC,IAAI,sBAAsB,CAAC;IAC9B,MAAM,aAAa,GACjB,sBAAsB,CACpB,KAAK,CAAC,gBAAgB,CAAC,EACvB,GAAG,CAAC,6BAA6B,CAClC,IAAI,mBAAmB,CAAC;IAC3B,OAAO;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,UAAU,EAAE,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;QACnD,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAC/C,iBAAiB,EAAE,KAAK,CAAC,GAAG,KAAK,IAAI;QACrC,UAAU,EAAE,UAAU,IAAI,EAAE;QAC5B,SAAS;QACT,gBAAgB;QAChB,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAAuC,EACvC,QAA4B;IAE5B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACxD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CACpB,SAAuC,EACvC,QAA4B,EAC5B,QAAgB,EAChB,QAAgB;IAEhB,IAAI,OAAO,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,KAAK,QAAQ,0BAA0B,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE;QAClB,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,QAAgB;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,6BAA6B,GAAG,oCAAoC,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,6BAA6B,GAAG,oCAAoC,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/setup/run-onboarding.d.ts

@@ -0,0 +1,22 @@
+import type { DoctorCheck } from "../doctor/types.js";
+import { type ComposeExecContext } from "./compose-exec.js";
+import { type AdministratorBootstrapPhase } from "./installation-status.js";
+import type { ProbeSpawnFn } from "./probe-spawn.js";
+import type { SetupOptions } from "./read-options.js";
+export declare const COMPOSE_ONBOARDING_TIMEOUT_MS = 300000;
+export interface OnboardingResult {
+    readonly checks: readonly DoctorCheck[];
+    readonly consoleUrl: string;
+    /** One-time password setup token for interactive display only (never persisted). */
+    readonly setupTokenForOperator?: string;
+    readonly administratorPhase: AdministratorBootstrapPhase | undefined;
+}
+export declare function runSetupOnboarding(input: {
+    readonly options: SetupOptions;
+    readonly execCtx: ComposeExecContext;
+    readonly spawn: ProbeSpawnFn | undefined;
+    readonly fetch: typeof fetch;
+    readonly mutateInstallation: boolean;
+    readonly processEnv?: NodeJS.ProcessEnv;
+}): Promise<OnboardingResult>;
+//# sourceMappingURL=run-onboarding.d.ts.map

package/dist/setup/run-onboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-onboarding.d.ts","sourceRoot":"","sources":["../../src/setup/run-onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,2BAA2B,EAEjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAKrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,eAAO,MAAM,6BAA6B,SAAU,CAAC;AAErD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,GAAG,SAAS,CAAC;CACtE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgQ5B"}

package/dist/setup/run-onboarding.js

@@ -0,0 +1,273 @@
+import { redactSecrets } from "../doctor/redact.js";
+import { parseIdentityBootstrapSetupToken, parseWorkspaceBootstrapOutput, redactBootstrapSubprocessOutput, } from "./bootstrap-capture.js";
+import { assertComposeSuccess, buildComposeSpawnEnv, ComposeExecError, runComposeCommand, } from "./compose-exec.js";
+import { classifyAdministratorBootstrapPhase, parseInstallationStatusJson, } from "./installation-status.js";
+import { writeAcceptanceBootstrapKeyFile, writeAcceptanceSetupTokenFile, } from "./acceptance-install.js";
+export const COMPOSE_ONBOARDING_TIMEOUT_MS = 300_000;
+export async function runSetupOnboarding(input) {
+    const processEnv = input.processEnv ?? process.env;
+    const checks = [];
+    const consoleUrl = `http://127.0.0.1:${String(input.options.consolePort)}`;
+    let setupTokenForOperator;
+    let administratorPhase;
+    if (!(await probeConsoleDistribution(input.execCtx, input.spawn))) {
+        checks.push(failCheck("console_distribution", "The pinned OSVA image does not include Console assets (apps/console).", "Re-run `osva setup --yes` after upgrading OSVA_IMAGE to a release that packages Console, or install a matching CLI bundle."));
+        checks.push(skipCheck("console_ready", "Skipped Console readiness because Console is unavailable in the OSVA image."));
+        checks.push(skipCheck("administrator_bootstrapped", "Skipped administrator bootstrap because Console distribution is unavailable."));
