@revos/cli 0.2.3 → 0.3.0

package/README.md

@@ -73,19 +73,25 @@ destination   Path or project name (default: current directory)
 
 If the destination already exists and is not empty, you will be prompted to confirm before proceeding. Use `--yes` to skip this prompt.
 
-**What it does:**
+**What it does (greenfield — no `revos.yaml` discovered):**
 
 1. Fetches your organizations and prompts you to select one (auto-selects if only one).
 2. Provisions a GCP service account for your org (idempotent) and writes the key to `~/.revos/{project-name}-gsa-creds.json`.
 3. Writes `revos.yaml` — the project marker that pins this directory to your organization. CLI commands like `revos status` walk up from the current directory to find this file.
 4. Creates the project directory structure (medallion layout: bronze/silver/gold).
-5. Generates `.devcontainer/devcontainer.json` with Python 3.11, Node.js, Google Cloud SDK (`bq`), GitHub CLI (`gh`), and dbt pre-installed. The Dev Container mounts `~/.revos/{project-name}-gsa-creds.json` automatically.
+5. Generates `.devcontainer/` (`devcontainer.json`, `Dockerfile`, `post-create.sh`, `post-start.sh`, `welcome.sh`) with Python, Node.js, Google Cloud SDK (`bq`), GitHub CLI (`gh`), `jq`, and dbt pre-installed. The Dev Container persists three per-project named Docker volumes — `revos-{slug}-credentials` (`~/.revos`), `revos-{slug}-gcloud` (`~/.config/gcloud`), and `revos-{slug}-claude` (`~/.claude`) — so CLI login, GSA key, gcloud auth state, and Claude Code state all survive `Rebuild Container`. No host bind mounts.
 6. Generates `dbt/profiles.yml` pre-configured for BigQuery.
 7. Generates `.gitignore` and `README.md`.
 8. Scaffolds AI companion files: `CLAUDE.md`, `AGENTS.md`, and `.claude/skills/` with six pre-installed skills: `explore-lakehouse`, `create-connections`, `create-cubes`, `create-dbt-transformations`, `load-sample-data`, and `visualize-semantic-model`. Also writes `.claude/settings.json` with deny rules that block AI assistants from reading `~/.revos/` (CLI credentials and service account keys), `~/.config/gcloud/` (Google Cloud Application Default Credentials), from running `gcloud auth print-*-token` commands, and from editing the settings file itself (so the AI can't lift its own restrictions).
 9. Discovers every Connection and Cube currently in the org and writes them under `connections/` and `cubes/` so a developer joining an org with existing pipelines and cubes starts from the live state. Pass `--no-pull` to skip. Sources are managed only through the API surface (see [Sources](#sources)) and are referenced from Connection YAML by their server id.
 
-**Requires:** `revos auth login` first.
+**What it does (in-project — re-run inside an existing `revos.yaml` tree):**
+
+`revos init` becomes idempotent: it skips the org prompt, skips scaffolding (no overwriting of existing files), skips IaC discovery, and only provisions the GCP service account key if `~/.revos/{project-name}-gsa-creds.json` is missing. Useful inside the Dev Container — the named volume starts empty, so after `revos auth login` you run `revos init` to materialize the GSA key. Outside the container, re-running is a safe no-op if everything is already in place.
+
+**Dev Container onboarding flow:** open project in VS Code → "Reopen in Container" → run `revos auth login` → run `revos init`. Subsequent container starts auto-activate the service account via `postStartCommand`.
+
+**Requires:** `revos auth login` first (greenfield), or in-container login (in-project).
 
