@prism-d1/cli 1.5.0 → 1.6.0

package/dist/src/aws/check.js

@@ -9,7 +9,7 @@
 import { aws } from '../utils/aws.js';
 import { severityRank } from '../utils/audit.js';
 import { auditAccount, ACCOUNT_AUDIT_IDS } from '../utils/audit-account.js';
-import { configuredSyncUrl } from '../commands/enable/codeburn.js';
+import { configuredSyncUrl } from '../utils/otel-sync-schedule.js';
 import { collectSecurityStatus, PIPELINE_STACK, } from '../security/setup.js';
 /** `<section>.<id>`: one id space across sections (a check appears in one section only). */
 export const checkId = (section, id) => `${section}.${id}`;

package/dist/src/aws/team.d.ts

@@ -0,0 +1,39 @@
+import { type SecurityOptions } from '../security/setup.js';
+export declare const TEAM_INFO_NOTICE = "Read-only (team info): one describe-stacks call and an identity check; nothing in AWS is changed.";
+export declare const ADD_DEVELOPER_NOTICE = "AWS write (team add-developer): creates one Cognito user after you confirm; nothing else in AWS is changed.";
+export declare const INFO_PERMISSIONS = "cloudformation:DescribeStacks";
+export declare const ADD_PERMISSIONS = "cloudformation:DescribeStacks (unless --user-pool-id) and cognito-idp:AdminCreateUser";
+/**
+ * shortcut: a practical shape check, not RFC 5322; Cognito does its own validation on create.
+ * ',' and '=' are rejected too: they are separators in AWS CLI shorthand (attributes are also passed as JSON).
+ * A leading '-' is rejected so the value can never be read as an AWS CLI option.
+ */
+export declare const EMAIL_RE: RegExp;
+export interface TeamOptions extends Pick<SecurityOptions, 'profile' | 'region' | 'profileSource' | 'connection'> {
+    json?: boolean;
+}
+export interface AddDeveloperOptions extends TeamOptions {
+    email?: string;
+    userPoolId?: string;
+    yes?: boolean;
+    dryRun?: boolean;
+}
+export interface TeamDeps {
+    env: NodeJS.ProcessEnv;
+    configRegion(profile?: string): string | null;
+    isTTY: boolean;
+    ask(q: string): Promise<string>;
+    log(line?: string): void;
+    err(line?: string): void;
+}
+export interface StackInfo {
+    account: string;
+    region: string;
+    stack: string;
+    otelCollectorUrl: string | null;
+    otelUserPoolId: string | null;
+}
+export declare const developerCommand: (url: string) => string;
+export declare function teamInfo(o: TeamOptions, d: TeamDeps): number;
+export declare function addDeveloper(o: AddDeveloperOptions, d: TeamDeps): Promise<number>;
+//# sourceMappingURL=team.d.ts.map

package/dist/src/aws/team.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../../src/aws/team.ts"],"names":[],"mappings":"AAeA,OAAO,EAAsE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAIhI,eAAO,MAAM,gBAAgB,sGAAsG,CAAC;AACpI,eAAO,MAAM,oBAAoB,gHAAgH,CAAC;AAClJ,eAAO,MAAM,gBAAgB,kCAAkC,CAAC;AAChE,eAAO,MAAM,eAAe,0FAA0F,CAAC;AAEvH;;;;GAIG;AACH,eAAO,MAAM,QAAQ,QAAgE,CAAC;AAItF,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,QAAQ,GAAG,eAAe,GAAG,YAAY,CAAC;IAC/G,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AACD,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAuC7I,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,KAAG,MAAkD,CAAC;AAElG,wBAAgB,QAAQ,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,GAAG,MAAM,CA2B5D;AAID,wBAAsB,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CvF"}

package/dist/src/aws/team.js

@@ -0,0 +1,172 @@
+/**
+ * `prism-cli team`: platform-team helpers for the PRISM metrics stack.
+ *
+ *   team info            READ-ONLY. describe-stacks on the metrics stack; prints
+ *                        OtelCollectorUrl and OtelUserPoolId.
+ *   team add-developer   AWS WRITE. One Cognito AdminCreateUser (username = the
+ *                        developer's email, as in README step 2), after the plan
+ *                        is shown and confirmed. Cognito emails the invite; the
+ *                        temporary password is never requested, printed, logged
+ *                        or stored here.
