@wardby/cli 0.1.0 → 0.2.0

package/README.md

@@ -1,5 +1,5 @@
 <div>
-  <img align="left" hspace="24" src="docs/assets/brand/wardby-mascot.png" alt="Wardby guardian robot protecting an agent budget" width="280">
+  <img align="left" hspace="24" src="https://raw.githubusercontent.com/wardby/wardby/main/docs/assets/brand/wardby-mascot.png" alt="Wardby guardian robot protecting an agent budget" width="280">
   <h3><big><big>Wardby</big></big> <small><em>(pronounced&nbsp;“WARD&#8209;bee”)</em></small></h3>
   <h3>Autonomous agents, bounded by design.</h3>
   <p><strong>Most agent runners focus on helping a model complete a task. Wardby is the self-hosted control plane that decides whether the task should run, limits what it can access, and returns a reviewable outcome governed by explicit policy.</strong></p>
@@ -11,19 +11,26 @@
     <a href="#a-full-cycle-agent-from-one-conversation">Full-cycle example</a> ·
     <a href="#host-it-in-your-cloud">Deployments</a> ·
     <a href="#bring-your-own-observability">Observability</a> ·
-    <a href="#quickstart">Quickstart</a> ·
+    <a href="https://github.com/wardby/wardby/blob/main/docs/getting-started.md">Getting started</a> ·
     <a href="#security-boundaries">Security</a>
   </p>
 </div>
 <br clear="left">
 
-<!-- GitHub does not expose live Actions badge images for private repositories. These capability badges link authenticated readers to the authoritative workflow. -->
-
-[![Security CI](https://img.shields.io/badge/security%20CI-GitHub%20Actions-2088FF?logo=githubactions&logoColor=white)](https://github.com/wardby/wardby/actions/workflows/security.yml?query=branch%3Amain)
+<!-- The first four badges are live: the npm version, Node floor and license are
+read from the published package, and the security badge shows the latest run of
+the security workflow on main. The last three are capability labels describing
+what that workflow enforces -- they are not status and never change colour.
+Every URL is absolute because npm renders this README too, and a relative path
+there resolves against npmjs.com instead of this repository. -->
+
+[![npm](https://img.shields.io/npm/v/@wardby/cli)](https://www.npmjs.com/package/@wardby/cli)
+[![Security checks](https://github.com/wardby/wardby/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/wardby/wardby/actions/workflows/security.yml?query=branch%3Amain)
+[![Node](https://img.shields.io/node/v/@wardby/cli)](https://www.npmjs.com/package/@wardby/cli)
+[![License](https://img.shields.io/npm/l/@wardby/cli)](https://github.com/wardby/wardby/blob/main/LICENSE)
 [![Dependency audit](https://img.shields.io/badge/dependencies-audit%20policy-0f766e.svg)](https://github.com/wardby/wardby/actions/workflows/security.yml?query=branch%3Amain)
 [![Container scan](https://img.shields.io/badge/container%20images-Trivy%20CRITICAL%20gate-0f766e.svg)](https://github.com/wardby/wardby/actions/workflows/security.yml?query=branch%3Amain)
 [![SBOM](https://img.shields.io/badge/SBOM-SPDX%20JSON-0f766e.svg)](https://github.com/wardby/wardby/actions/workflows/security.yml?query=branch%3Amain)
-[![License](https://img.shields.io/badge/license-Apache--2.0-0f766e.svg)](LICENSE)
 
 > **Project status:** the control plane, scheduler, budget groups, MCP server,
 > native agents, isolated Codex and Claude Code workers, GitHub draft-PR flow,
@@ -68,7 +75,7 @@ result.
 