 ---
 
@@ -290,6 +296,12 @@ The CLI walks up from the current working directory to find `revos.yaml` (or set
 revos auth login
 ```
 
+After the OAuth flow completes, the CLI picks your default organization:
+
+- **Inside a project** (`revos.yaml` discovered) — uses `metadata.orgId` from `revos.yaml`; no prompt.
+- **Outside a project, one org** — auto-selects it.
+- **Outside a project, multiple orgs** — prompts you to pick.
+
 #### Logout
 
 ```bash

package/dist/adapters/oclif/commands/action-runs/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/action-runs/get.ts
 var get_default = getCommand({
 	resource: "actionRuns",

package/dist/adapters/oclif/commands/action-runs/list.mjs

@@ -1,4 +1,4 @@
-import { i as listCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { i as listCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/action-runs/list.ts
 var list_default = listCommand({
 	resource: "actionRuns",

package/dist/adapters/oclif/commands/actions/get-input-schema.mjs

@@ -1,5 +1,5 @@
-import { x as unwrap } from "../../../../core-B-IdeRNl.mjs";
-import { r as defineApiCommand } from "../../../../factory-CCcimDhl.mjs";
+import { x as unwrap } from "../../../../core-DsGA_HuL.mjs";
+import { r as defineApiCommand } from "../../../../factory-eslVs9tN.mjs";
 import { Args, Flags } from "@oclif/core";
 //#region src/adapters/oclif/commands/actions/get-input-schema.ts
 var get_input_schema_default = defineApiCommand({

package/dist/adapters/oclif/commands/actions/get-params-schema.mjs

@@ -1,5 +1,5 @@
-import { x as unwrap } from "../../../../core-B-IdeRNl.mjs";
-import { r as defineApiCommand } from "../../../../factory-CCcimDhl.mjs";
+import { x as unwrap } from "../../../../core-DsGA_HuL.mjs";
+import { r as defineApiCommand } from "../../../../factory-eslVs9tN.mjs";
 import { Args, Flags } from "@oclif/core";
 //#region src/adapters/oclif/commands/actions/get-params-schema.ts
 var get_params_schema_default = defineApiCommand({

package/dist/adapters/oclif/commands/actions/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/actions/get.ts
 var get_default = getCommand({
 	resource: "actions",

package/dist/adapters/oclif/commands/actions/list.mjs

@@ -1,5 +1,5 @@
-import { x as unwrap } from "../../../../core-B-IdeRNl.mjs";
-import { n as createListRender, r as defineApiCommand } from "../../../../factory-CCcimDhl.mjs";
+import { x as unwrap } from "../../../../core-DsGA_HuL.mjs";
+import { n as createListRender, r as defineApiCommand } from "../../../../factory-eslVs9tN.mjs";
 import { Flags } from "@oclif/core";
 var list_default = defineApiCommand({
 	description: "List available actions",

package/dist/adapters/oclif/commands/ai-instructions/create.mjs

@@ -1,4 +1,4 @@
-import { t as createCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { t as createCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/ai-instructions/create.ts
 var create_default = createCommand({
 	resource: "aiInstructions",

package/dist/adapters/oclif/commands/ai-instructions/delete.mjs

@@ -1,4 +1,4 @@
-import { n as deleteCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { n as deleteCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/ai-instructions/delete.ts
 var delete_default = deleteCommand({
 	resource: "aiInstructions",

package/dist/adapters/oclif/commands/ai-instructions/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/ai-instructions/get.ts
 var get_default = getCommand({
 	resource: "aiInstructions",

package/dist/adapters/oclif/commands/ai-instructions/list.mjs

@@ -1,4 +1,4 @@
-import { i as listCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { i as listCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/ai-instructions/list.ts
 var list_default = listCommand({
 	resource: "aiInstructions",

package/dist/adapters/oclif/commands/ai-instructions/update.mjs

@@ -1,4 +1,4 @@
-import { a as updateCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { a as updateCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/ai-instructions/update.ts
 var update_default = updateCommand({
 	resource: "aiInstructions",