+ *
+ * Same AWS resolution as the other AWS commands (aws connect precedence,
+ * --profile / --region), through the AWS CLI with an argv array (no shell).
+ */
+import { aws } from '../utils/aws.js';
+import { NO_REGION_MESSAGE, credentialSource, resolveRegion, PIPELINE_STACK } from '../security/setup.js';
+import { accountChangeWarning } from './connection.js';
+import { SETUP_DOCS } from '../utils/sync-mode.js';
+export const TEAM_INFO_NOTICE = 'Read-only (team info): one describe-stacks call and an identity check; nothing in AWS is changed.';
+export const ADD_DEVELOPER_NOTICE = 'AWS write (team add-developer): creates one Cognito user after you confirm; nothing else in AWS is changed.';
+export const INFO_PERMISSIONS = 'cloudformation:DescribeStacks';
+export const ADD_PERMISSIONS = 'cloudformation:DescribeStacks (unless --user-pool-id) and cognito-idp:AdminCreateUser';
+/**
+ * shortcut: a practical shape check, not RFC 5322; Cognito does its own validation on create.
+ * ',' and '=' are rejected too: they are separators in AWS CLI shorthand (attributes are also passed as JSON).
+ * A leading '-' is rejected so the value can never be read as an AWS CLI option.
+ */
+export const EMAIL_RE = /^(?!-)[^\s@<>"'`;|&$\\,=]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/;
+const POOL_RE = /^[\w-]+_[0-9a-zA-Z]+$/;
+const ACCESS_DENIED = /AccessDenied|UnauthorizedOperation|NotAuthorized/;
+const lastLine = (r) => r.errorCode || r.raw.split('\n').map((l) => l.trim()).filter(Boolean).pop() || 'unknown error';
+/** Region, identity and the header lines. Returns null after printing the error. */
+function resolveTarget(o, d, say) {
+    const r = resolveRegion(o, d);
+    if (!r) {
+        say(`Error: ${NO_REGION_MESSAGE} Or save one with prism-cli aws connect.`);
+        return null;
+    }
+    const target = { profile: o.profile, env: { AWS_PAGER: '', AWS_REGION: r.region, AWS_DEFAULT_REGION: r.region } };
+    const who = aws(['sts', 'get-caller-identity'], target);
+    const account = who.ok ? String(who.json?.Account || '') : '';
+    if (!account) {
+        say(`Error: cannot resolve the AWS identity: ${lastLine(who)}. Sign in (e.g. aws sso login), pass --profile, or run prism-cli aws connect.`);
+        return null;
+    }
+    say(`Account:     ${account}`);
+    say(`Region:      ${r.region} (${r.source})`);
+    say(`Credentials: ${credentialSource(o, d.env)}`);
+    const w = accountChangeWarning(o.connection, account);
+    if (w)
+        say(w);
+    say('');
+    return { target, account, region: r.region };
+}
+/** The metrics stack's OTEL outputs, or an error line. */
+function readStack(t) {
+    const r = aws(['cloudformation', 'describe-stacks', '--stack-name', PIPELINE_STACK, '--region', t.region], t.target);
+    if (!r.ok) {
+        if (/does not exist/.test(r.raw))
+            return { error: `${PIPELINE_STACK} is not deployed in account ${t.account}, ${t.region}. Deploy it first (infra/: npx cdk deploy --all); see ${SETUP_DOCS.platformTeamGuide}` };
+        if (ACCESS_DENIED.test(r.errorCode || r.raw))
+            return { error: `access denied reading ${PIPELINE_STACK} (${lastLine(r)}). team info needs ${INFO_PERMISSIONS}.` };
+        return { error: `cannot read ${PIPELINE_STACK}: ${lastLine(r)}. team info needs ${INFO_PERMISSIONS}.` };
+    }
+    const outputs = r.json?.Stacks?.[0]?.Outputs || [];
+    const out = (k) => { const v = outputs.find((o) => o?.OutputKey === k)?.OutputValue; return typeof v === 'string' && v ? v : null; };
+    return { account: t.account, region: t.region, stack: PIPELINE_STACK, otelCollectorUrl: out('OtelCollectorUrl'), otelUserPoolId: out('OtelUserPoolId') };
+}