 ## One control plane, the full lifecycle
 
-![Wardby workflow: ask in Claude or Codex, define an agent through MCP, govern it in Wardby, execute it in isolation, and apply review policy to its outcome](docs/assets/wardby-workflow.svg)
+![Wardby workflow: ask in Claude or Codex, define an agent through MCP, govern it in Wardby, execute it in isolation, and apply review policy to its outcome](https://raw.githubusercontent.com/wardby/wardby/main/docs/assets/wardby-workflow.svg)
 
 Claude and Codex are the operator experience. Wardby is the durable system
 behind them: it stores agent definitions, triggers work, reserves budget,
@@ -126,17 +133,17 @@ The core does not import a cloud SDK. Jobs, model access, email, secrets,
 authentication, and object storage sit behind provider interfaces so operators
 can choose the infrastructure boundary that fits their environment.
 
-| Target                               | Current support                                                                                                                                 |
-| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Local Docker, VM, or on-premises** | Portable PostgreSQL and container workflow for development and self-hosting.                                                                    |
-| **Production container baseline**    | Separate runtime and migration images plus a Compose/Caddy reference boundary.                                                                  |
-| **GCP**                              | Terraform reference for the control plane on Cloud Run and Cloud SQL. Cloud-native coding jobs and production observability are follow-on work. |
-| **AWS**                              | The portable runtime and Bedrock model adapter are available; a native AWS deployment module is planned.                                        |
-| **Other clouds**                     | Run the production image and provide equivalent PostgreSQL, secrets, ingress, egress, and monitoring controls.                                  |
-
-Start with [deployment targets](deploy/README.md), the
-[portable production boundary](deploy/production/README.md), or the
-[GCP setup guide](deploy/gcp/SETUP.md). Reference deployments are examples,
+| Target                               | Current support                                                                                                  |
+| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------- |
+| **Local Docker, VM, or on-premises** | Portable PostgreSQL and container workflow for development and self-hosting.                                     |
+| **Production container baseline**    | Separate runtime and migration images plus a Compose/Caddy reference boundary.                                   |
+| **GKE Autopilot**                    | Supported GCP reference with private Cloud SQL, isolated Codex worker pods, HTTPS Gateway, and immutable images. |
+| **AWS**                              | The portable runtime and Bedrock model adapter are available; a native AWS deployment module is planned.         |
+| **Other clouds**                     | Run the production image and provide equivalent PostgreSQL, secrets, ingress, egress, and monitoring controls.   |
+
+Start with [deployment targets](https://github.com/wardby/wardby/blob/main/deploy/README.md), the
+[portable production boundary](https://github.com/wardby/wardby/blob/main/deploy/production/README.md), or the
+[GKE getting-started guide](https://github.com/wardby/wardby/blob/main/docs/getting-started-gke.md). Reference deployments are examples,
 not a requirement to use one vendor.
 
 **A complete deployment runs more than `wardby mcp`.** `mcp` serves the MCP
@@ -172,7 +179,7 @@ npm run observability:down
 The included cloud deployments do not yet provision AWS or GCP collectors.
 Current metrics primarily cover the coding proxy; application/MCP metrics,
 production alerts, and SLOs remain operator responsibilities. See the
-[observability guide](docs/observability.md) for boundaries and retention.
+[observability guide](https://github.com/wardby/wardby/blob/main/docs/observability.md) for boundaries and retention.
 
 ## Security boundaries
 
@@ -195,9 +202,9 @@ production alerts, and SLOs remain operator responsibilities. See the
 - **Sanitized operations:** lifecycle events and metrics exclude prompts,
   repository content, credentials, diffs, and raw worker output.
 
-Read the [runtime architecture](docs/architecture-runtime.md),
-[coding-worker isolation model](docs/coding-worker-isolation.md), and
-[security deployment guide](docs/security-deployment.md) before enabling a
+Read the [runtime architecture](https://github.com/wardby/wardby/blob/main/docs/architecture-runtime.md),
+[coding-worker isolation model](https://github.com/wardby/wardby/blob/main/docs/coding-worker-isolation.md), and
+[security deployment guide](https://github.com/wardby/wardby/blob/main/docs/security-deployment.md) before enabling a
 production repository.
 