package/dist/adapters/oclif/commands/api.mjs

@@ -1,5 +1,5 @@
-import { U as ApiError } from "../../../core-B-IdeRNl.mjs";
-import { r as defineApiCommand, t as bodyFlag } from "../../../factory-CCcimDhl.mjs";
+import { U as ApiError } from "../../../core-DsGA_HuL.mjs";
+import { r as defineApiCommand, t as bodyFlag } from "../../../factory-eslVs9tN.mjs";
 import { client } from "@revos/api-client";
 import { Args, Flags } from "@oclif/core";
 //#region src/adapters/oclif/commands/api.ts

package/dist/adapters/oclif/commands/apply.d.mts

@@ -1,4 +1,4 @@
-import { f as AppliedResource } from "../../../index-D0ax2I61.mjs";
+import { f as AppliedResource } from "../../../index-Blr5iiwc.mjs";
 import { c as IacError } from "../../../context-D5uelKLe.mjs";
 import { t as BaseCommand } from "../../../base.command-BmddDbHa.mjs";
 import * as _$_oclif_core_interfaces0 from "@oclif/core/interfaces";

package/dist/adapters/oclif/commands/apply.mjs

@@ -1,5 +1,5 @@
-import { E as getConfig, _ as buildIacRegistry, b as createApiClient, m as apply, v as discoverProject, y as projectRoot } from "../../../core-B-IdeRNl.mjs";
-import { t as BaseCommand } from "../../../base.command-D8taHOFF.mjs";
+import { E as getConfig, _ as buildIacRegistry, b as createApiClient, m as apply, v as discoverProject, y as projectRoot } from "../../../core-DsGA_HuL.mjs";
+import { t as BaseCommand } from "../../../base.command-BLken6pU.mjs";
 import { n as renderIacErrors, t as APPLY_ACTION_LABELS } from "../../../iac-render-BSZZEP0n.mjs";
 import chalk from "chalk";
 import { Args, Flags } from "@oclif/core";

package/dist/adapters/oclif/commands/auth/login.mjs

@@ -1,5 +1,5 @@
-import { A as generatePKCEChallenge, D as AUTH_ENVS, F as setAuthEnv, H as saveCredentials, I as tokenResponseToCredentials, L as startOAuthServer, M as getUserInfo, O as buildAuthorizationUrl, P as setAuthConfig, b as createApiClient, j as getActiveAuthConfig, k as exchangeCodeForTokens, n as selectOrganization, x as unwrap, z as getCredentialsPath } from "../../../../core-B-IdeRNl.mjs";
-import { t as BaseCommand } from "../../../../base.command-D8taHOFF.mjs";
+import { A as generatePKCEChallenge, D as AUTH_ENVS, F as setAuthEnv, H as saveCredentials, I as tokenResponseToCredentials, L as startOAuthServer, M as getUserInfo, O as buildAuthorizationUrl, P as setAuthConfig, b as createApiClient, j as getActiveAuthConfig, k as exchangeCodeForTokens, l as resolveProjectContext, n as selectOrganization, x as unwrap, z as getCredentialsPath } from "../../../../core-DsGA_HuL.mjs";
+import { t as BaseCommand } from "../../../../base.command-BLken6pU.mjs";
 import chalk from "chalk";
 import { Flags } from "@oclif/core";
 import open from "open";
@@ -51,7 +51,12 @@ var AuthLogin = class extends BaseCommand {
 			this.log(chalk.green(`\nAuthenticated as ${userInfo.email || userInfo.sub}`));
 			this.log(`\nCredentials saved to ${getCredentialsPath()}`);
 		}
-		try {
+		const projectCtx = resolveProjectContext();
+		if (projectCtx) {
+			credentials.organizationId = projectCtx.orgId;
+			saveCredentials(credentials);
+			if (!this.jsonEnabled()) this.log(chalk.green(`\nUsing organization from revos.yaml: ${projectCtx.orgId}`));
+		} else try {
 			const orgs = unwrap(await createApiClient({
 				apiUrl,
 				token: tokenResponse.access_token