+export const developerCommand = (url) => `prism-cli enable codeburn --url ${url}`;
+export function teamInfo(o, d) {
+    const say = o.json ? d.err : d.log;
+    say(TEAM_INFO_NOTICE);
+    say('');
+    const t = resolveTarget(o, d, say);
+    if (!t)
+        return 1;
+    const s = readStack(t);
+    if ('error' in s) {
+        say(`Error: ${s.error}`);
+        return 1;
+    }
+    if (!s.otelCollectorUrl && !s.otelUserPoolId) {
+        say(`Error: ${PIPELINE_STACK} has no OtelCollectorUrl or OtelUserPoolId output, so the OTEL collector is not deployed. Redeploy without -c skipOtelCollector=true.`);
+        return 1;
+    }
+    const cmd = s.otelCollectorUrl ? developerCommand(s.otelCollectorUrl) : null;
+    if (o.json) {
+        d.log(JSON.stringify({ ...s, developer_command: cmd }, null, 2));
+        return 0;
+    }
+    d.log(`Stack:            ${s.stack}`);
+    d.log(`OtelCollectorUrl: ${s.otelCollectorUrl ?? '(no output)'}`);
+    d.log(`OtelUserPoolId:   ${s.otelUserPoolId ?? '(no output; developer accounts cannot be created in this stack)'}`);
+    d.log('');
+    if (cmd) {
+        d.log('Send each developer this line:');
+        d.log(`  ${cmd}`);
+    }
+    if (s.otelUserPoolId)
+        d.log('Add a developer: prism-cli team add-developer <email>');
+    return 0;
+}
+const yes = (a) => ['y', 'yes'].includes(a.trim().toLowerCase());
+export async function addDeveloper(o, d) {
+    const email = (o.email || '').trim();
+    if (!email || email.length > 254 || !EMAIL_RE.test(email)) {
+        d.err(`Error: "${email}" is not a valid email address. The username is the developer's email (README step 2).`);
+        return 1;
+    }
+    if (o.userPoolId !== undefined && !POOL_RE.test(o.userPoolId)) {
+        d.err(`Error: "${o.userPoolId}" is not a Cognito user pool id (like us-west-2_AbC123).`);
+        return 1;
+    }
+    d.log(ADD_DEVELOPER_NOTICE);
+    d.log(`Needs: ${ADD_PERMISSIONS}.`);
+    d.log('');
+    const t = resolveTarget(o, d, d.log);
+    if (!t)
+        return 1;
+    let pool = o.userPoolId;
+    if (!pool) {
+        const s = readStack(t);
+        if ('error' in s) {
+            d.err(`Error: ${s.error}`);
+            return 1;
+        }
+        if (!s.otelUserPoolId) {
+            d.err(`Error: ${PIPELINE_STACK} has no OtelUserPoolId output. Pass --user-pool-id, or redeploy with the OTEL collector.`);
+            return 1;
+        }
+        pool = s.otelUserPoolId;
+    }
+    d.log('Plan: create one Cognito user');
+    d.log(`  Account:   ${t.account}`);
+    d.log(`  Region:    ${t.region}`);
+    d.log(`  User pool: ${pool}`);
+    d.log(`  Username:  ${email} (email attribute too; Cognito emails the invite)`);
+    d.log('');
+    if (o.dryRun) {
+        d.log('Dry run: nothing was changed.');
+        return 0;
+    }
+    if (!o.yes) {
+        if (!d.isTTY) {
+            d.err('Error: no terminal to confirm. Re-run with --yes to create the user, or --dry-run to see the plan.');
+            return 1;
+        }
+        if (!yes(await d.ask('Create this user? [y/N] '))) {
+            d.err('Not created. Nothing was changed.');
+            return 1;
+        }
+    }
+    // No --temporary-password: Cognito generates one and emails it; it never passes through here.
+    const r = aws(['cognito-idp', 'admin-create-user', '--user-pool-id', pool, '--username', email,
+        '--user-attributes', JSON.stringify([{ Name: 'email', Value: email }]), '--desired-delivery-mediums', 'EMAIL', '--region', t.region], t.target);
+    if (r.ok) {
+        d.log(`✓ Created ${email} in ${pool}. Cognito emailed the invite with a temporary password.`);
+        return 0;
+    }
+    // Only the error code is shown: AWS error text can echo request values.