+        return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+    }
+    checks.push(passCheck("console_distribution", "Console server assets are present in the pinned OSVA image."));
+    if (input.mutateInstallation) {
+        startConsoleService(input.execCtx, input.spawn);
+    }
+    try {
+        await waitForConsoleReady(input.fetch, consoleUrl);
+        checks.push(passCheck("console_ready", `Console is ready at ${consoleUrl}.`));
+    }
+    catch (error) {
+        checks.push(failCheck("console_ready", redactSecrets(error instanceof Error
+            ? error.message
+            : "Console did not become ready."), "Inspect `docker compose --project-directory <install-dir> logs console` and retry `osva setup`."));
+        return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+    }
+    let status;
+    try {
+        status = await readInstallationStatus(input.execCtx, input.spawn);
+    }
+    catch (error) {
+        checks.push(failCheck("administrator_bootstrapped", redactSecrets(error instanceof Error
+            ? error.message
+            : "Could not read installation status."), "Ensure PostgreSQL is healthy, then retry `osva setup`."));
+        return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+    }
+    administratorPhase = classifyAdministratorBootstrapPhase(status);
+    if (!input.mutateInstallation) {
+        checks.push(...reportReadOnlyAdministratorState(administratorPhase, consoleUrl));
+        return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+    }
+    if (administratorPhase === "administrator_ready") {
+        checks.push(passCheck("administrator_bootstrapped", "A human administrator is already linked to this installation."));
+        checks.push(passCheck("administrator_setup_complete", "Initial administrator password setup appears complete."));
+        checks.push(passCheck("installation_complete", `Installation complete. Open ${consoleUrl}, sign in, and continue Console onboarding.`));
+        checks.push(skipCheck("first_agent_run_succeeded", "First agent execution is not verified by the installer; complete Agent Studio onboarding in the Console."));
+        return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+    }
+    if (administratorPhase === "administrator_pending_password_setup") {
+        checks.push(passCheck("administrator_bootstrapped", "Human administrator exists but password setup is still pending."));
+        checks.push(skipCheck("administrator_setup_complete", `Complete password setup at ${consoleUrl}/setup before signing in.`));
+        checks.push(skipCheck("installation_complete", "Installation is not complete until administrator password setup and sign-in succeed."));
+        return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+    }
+    if (administratorPhase === "multiple_unlinked_workspaces") {
+        checks.push(warnCheck("administrator_bootstrapped", "Multiple workspaces exist without linked human administrators.", "Run identity bootstrap manually with explicit --workspace-id values for each workspace, or consolidate workspaces before retrying `osva setup`."));
+        checks.push(skipCheck("installation_complete", "Installation is not complete until each workspace has a linked human administrator."));
+        return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+    }
+    if (status.apiKeyCount === 0) {
+        try {
+            await runWorkspaceBootstrapJob(input.execCtx, input.spawn, input.options, processEnv);
+            status = await readInstallationStatus(input.execCtx, input.spawn);
+            administratorPhase = classifyAdministratorBootstrapPhase(status);
+        }
+        catch (error) {
+            checks.push(failCheck("administrator_bootstrapped", redactSecrets(error instanceof Error
+                ? error.message
+                : "Workspace bootstrap failed."), "Inspect bootstrap job logs and retry `osva setup`."));
+            return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+        }
+    }
+    if (administratorPhase === "fresh_installation" ||