package/dist/adapters/oclif/commands/auth/logout.mjs

@@ -1,5 +1,5 @@
-import { R as deleteCredentials } from "../../../../core-B-IdeRNl.mjs";
-import { t as BaseCommand } from "../../../../base.command-D8taHOFF.mjs";
+import { R as deleteCredentials } from "../../../../core-DsGA_HuL.mjs";
+import { t as BaseCommand } from "../../../../base.command-BLken6pU.mjs";
 import * as os from "os";
 //#region src/adapters/oclif/commands/auth/logout.ts
 var AuthLogout = class extends BaseCommand {

package/dist/adapters/oclif/commands/auth/status.mjs

@@ -1,5 +1,5 @@
-import { B as isTokenExpired, V as loadCredentials, l as resolveProjectContext, z as getCredentialsPath } from "../../../../core-B-IdeRNl.mjs";
-import { t as BaseCommand } from "../../../../base.command-D8taHOFF.mjs";
+import { B as isTokenExpired, V as loadCredentials, l as resolveProjectContext, z as getCredentialsPath } from "../../../../core-DsGA_HuL.mjs";
+import { t as BaseCommand } from "../../../../base.command-BLken6pU.mjs";
 import chalk from "chalk";
 //#region src/adapters/oclif/commands/auth/status.ts
 var AuthStatus = class extends BaseCommand {

package/dist/adapters/oclif/commands/connections/create.mjs

@@ -1,4 +1,4 @@
-import { t as createCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { t as createCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/connections/create.ts
 var create_default = createCommand({
 	resource: "connections",

package/dist/adapters/oclif/commands/connections/delete.mjs

@@ -1,4 +1,4 @@
-import { n as deleteCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { n as deleteCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/connections/delete.ts
 var delete_default = deleteCommand({
 	resource: "connections",

package/dist/adapters/oclif/commands/connections/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/connections/get.ts
 var get_default = getCommand({
 	resource: "connections",

package/dist/adapters/oclif/commands/connections/list.mjs

@@ -1,4 +1,4 @@
-import { i as listCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { i as listCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/connections/list.ts
 var list_default = listCommand({
 	resource: "connections",

package/dist/adapters/oclif/commands/connections/update.mjs

@@ -1,4 +1,4 @@
-import { a as updateCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { a as updateCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/connections/update.ts
 var update_default = updateCommand({
 	resource: "connections",

package/dist/adapters/oclif/commands/cubes/create.mjs

@@ -1,4 +1,4 @@
-import { t as createCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { t as createCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/cubes/create.ts
 var create_default = createCommand({
 	resource: "cubes",

package/dist/adapters/oclif/commands/cubes/delete.mjs

@@ -1,4 +1,4 @@
-import { n as deleteCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { n as deleteCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/cubes/delete.ts
 var delete_default = deleteCommand({
 	resource: "cubes",

package/dist/adapters/oclif/commands/cubes/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/cubes/get.ts
 var get_default = getCommand({
 	resource: "cubes",

package/dist/adapters/oclif/commands/cubes/list.mjs

@@ -1,4 +1,4 @@
-import { i as listCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { i as listCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/cubes/list.ts
 var list_default = listCommand({
 	resource: "cubes",

package/dist/adapters/oclif/commands/cubes/update.mjs

@@ -1,4 +1,4 @@
-import { a as updateCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { a as updateCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/cubes/update.ts
 var update_default = updateCommand({
 	resource: "cubes",

package/dist/adapters/oclif/commands/diff.d.mts

@@ -1,4 +1,4 @@
-import { f as AppliedResource } from "../../../index-D0ax2I61.mjs";
+import { f as AppliedResource } from "../../../index-Blr5iiwc.mjs";
 import { c as IacError } from "../../../context-D5uelKLe.mjs";
 import { t as BaseCommand } from "../../../base.command-BmddDbHa.mjs";
 import * as _$_oclif_core_interfaces0 from "@oclif/core/interfaces";