+    if (r.errorCode === 'UsernameExistsException') {
+        d.log(`✓ ${email} already exists in ${pool}; nothing changed.`);
+        return 0;
+    }
+    if (ACCESS_DENIED.test(r.errorCode || '')) {
+        d.err(`Error: access denied (${r.errorCode}). team add-developer needs ${ADD_PERMISSIONS}.`);
+        return 1;
+    }
+    d.err(`Error: AdminCreateUser failed (${r.errorCode || 'unknown error'}). Nothing was created.`);
+    return 1;
+}
+//# sourceMappingURL=team.js.map

package/dist/src/aws/team.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.js","sourceRoot":"","sources":["../../../src/aws/team.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,GAAG,EAAkC,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AAChI,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mGAAmG,CAAC;AACpI,MAAM,CAAC,MAAM,oBAAoB,GAAG,6GAA6G,CAAC;AAClJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAChE,MAAM,CAAC,MAAM,eAAe,GAAG,uFAAuF,CAAC;AAEvH;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,6DAA6D,CAAC;AACtF,MAAM,OAAO,GAAG,uBAAuB,CAAC;AACxC,MAAM,aAAa,GAAG,kDAAkD,CAAC;AAuBzE,MAAM,QAAQ,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC;AAIlI,oFAAoF;AACpF,SAAS,aAAa,CAAC,CAAc,EAAE,CAAW,EAAE,GAAyB;IAC3E,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,UAAU,iBAAiB,0CAA0C,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACpG,MAAM,MAAM,GAAc,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC7H,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,2CAA2C,QAAQ,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC7I,OAAO,IAAI,CAAC;IACd,CAAC;IACD,GAAG,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,GAAG,CAAC,gBAAgB,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACd,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,cAAc,+BAA+B,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,yDAAyD,UAAU,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAClN,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,yBAAyB,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,gBAAgB,GAAG,EAAE,CAAC;QACjK,OAAO,EAAE,KAAK,EAAE,eAAe,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,gBAAgB,GAAG,EAAE,CAAC;IAC1G,CAAC;IACD,MAAM,OAAO,GAAoD,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IACpG,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7I,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAC3J,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,mCAAmC,GAAG,EAAE,CAAC;AAElG,MAAM,UAAU,QAAQ,CAAC,CAAc,EAAE,CAAW;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtB,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAAC,GAAG,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACzD,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,cAAc,uIAAuI,CAAC,CAAC;QACrK,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,gBAAgB,IAAI,aAAa,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,cAAc,IAAI,iEAAiE,EAAE,CAAC,CAAC;IACpH,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,GAAG,EAAE,CAAC;QACR,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACxC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,CAAC,cAAc;QAAE,CAAC,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAsB,EAAE,CAAW;IACpE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,wFAAwF,CAAC,CAAC;QAChH,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,UAAU,0DAA0D,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC5B,CAAC,CAAC,GAAG,CAAC,UAAU,eAAe,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,UAAU,cAAc,0FAA0F,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC/J,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC;IAC1B,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACvC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,GAAG,CAAC,gBAAgB,KAAK,mDAAmD,CAAC,CAAC;IAChF,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACnE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,oGAAoG,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACxI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;IAC9G,CAAC;IACD,8FAA8F;IAC9F,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;QAC5F,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,4BAA4B,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAClJ,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QACT,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,OAAO,IAAI,yDAAyD,CAAC,CAAC;QAC9F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,wEAAwE;IACxE,IAAI,CAAC,CAAC,SAAS,KAAK,yBAAyB,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,sBAAsB,IAAI,oBAAoB,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAC7H,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,SAAS,+BAA+B,eAAe,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACtJ,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,SAAS,IAAI,eAAe,yBAAyB,CAAC,CAAC;IACjG,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/src/commands/enable/codeburn.d.ts