+        administratorPhase === "workspace_without_human_administrator" ||
+        administratorPhase === "ambiguous_workspace_state") {
+        if (input.options.adminEmail.trim().length === 0) {
+            checks.push(failCheck("administrator_bootstrapped", "Administrator email is required for initial human identity bootstrap.", "Re-run with --admin-email owner@example.com (and optional --admin-name / --organization-name)."));
+            checks.push(skipCheck("installation_complete", "Installation is not complete until administrator bootstrap succeeds."));
+            return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+        }
+        try {
+            const token = await runIdentityBootstrapJob(input.execCtx, input.spawn, input.options, status);
+            setupTokenForOperator = token;
+            if (token !== undefined) {
+                await writeAcceptanceSetupTokenFile({ processEnv, token });
+            }
+            checks.push(passCheck("administrator_bootstrapped", `Initial human administrator ${input.options.adminEmail} was linked to the workspace.`));
+            if (token !== undefined) {
+                checks.push(skipCheck("administrator_setup_complete", `Open ${consoleUrl}/setup and enter the one-time setup token printed below (not stored in installation files or JSON output).`));
+            }
+            checks.push(skipCheck("installation_complete", "Installation is not complete until password setup and sign-in succeed in the Console."));
+            checks.push(skipCheck("first_agent_run_succeeded", "First agent execution is not verified by the installer."));
+        }
+        catch (error) {
+            checks.push(failCheck("administrator_bootstrapped", redactSecrets(error instanceof Error
+                ? error.message
+                : "Human identity bootstrap failed."), "Resolve the reported issue and retry `osva setup` (existing organizations are not reset)."));
+        }
+    }
+    return { checks, consoleUrl, setupTokenForOperator, administratorPhase };
+}
+function reportReadOnlyAdministratorState(phase, consoleUrl) {
+    if (phase === "administrator_ready") {
+        return [
+            passCheck("administrator_bootstrapped", "Human administrator is configured."),
+            passCheck("administrator_setup_complete", "Initial administrator password setup appears complete."),
+            skipCheck("installation_complete", `Platform is operational. Open ${consoleUrl} to sign in (re-run with --yes to reconcile services).`),
+        ];
+    }
+    if (phase === "administrator_pending_password_setup") {
+        return [
+            passCheck("administrator_bootstrapped", "Human administrator exists; password setup is pending."),
+            skipCheck("administrator_setup_complete", `Complete setup at ${consoleUrl}/setup (re-run with --yes to reconcile services).`),
+        ];
+    }
+    return [
+        skipCheck("administrator_bootstrapped", "Human administrator bootstrap is incomplete. Re-run `osva setup --yes` with --admin-email to continue."),
+    ];
+}
+async function probeConsoleDistribution(ctx, spawn) {
+    const script = "try{require('fs').accessSync('/app/apps/console/dist/server/main.js');process.exit(0)}catch{process.exit(2)}";
+    const result = runComposeCommand(ctx, [
+        "run",
+        "--rm",
+        "--no-deps",
+        "-T",
+        "--entrypoint",
+        "node",
+        "web",
+        "-e",
+        script,
+    ], {
+        spawn,
+        timeoutMs: COMPOSE_ONBOARDING_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(ctx),
+    });
+    return result.status === 0;
+}
+function startConsoleService(ctx, spawn) {
+    const result = runComposeCommand(ctx, ["up", "-d", "--no-build", "--wait", "console"], {
+        spawn,
+        timeoutMs: COMPOSE_ONBOARDING_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(ctx),
+    });
+    assertComposeSuccess(result, "Starting Console");
+}
+async function waitForConsoleReady(fetchImpl, consoleUrl) {
+    let lastStatus;
+    for (let attempt = 0; attempt < 45; attempt += 1) {
+        try {
+            const response = await fetchImpl(`${consoleUrl}/`);