package/dist/adapters/oclif/commands/diff.mjs

@@ -1,5 +1,5 @@
-import { E as getConfig, _ as buildIacRegistry, b as createApiClient, h as formatDiffLine, m as apply, v as discoverProject, y as projectRoot } from "../../../core-B-IdeRNl.mjs";
-import { t as BaseCommand } from "../../../base.command-D8taHOFF.mjs";
+import { E as getConfig, _ as buildIacRegistry, b as createApiClient, h as formatDiffLine, m as apply, v as discoverProject, y as projectRoot } from "../../../core-DsGA_HuL.mjs";
+import { t as BaseCommand } from "../../../base.command-BLken6pU.mjs";
 import { n as renderIacErrors, t as APPLY_ACTION_LABELS } from "../../../iac-render-BSZZEP0n.mjs";
 import chalk from "chalk";
 import { Args, Flags } from "@oclif/core";

package/dist/adapters/oclif/commands/gservice-account-keys/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/gservice-account-keys/get.ts
 var get_default = getCommand({
 	resource: "gserviceAccountKeys",

package/dist/adapters/oclif/commands/gservice-account-keys/reveal.mjs

@@ -1,5 +1,5 @@
-import { x as unwrap } from "../../../../core-B-IdeRNl.mjs";
-import { r as defineApiCommand } from "../../../../factory-CCcimDhl.mjs";
+import { x as unwrap } from "../../../../core-DsGA_HuL.mjs";
+import { r as defineApiCommand } from "../../../../factory-eslVs9tN.mjs";
 import { Args } from "@oclif/core";
 //#region src/adapters/oclif/commands/gservice-account-keys/reveal.ts
 var reveal_default = defineApiCommand({

package/dist/adapters/oclif/commands/gservice-accounts/create.mjs

@@ -1,4 +1,4 @@
-import { t as createCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { t as createCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/gservice-accounts/create.ts
 var create_default = createCommand({
 	resource: "gserviceAccounts",

package/dist/adapters/oclif/commands/gservice-accounts/delete.mjs

@@ -1,4 +1,4 @@
-import { n as deleteCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { n as deleteCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/gservice-accounts/delete.ts
 var delete_default = deleteCommand({
 	resource: "gserviceAccounts",

package/dist/adapters/oclif/commands/gservice-accounts/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/gservice-accounts/get.ts
 var get_default = getCommand({
 	resource: "gserviceAccounts",

package/dist/adapters/oclif/commands/gservice-accounts/list.mjs

@@ -1,4 +1,4 @@
-import { i as listCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { i as listCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/gservice-accounts/list.ts
 var list_default = listCommand({
 	resource: "gserviceAccounts",

package/dist/adapters/oclif/commands/init.d.mts

@@ -14,6 +14,8 @@ declare class Init extends BaseCommand<typeof Init> {
     "no-pull": _$_oclif_core_interfaces0.BooleanFlag<boolean>;
   };
   run(): Promise<void>;
+  private runInProject;
+  private activateGcloudInContainer;
 }
 //#endregion
 export { Init as default };