@@ -1,4 +1,5 @@
 import { run, type RunResult } from '../../utils/exec.js';
+import { configuredSyncUrl } from '../../utils/otel-sync-schedule.js';
 /** Exact install command, printed before it runs and in every hint. */
 export declare const INSTALL_CMD: string;
 export declare function getCodeburnPath(): string | null;
@@ -35,8 +36,7 @@ export interface CodeburnDeps {
 export declare function defaultDeps(): CodeburnDeps;
 export declare const SCHEDULE_KINDS: readonly ["systemd", "cron"];
 export declare const SYSTEMD_CMD = "prism-cli enable codeburn --schedule systemd";
-/** The sync endpoint codeburn has stored, or null when sync is not set up. '' when the file is unreadable. */
-export declare function configuredSyncUrl(home: string): string | null;
+export { configuredSyncUrl };
 /** True when `version` (e.g. "0.9.24") is at least MIN_CODEBURN. */
 export declare function codeburnVersionOk(version: string): boolean;
 export interface CodeburnOptions {
@@ -48,6 +48,10 @@ export interface CodeburnOptions {
     dryRun?: boolean;
     /** Linux: systemd or cron. */
     schedule?: string;
+    /** Sync mode local: usage stays on this machine. */
+    local?: boolean;
+    /** Sync mode admin: print the platform-team steps; no AWS calls. */
+    admin?: boolean;
 }
 /**
  * The setup flow. Returns the exit code; every change is skipped on --dry-run,

package/dist/src/commands/enable/codeburn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codeburn.d.ts","sourceRoot":"","sources":["../../../../src/commands/enable/codeburn.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,GAAG,EAAkB,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgB1E,uEAAuE;AACvE,eAAO,MAAM,WAAW,QAA2C,CAAC;AAUpE,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAK/C;AAuDD,8GAA8G;AAC9G,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA6B7H;AAED,wGAAwG;AACxG,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,SAAY,EAAE,KAAK,GAAE,OAAO,GAAS,GAAG,IAAI,CASnI;AAED,wBAAgB,qBAAqB,CAAC,IAAI,SAAY,EAAE,KAAK,GAAE,OAAO,GAAS,GAAG,IAAI,CAKrF;AA8ID,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,SAAS,CAAC;IACjD,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC1D,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1E,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,oFAAoF;IACpF,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,OAAO,CAAC;QACzB,MAAM,EAAE,MAAM,OAAO,CAAC;QACtB,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/D,MAAM,EAAE,MAAM,IAAI,CAAC;KACpB,CAAC;CACH;AAED,wBAAgB,WAAW,IAAI,YAAY,CA2B1C;AAmBD,eAAO,MAAM,cAAc,8BAA+B,CAAC;AAC3D,eAAO,MAAM,WAAW,iDAA8C,CAAC;AAiEvE,8GAA8G;AAC9G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS7D;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAgFD,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA6CD;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAwK5F;AAED,eAAO,MAAM,gBAAgB;;;GAQ5B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,YAAY,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvG;;;;;;;;;AAED,wBAIE"}
+{"version":3,"file":"codeburn.d.ts","sourceRoot":"","sources":["../../../../src/commands/enable/codeburn.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,GAAG,EAAkB,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAKmD,iBAAiB,EAC1E,MAAM,mCAAmC,CAAC;AAW3C,uEAAuE;AACvE,eAAO,MAAM,WAAW,QAA2C,CAAC;AAUpE,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAK/C;AAuDD,8GAA8G;AAC9G,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA6B7H;AAED,wGAAwG;AACxG,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,SAAY,EAAE,KAAK,GAAE,OAAO,GAAS,GAAG,IAAI,CASnI;AAED,wBAAgB,qBAAqB,CAAC,IAAI,SAAY,EAAE,KAAK,GAAE,OAAO,GAAS,GAAG,IAAI,CAKrF;AA8ID,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,SAAS,CAAC;IACjD,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC1D,YAAY,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1E,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,oFAAoF;IACpF,