+            lastStatus = response.status;
+            if (response.ok) {
+                return;
+            }
+        }
+        catch {
+            // retry
+        }
+        await delay(2_000);
+    }
+    throw new ComposeExecError("command_failed", `Timed out waiting for Console at ${consoleUrl}${lastStatus === undefined ? "" : ` (last status ${String(lastStatus)})`}.`);
+}
+async function readInstallationStatus(ctx, spawn) {
+    const result = runComposeCommand(ctx, ["--profile", "bootstrap", "run", "--rm", "-T", "installation-status"], {
+        spawn,
+        timeoutMs: COMPOSE_ONBOARDING_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(ctx),
+    });
+    assertComposeSuccess(result, "Installation status probe");
+    return parseInstallationStatusJson(result.stdout);
+}
+async function runWorkspaceBootstrapJob(ctx, spawn, options, processEnv) {
+    const args = [
+        "--profile",
+        "bootstrap",
+        "run",
+        "--rm",
+        "-T",
+        "-e",
+        `OSVA_BOOTSTRAP_WORKSPACE_NAME=${options.workspaceName}`,
+        "bootstrap",
+    ];
+    const result = runComposeCommand(ctx, args, {
+        spawn,
+        timeoutMs: COMPOSE_ONBOARDING_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(ctx),
+    });
+    if (result.status !== 0) {
+        const detail = redactBootstrapSubprocessOutput(result.stderr || result.stdout);
+        throw new ComposeExecError("command_failed", detail.length > 0 ? detail : "Workspace bootstrap failed.");
+    }
+    const parsed = parseWorkspaceBootstrapOutput(result.stdout);
+    if (!parsed.alreadyCompleted && parsed.workspaceId === undefined) {
+        throw new ComposeExecError("command_failed", "Workspace bootstrap completed without a workspace id.");
+    }
+    if (parsed.apiKey !== undefined) {
+        await writeAcceptanceBootstrapKeyFile({
+            processEnv,
+            apiKey: parsed.apiKey,
+        });
+    }
+}
+async function runIdentityBootstrapJob(ctx, spawn, options, status) {
+    const identityArgs = [
+        "--profile",
+        "bootstrap",
+        "run",
+        "--rm",
+        "-T",
+        "identity-bootstrap",
+        "--",
+        "--email",
+        options.adminEmail,
+        "--name",
+        options.adminName,
+        "--organization-name",
+        options.organizationName,
+    ];
+    if (status.unlinkedWorkspaceIds.length === 1) {
+        identityArgs.push("--workspace-id", status.unlinkedWorkspaceIds[0]);
+    }
+    else if (status.unlinkedWorkspaceIds.length > 1) {
+        identityArgs.push("--all-unlinked-workspaces");
+    }
+    else if (status.workspaceCount === 1) {
+        const workspaceBootstrap = await readLatestWorkspaceId(ctx, spawn);
+        if (workspaceBootstrap !== undefined) {
+            identityArgs.push("--workspace-id", workspaceBootstrap);
+        }
+    }
+    const result = runComposeCommand(ctx, identityArgs, {
+        spawn,
+        timeoutMs: COMPOSE_ONBOARDING_TIMEOUT_MS,
+        processEnv: buildComposeSpawnEnv(ctx),
+    });
+    if (result.status !== 0) {
+        const detail = redactBootstrapSubprocessOutput(result.stderr || result.stdout);
+        throw new ComposeExecError("command_failed", detail.length > 0 ? detail : "Human identity bootstrap failed.");
+    }
+    return parseIdentityBootstrapSetupToken(result.stdout);
+}
+async function readLatestWorkspaceId(ctx, spawn) {
+    const status = await readInstallationStatus(ctx, spawn);
+    if (status.unlinkedWorkspaceIds.length === 1) {
+        return status.unlinkedWorkspaceIds[0];
+    }
+    return status.unlinkedWorkspaceIds[0];
+}
+function delay(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+function passCheck(id, message) {
+    return { id, status: "PASS", message };
+}
+function warnCheck(id, message, remediation) {
+    return { id, status: "WARN", message, remediation };
+}
+function failCheck(id, message, remediation) {
+    return { id, status: "FAIL", message, remediation };
+}
+function skipCheck(id, message) {
+    return { id, status: "SKIP", message };
+}
+//# sourceMappingURL=run-onboarding.js.map