package/dist/adapters/oclif/commands/init.mjs

@@ -1,9 +1,10 @@
-import { E as getConfig, U as ApiError, t as InitService } from "../../../core-B-IdeRNl.mjs";
+import { E as getConfig, U as ApiError, l as resolveProjectContext, t as InitService } from "../../../core-DsGA_HuL.mjs";
 import { TEMPLATES_DIR } from "../../../templates/index.mjs";
-import { t as BaseCommand } from "../../../base.command-D8taHOFF.mjs";
+import { t as BaseCommand } from "../../../base.command-BLken6pU.mjs";
 import * as fs from "fs";
 import * as path from "path";
 import chalk from "chalk";
+import { execFileSync } from "child_process";
 import { Args, Flags } from "@oclif/core";
 import select from "@inquirer/select";
 //#region src/adapters/oclif/commands/init.ts
@@ -35,6 +36,17 @@ var Init = class extends BaseCommand {
 	async run() {
 		const { apiUrl, token, organizationId } = await getConfig();
 		const projectDir = this.args.destination ? path.resolve(this.args.destination) : process.cwd();
+		const service = new InitService(TEMPLATES_DIR);
+		const projectCtx = fs.existsSync(projectDir) ? resolveProjectContext({ cwd: projectDir }) : null;
+		if (projectCtx) {
+			await this.runInProject({
+				apiUrl,
+				token,
+				service,
+				projectCtx
+			});
+			return;
+		}
 		if (fs.existsSync(projectDir) && !isDirEmpty(projectDir) && !this.flags.yes) {
 			if (await select({
 				message: `Directory "${path.basename(projectDir)}" already exists and is not empty. What would you like to do?`,
@@ -50,7 +62,6 @@ var Init = class extends BaseCommand {
 				return;
 			}
 		}
-		const service = new InitService(TEMPLATES_DIR);
 		const org = await service.resolveOrganization(apiUrl, token, organizationId).catch((err) => {
 			const message = err instanceof Error ? err.message : String(err);
 			this.error(message, { exit: 1 });
@@ -102,6 +113,74 @@ var Init = class extends BaseCommand {
 		this.log(`\nNext step: open ${chalk.bold(result.projectDir)} in VS Code and click ${chalk.bold("Reopen in Container")}.`);
 		this.log(`\n${chalk.dim("Tip: once inside the Dev Container, ask Claude to \"load sample data\" if you need example datasets.")}\n`);
 	}
+	async runInProject(args) {
+		const { apiUrl, token, service, projectCtx } = args;
+		const projectSlug = projectCtx.projectFile.metadata.name;
+		const orgId = projectCtx.orgId;
+		if (!projectSlug) this.error(`revos.yaml at ${projectCtx.projectFile.path} is missing metadata.name — required to locate the GCP service account key.`, { exit: 1 });
+		if (this.flags["dry-run"]) {
+			this.log(`\nDetected existing RevOS project at ${chalk.dim(projectCtx.projectPath)}`);
+			this.log(`  Org: ${chalk.bold(orgId)}`);
+			const keyPath = InitService.gcpKeyPath(projectSlug);
+			if (fs.existsSync(keyPath) && fs.statSync(keyPath).size > 0) this.log(chalk.dim("\nNothing to do — GCP service account key already present."));
+			else this.log(`\nWould provision GCP service account key at ${keyPath}`);
+			return;
+		}
+		const org = await service.resolveOrganization(apiUrl, token, orgId).catch((err) => {
+			const message = err instanceof Error ? err.message : String(err);
+			this.error(message, { exit: 1 });
+		});
+		this.log(`\nDetected existing RevOS project at ${chalk.dim(projectCtx.projectPath)}`);
+		this.log(`  Org: ${chalk.bold(org.name)} (${org.id})\n`);
+		const result = await service.ensureGcpKey({
+			apiUrl,
+			token,
+			organization: org,
+			projectSlug
+		}).catch((err) => {
+			if (err instanceof ApiError) {
+				this.log(chalk.red(`\nAPI error: ${err.status} ${err.statusText}`));
+				this.log(chalk.red(`URL: ${err.url}`));
+				this.log(chalk.red(`Body: ${JSON.stringify(err.body, null, 2)}`));
+			}
+			const message = err instanceof Error ? err.message : String(err);
+			this.error(message, { exit: 1 });
+		});
+		if (result.status === "created") {
+			this.log(chalk.green(`Provisioned GCP service account key: ${result.keyPath}`));
+			this.activateGcloudInContainer(result.keyPath);
+		} else this.log(chalk.dim(`Nothing to do — GCP service account key already present at ${result.keyPath}.`));
+	}
+	/**
+	* After provisioning a key inside a Dev Container, the GSA still needs to
+	* be activated in gcloud's local config for `bq`, `dbt`, and direct
+	* `gcloud` commands to work in this shell — postStartCommand already ran
+	* with no key file. We do that activation here, but only inside a
+	* container (detected via /.dockerenv) so we never touch the user's
+	* personal gcloud config on the host.
+	*/
+	activateGcloudInContainer(keyPath) {
+		if (!fs.existsSync("/.dockerenv")) return;
+		try {
+			execFileSync("gcloud", [
+				"auth",
+				"activate-service-account",
+				"--key-file",
+				keyPath
+			], { stdio: "ignore" });
+			const project = process.env.GOOGLE_CLOUD_PROJECT;
+			if (project) execFileSync("gcloud", [
+				"config",
+				"set",
+				"project",
+				project
+			], { stdio: "ignore" });
+			this.log(chalk.green("Activated service account in gcloud."));
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			this.log(chalk.yellow(`Could not activate gcloud automatically (${msg}). Run manually:\n  gcloud auth activate-service-account --key-file=${keyPath}`));
+		}
+	}
 };
 //#endregion
 export { Init as default };