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,OAAO,CAAC;QACzB,MAAM,EAAE,MAAM,OAAO,CAAC;QACtB,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/D,MAAM,EAAE,MAAM,IAAI,CAAC;KACpB,CAAC;CACH;AAED,wBAAgB,WAAW,IAAI,YAAY,CA2B1C;AAmBD,eAAO,MAAM,cAAc,8BAA+B,CAAC;AAC3D,eAAO,MAAM,WAAW,iDAA8C,CAAC;AAkEvE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAkFD,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oEAAoE;IACpE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAsID;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuL5F;AAED,eAAO,MAAM,gBAAgB;;;GAU5B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,YAAY,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,8FAA8F;AAC9F,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvG;;;;;;;;;AAED,wBAIE"}

package/dist/src/commands/enable/codeburn.js

@@ -13,8 +13,9 @@ import { existsSync, mkdirSync, writeFileSync, readFileSync, unlinkSync } from '
 import { join } from 'node:path';
 import { run, runInteractive } from '../../utils/exec.js';
 import { withPrivateTemp } from '../../utils/tempfile.js';
-import { CRON_MARKER, PLIST_LABEL, SCHTASK_NAME, otelLogDir, otelLogFile, codeburnSyncConfigPath, linuxCrontabAvailable, crontabLines, darwinPlistPath, scheduleExists, schedulerName, CODEBURN_INSTALL_ARGS, ENABLE_CODEBURN_CMD, SYNC_SINCE, syncArgs, linuxCronScheduleExists, SYSTEMD_SCHEDULER_NAME, SYSTEMD_UNIT, systemdServicePath, systemdTimerExists, systemdTimerPath, systemdUserAvailable, systemdUserDir, } from '../../utils/otel-sync-schedule.js';
+import { CRON_MARKER, PLIST_LABEL, SCHTASK_NAME, otelLogDir, otelLogFile, codeburnSyncConfigPath, linuxCrontabAvailable, crontabLines, darwinPlistPath, scheduleExists, schedulerName, CODEBURN_INSTALL_ARGS, ENABLE_CODEBURN_CMD, SYNC_SINCE, syncArgs, linuxCronScheduleExists, SYSTEMD_SCHEDULER_NAME, SYSTEMD_UNIT, systemdServicePath, systemdTimerExists, systemdTimerPath, systemdUserAvailable, systemdUserDir, configuredSyncUrl, } from '../../utils/otel-sync-schedule.js';
 import { runGuarded } from './security.js';
+import { effectiveMode, LOCAL_MODE_HELP, MODE_SOURCE_TEXT, PLATFORM_TEAM_HELP, SETUP_DOCS, SYNC_MODE_PATH, TEAM_URL_CMD, writeSyncMode, } from '../../utils/sync-mode.js';
 // ---- Constants ----
 // Marker, label and task name are shared with the dashboard's setup check.
 const LOG_DIR = otelLogDir();
@@ -382,19 +383,8 @@ function removeSchedules(opts, d) {
     d.log('');
     return 0;
 }
-/** The sync endpoint codeburn has stored, or null when sync is not set up. '' when the file is unreadable. */
-export function configuredSyncUrl(home) {
-    const configPath = codeburnSyncConfigPath(home);
-    if (!existsSync(configPath))
-        return null;
-    try {
-        const cfg = JSON.parse(readFileSync(configPath, 'utf8'));
-        return String(cfg.baseUrl || cfg.endpoint || cfg.url || '');
-    }
-    catch {
-        return '';
-    }
-}
+// Lives in utils/otel-sync-schedule.ts (shared with the dashboard and aws check); re-exported for existing importers.
+export { configuredSyncUrl };
 /** True when `version` (e.g. "0.9.24") is at least MIN_CODEBURN. */
 export function codeburnVersionOk(version) {
     const parts = version.split('.').map((n) => parseInt(n, 10) || 0);
@@ -446,8 +436,10 @@ function showStatus(d) {
         d.log(`  ✗ codeburn not found in PATH (run ${ENABLE_CODEBURN_CMD})`);
     }
     const url = configuredSyncUrl(d.home);
+    const m = effectiveMode(d.home, url);
+    d.log(`  Sync mode: ${m.mode} (${MODE_SOURCE_TEXT[m.source]})`);
     if (url === null)
-        d.log(`  ✗ sync not configured (run ${ENABLE_CODEBURN_CMD})`);
+        d.log(m.mode === 'team' ? `  ✗ sync not configured (run ${TEAM_URL_CMD})` : '  - no sync endpoint (usage stays on this machine)');
     else if (url)
         d.log(`  ✓ sync configured: ${url}`);
     else
@@ -484,6 +476,100 @@ function showStatus(d) {
         reportSyncStatus(codeburnPath, d);
     d.log('');
 }
+const MODE_CHOICES = [
+    ['1', 'local', 'just me, keep it on this machine'],
+    ['2', 'team', "my team's PRISM (I have the collector URL from my platform team)"],
+    ['3', 'admin', "I'm the platform team setting up PRISM"],
+];
+/**
+ * The sync mode for this run: a flag, else the mode already in effect (saved,
+ * or team for a machine with a sync endpoint), else the question on a TTY,
+ * else local. Returns an exit code on a bad answer.
+ */
+async function chooseMode(opts, d, dry) {
+    if (opts.local)
+        return 'local';
+    if (opts.admin)
+        return 'admin';
+    if (opts.url)
+        return 'team';
+    const cur = effectiveMode(d.home);
+    if (cur.source !== 'default') {
+        d.log(`  Sync mode: ${cur.mode} (${MODE_SOURCE_TEXT[cur.source]}; --local, --url or --admin changes it)`);
+        return cur.mode;
+    }
+    if (!d.isTTY) {
+        d.log('  No terminal and no --local, --url or --admin: local only.');
+        return 'local';
+    }
+    if (dry) {
+        d.log('  → would ask where your usage should go; this plan is for local only (--url or --admin plans the others)');
+        return 'local';
+    }
+    d.log('  Where should your usage go?');
+    for (const [n, , text] of MODE_CHOICES)
+        d.log(`    ${n}) ${text}`);
+    const answer = (await d.ask('  Choose 1, 2 or 3 [1]: ')).trim() || '1';
+    const picked = MODE_CHOICES.find(([n]) => n === answer);
+    if (!picked) {
+        d.error(`Error: "${answer}" is not 1, 2 or 3. Or pass --local, --url <collector URL> or --admin.`);
+        return 1;
+    }
+    return picked[1];
+}
+function saveMode(mode, d, dry) {
+    if (dry) {
+        d.log(`  → would save sync mode ${mode} in ${SYNC_MODE_PATH}`);
+        return;
+    }
+    writeSyncMode(d.home, mode);
+    d.log(`  ✓ Sync mode ${mode} saved in ${SYNC_MODE_PATH}`);
+}
+/** Every installed sync schedule's name; an unreadable crontab is skipped (it cannot be told). */
+function installedSchedules(d) {
+    const all = d.linux ? [nativeSchedule(d), systemdSchedule(d)] : [nativeSchedule(d)];
+    return all.filter((s) => probeSchedule(s) === true).map((s) => s.name);
+}
+/** Local only: codeburn keeps working here; no endpoint is set up and no schedule installed. */
+async function localOnly(opts, d, dry) {
+    // Removal first: taking the schedule off never needs codeburn installed.
+    if (opts.remove) {
+        const code = removeSchedules(opts, d);
+        if (code)
+            return code;
+    }
+    const ensured = await ensureCodeburn(opts, d);
+    if (typeof ensured === 'number')
+        return ensured;
+    saveMode('local', d, dry);
+    const url = configuredSyncUrl(d.home);
+    const left = dry && opts.remove ? [] : installedSchedules(d);
+    d.log('');
+    if (left.length) {
+        d.log(`  ⚠ Sync mode is local, but the ${left.join(' and ')} schedule is still installed and still pushes usage.`);
+        d.log(`    Remove it: ${ENABLE_CODEBURN_CMD} --local --remove`);
+    }
+    else {
+        d.log('  ✅ Local only: codeburn usage stays on this machine. No sync endpoint is set up and no schedule is installed.');
+    }
+    if (url !== null)
+        d.log(`  Left in place: codeburn's sync config${url ? ` for ${url}` : ''} (${codeburnSyncConfigPath(d.home)}). Nothing pushes to it without a schedule.`);
+    d.log(`\n  ${LOCAL_MODE_HELP.text}`);
+    d.log(`  Setup instructions: ${SETUP_DOCS.telemetryAccount}\n`);
+    return 0;
+}
+/** Admin: the platform-team steps and helper commands. No AWS call is made. */
+function platformTeam(d, dry) {
+    d.log('  Platform team setup (this prints steps only; no AWS calls are made):\n');
+    PLATFORM_TEAM_HELP.steps.forEach((step, i) => d.log(`    ${i + 1}. ${step}`));
+    d.log('\n  Helper commands:');
+    d.log('    prism-cli team info                      read-only: prints OtelCollectorUrl and OtelUserPoolId');
+    d.log('    prism-cli team add-developer <email>     creates the developer\'s telemetry account (asks first; --dry-run shows the plan)');
+    d.log(`\n  Platform team guide: ${SETUP_DOCS.platformTeamGuide}\n`);
+    saveMode('admin', d, dry);
+    d.log(`  To sync your own usage as well, run ${TEAM_URL_CMD}.\n`);
+    return 0;
+}
 /**
  * Step 1: codeburn on PATH, installing it after a confirmation when missing.
  * Returns its path, `null` on a dry run without it, or an exit code on refusal.