package/dist/adapters/oclif/commands/org/create.mjs

@@ -1,4 +1,4 @@
-import { t as createCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { t as createCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/org/create.ts
 var create_default = createCommand({
 	resource: "organizations",

package/dist/adapters/oclif/commands/org/current.mjs

@@ -1,5 +1,5 @@
-import { E as getConfig, V as loadCredentials, b as createApiClient, l as resolveProjectContext, x as unwrap } from "../../../../core-B-IdeRNl.mjs";
-import { t as BaseCommand } from "../../../../base.command-D8taHOFF.mjs";
+import { E as getConfig, V as loadCredentials, b as createApiClient, l as resolveProjectContext, x as unwrap } from "../../../../core-DsGA_HuL.mjs";
+import { t as BaseCommand } from "../../../../base.command-BLken6pU.mjs";
 import chalk from "chalk";
 //#region src/adapters/oclif/commands/org/current.ts
 var OrgCurrent = class extends BaseCommand {

package/dist/adapters/oclif/commands/org/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/org/get.ts
 var get_default = getCommand({
 	resource: "organizations",

package/dist/adapters/oclif/commands/org/list.mjs

@@ -1,5 +1,5 @@
-import { l as resolveProjectContext, x as unwrap } from "../../../../core-B-IdeRNl.mjs";
-import { a as resolveColumns, i as renderList, r as defineApiCommand } from "../../../../factory-CCcimDhl.mjs";
+import { l as resolveProjectContext, x as unwrap } from "../../../../core-DsGA_HuL.mjs";
+import { a as resolveColumns, i as renderList, r as defineApiCommand } from "../../../../factory-eslVs9tN.mjs";
 import chalk from "chalk";
 import { Flags } from "@oclif/core";
 //#region src/adapters/oclif/commands/org/list.ts

package/dist/adapters/oclif/commands/org/switch.mjs

@@ -1,5 +1,5 @@
-import { E as getConfig, H as saveCredentials, V as loadCredentials, a as formatInProjectSwitchWarning, b as createApiClient, l as resolveProjectContext, n as selectOrganization, x as unwrap } from "../../../../core-B-IdeRNl.mjs";
-import { t as BaseCommand } from "../../../../base.command-D8taHOFF.mjs";
+import { E as getConfig, H as saveCredentials, V as loadCredentials, a as formatInProjectSwitchWarning, b as createApiClient, l as resolveProjectContext, n as selectOrganization, x as unwrap } from "../../../../core-DsGA_HuL.mjs";
+import { t as BaseCommand } from "../../../../base.command-BLken6pU.mjs";
 import * as os from "os";
 import chalk from "chalk";
 import { Args } from "@oclif/core";