@@ -540,7 +626,12 @@ export async function enableCodeburn(opts, d) {
         showStatus(d);
         return 0;
     }
-    if (opts.remove)
+    const modes = [opts.local && '--local', opts.url && '--url', opts.admin && '--admin'].filter(Boolean);
+    if (modes.length > 1) {
+        d.error(`Error: ${modes.join(' and ')} choose different sync modes; pass one of them.`);
+        return 1;
+    }
+    if (opts.remove && !opts.local)
         return removeSchedules(opts, d);
     const dry = !!opts.dryRun;
     const intervalHours = opts.interval ? parseInt(opts.interval, 10) : 12;
@@ -549,6 +640,13 @@ export async function enableCodeburn(opts, d) {
         return 1;
     }
     d.log(dry ? '\n🔄 enable codeburn — dry run, nothing is changed\n' : '\n🔄 enable codeburn\n');
+    const mode = await chooseMode(opts, d, dry);
+    if (typeof mode === 'number')
+        return mode;
+    if (mode === 'admin')
+        return platformTeam(d, dry);
+    if (mode === 'local')
+        return localOnly(opts, d, dry);
     // 1. codeburn installed, and new enough for --attribution
     const ensured = await ensureCodeburn(opts, d);
     if (typeof ensured === 'number')
@@ -574,9 +672,13 @@ export async function enableCodeburn(opts, d) {
             d.log('  → would ask for the OTEL collector URL (pass --url <OtelCollectorUrl> to skip)');
         }
         else {
-            otelUrl = await d.ask('  OTEL collector URL (from CDK deploy output OtelCollectorUrl): ');
+            if (!d.isTTY) {
+                d.error(`Error: the collector URL is required. Ask your platform team for it, then run ${TEAM_URL_CMD}.`);
+                return 1;
+            }
+            otelUrl = await d.ask('  Collector URL (from your platform team; the OtelCollectorUrl stack output): ');
             if (!otelUrl) {
-                d.error('Error: OTEL collector URL is required. Pass --url <OtelCollectorUrl>.');
+                d.error(`Error: the collector URL is required. Ask your platform team for it, then run ${TEAM_URL_CMD}.`);
                 return 1;
             }
         }
@@ -682,6 +784,7 @@ export async function enableCodeburn(opts, d) {
         }
     }
     // 6. What codeburn itself reports.
+    saveMode('team', d, dry);
     if (dry) {
         d.log('  → would run: codeburn sync status');
         d.log('\n  Dry run complete. Re-run without --dry-run to apply.\n');
@@ -703,12 +806,14 @@ export async function enableCodeburn(opts, d) {
     return 0;
 }
 export const CODEBURN_OPTIONS = [
-    { flags: '--url <url>', description: 'OTEL collector URL (from CDK deploy output OtelCollectorUrl; default: the URL codeburn already syncs to)' },
+    { flags: '--local', description: 'Sync mode local (the default): codeburn usage stays on this machine; no endpoint, no schedule. Leaves an existing endpoint and schedule in place unless --remove' },
+    { flags: '--url <url>', description: "Sync mode team: your team's collector URL (the OtelCollectorUrl stack output, from your platform team; default: the URL codeburn already syncs to)" },
+    { flags: '--admin', description: 'Sync mode admin: print the platform-team setup steps and the prism-cli team helper commands (no AWS calls)' },
     { flags: '--interval <hours>', description: 'Sync interval in hours (default: 12)' },
     { flags: '--yes', description: `Install codeburn (${INSTALL_CMD}), reconfigure a different endpoint, and accept an offered systemd user timer without a prompt` },
     { flags: '--dry-run', description: 'Print the plan with the exact commands; change nothing' },
     { flags: '--status', description: 'Show codeburn, sync and schedule status' },
-    { flags: '--remove', description: 'Remove the sync schedule (both kinds on Linux, unless --schedule picks one)' },
+    { flags: '--remove', description: 'Remove the sync schedule (both kinds on Linux, unless --schedule picks one); with --local, switch to local and remove it' },
     { flags: '--schedule <kind>', description: 'Linux: systemd (a systemd user timer) or cron (your crontab). Default: cron; when the crontab cannot be read, a systemd user timer is offered' },
 ];
 /** The one entry point for `enable codeburn` and its `bootstrapper setup-otel-sync` alias. */
@@ -716,7 +821,7 @@ export async function runEnableCodeburn(opts, hooks = {}) {
     await runGuarded(() => enableCodeburn(opts, (hooks.deps ?? defaultDeps)()), hooks);
 }
 export default {
-    description: 'Install codeburn and schedule its OTEL sync (pushes AI usage and commit attribution every 12h)',
+    description: "Set up codeburn: local only (default), sync to your team's PRISM every 12h (--url), or the platform-team steps (--admin)",
     options: CODEBURN_OPTIONS,
     action: runEnableCodeburn,
 };