package/dist/adapters/oclif/commands/pull.d.mts

@@ -1,4 +1,4 @@
-import { d as PulledResource } from "../../../index-D0ax2I61.mjs";
+import { d as PulledResource } from "../../../index-Blr5iiwc.mjs";
 import { c as IacError } from "../../../context-D5uelKLe.mjs";
 import { t as BaseCommand } from "../../../base.command-BmddDbHa.mjs";
 import * as _$_oclif_core_interfaces0 from "@oclif/core/interfaces";

package/dist/adapters/oclif/commands/pull.mjs

@@ -1,5 +1,5 @@
-import { E as getConfig, _ as buildIacRegistry, b as createApiClient, p as pull, v as discoverProject, y as projectRoot } from "../../../core-B-IdeRNl.mjs";
-import { t as BaseCommand } from "../../../base.command-D8taHOFF.mjs";
+import { E as getConfig, _ as buildIacRegistry, b as createApiClient, p as pull, v as discoverProject, y as projectRoot } from "../../../core-DsGA_HuL.mjs";
+import { t as BaseCommand } from "../../../base.command-BLken6pU.mjs";
 import { n as renderIacErrors } from "../../../iac-render-BSZZEP0n.mjs";
 import chalk from "chalk";
 import { Args, Flags } from "@oclif/core";

package/dist/adapters/oclif/commands/score-groups/create.mjs

@@ -1,4 +1,4 @@
-import { t as createCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { t as createCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/score-groups/create.ts
 var create_default = createCommand({
 	resource: "scoreGroups",

package/dist/adapters/oclif/commands/score-groups/delete.mjs

@@ -1,4 +1,4 @@
-import { n as deleteCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { n as deleteCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/score-groups/delete.ts
 var delete_default = deleteCommand({
 	resource: "scoreGroups",

package/dist/adapters/oclif/commands/score-groups/get.mjs

@@ -1,4 +1,4 @@
-import { r as getCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { r as getCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/score-groups/get.ts
 var get_default = getCommand({
 	resource: "scoreGroups",

package/dist/adapters/oclif/commands/score-groups/list.mjs

@@ -1,4 +1,4 @@
-import { i as listCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { i as listCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/score-groups/list.ts
 var list_default = listCommand({
 	resource: "scoreGroups",

package/dist/adapters/oclif/commands/score-groups/update.mjs

@@ -1,4 +1,4 @@
-import { a as updateCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { a as updateCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/score-groups/update.ts
 var update_default = updateCommand({
 	resource: "scoreGroups",

package/dist/adapters/oclif/commands/scores/create.mjs

@@ -1,4 +1,4 @@
-import { t as createCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { t as createCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/scores/create.ts
 var create_default = createCommand({
 	resource: "scores",

package/dist/adapters/oclif/commands/scores/delete.mjs

@@ -1,4 +1,4 @@
-import { n as deleteCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { n as deleteCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/scores/delete.ts
 var delete_default = deleteCommand({
 	resource: "scores",

package/dist/adapters/oclif/commands/scores/list.mjs

@@ -1,4 +1,4 @@
-import { i as listCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { i as listCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/scores/list.ts
 var list_default = listCommand({
 	resource: "scores",

package/dist/adapters/oclif/commands/scores/update.mjs

@@ -1,4 +1,4 @@
-import { a as updateCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { a as updateCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/scores/update.ts
 var update_default = updateCommand({
 	resource: "scores",

package/dist/adapters/oclif/commands/segments/create.mjs

@@ -1,4 +1,4 @@
-import { t as createCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { t as createCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/segments/create.ts
 var create_default = createCommand({
 	resource: "segments",

package/dist/adapters/oclif/commands/segments/delete.mjs

@@ -1,4 +1,4 @@
-import { n as deleteCommand } from "../../../../presets-Bb9gwgeh.mjs";
+import { n as deleteCommand } from "../../../../presets-D0AIVsGO.mjs";
 //#region src/adapters/oclif/commands/segments/delete.ts
 var delete_default = deleteCommand({
 	resource: "segments",