 Review policy is designed to support designated agents as well as people.
@@ -210,33 +217,38 @@ Requirements: Node.js 24 or newer, Docker, and one supported model-provider
 credential.
 
 ```sh
-git clone https://github.com/wardby/wardby.git
-cd wardby
-npm ci
-cp .env.example .env
+npx --yes @wardby/cli@latest quickstart
 ```
 
-Edit `.env` and set `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`. Generate a local
-secret-encryption key with `openssl rand -hex 32` and use it as
-`SECRET_APP_KEY`. Then initialize the local database and start the stdio MCP
-server:
+The guided command checks prerequisites, creates private project-local
+configuration, starts PostgreSQL in Docker, applies migrations, and offers to
+run a small agent with a `$1` maximum budget. It can also register Wardby as a
+local MCP server in Codex, Claude Code, or both.
+
+Read the [Getting started guide](https://github.com/wardby/wardby/blob/main/docs/getting-started.md) for unattended setup,
+MCP usage, lifecycle commands, and the boundary between the native demo and
+isolated coding agents. For a shared cloud installation, follow the full
+[GKE getting-started guide](https://github.com/wardby/wardby/blob/main/docs/getting-started-gke.md).
+
+### Installing from npm
 
 ```sh
-npm run db:up
-npm run prisma:generate
-npm run prisma:migrate
-npm run cli -- mcp
+npm install @wardby/cli
 ```
 
-Point Claude or Codex at `npm run cli -- mcp` with the repository as its working
-directory. The exact client configuration format differs, but both use Wardby's
-stdio transport locally. For shared or remote access, use Streamable HTTP with
-OAuth and the production boundary documented above.
+`npm audit` will report a high-severity advisory in `deepmerge-ts`
+([GHSA-ggr8-5vv4-36mx](https://github.com/advisories/GHSA-ggr8-5vv4-36mx)). It
+is reached only through Prisma's CLI while it loads your own Prisma
+configuration, and Prisma has not patched it in the 6.x line. This repository
+clears it with an override, but npm does not apply a package's overrides to the
+projects that install it — so add the same entry to your own `package.json`:
+
+```json
+"overrides": { "deepmerge-ts": "8.0.2" }
+```
 
-Once connected, ask the client to list the available Wardby tools, create an
-agent with a small budget, trigger it, and inspect the run. Coding-agent setup
-additionally requires a dedicated GitHub App, immutable worker images, and the
-proxy boundary described in the [local coding-agent setup guide](docs/coding-agent-setup.md).
+That override is tested against Prisma 6 and the CLI; the reasoning and the
+retirement plan are in [SR-009](https://github.com/wardby/wardby/blob/main/docs/security-deployment.md#images-and-dependency-exception).
 
 ## What is implemented
 
@@ -251,12 +263,12 @@ proxy boundary described in the [local coding-agent setup guide](docs/coding-age
 - In-process reconciliation and optional DBOS durable workflows.
 - Self-hosted or delegated OAuth for remote MCP access.
 - Prometheus metrics and provisioned Grafana dashboards for local operations.
-- Portable production images, a Compose/Caddy boundary, and a GCP control-plane
-  Terraform reference.
+- Portable production images, a Compose/Caddy boundary, and a GKE Autopilot
+  Terraform reference deployment.
 
 This project is under active development. Run the
-[release verification](docs/release-verification.md) checks and review the
-[security deployment guide](docs/security-deployment.md) before production use.
+[release verification](https://github.com/wardby/wardby/blob/main/docs/release-verification.md) checks and review the
+[security deployment guide](https://github.com/wardby/wardby/blob/main/docs/security-deployment.md) before production use.
 
 ## Repository map
 
@@ -273,10 +285,10 @@ docs/           Architecture, security, setup, and operator guidance
 
 ## License
 
-Apache License 2.0. See [LICENSE](LICENSE) for the license terms and
-[NOTICE](NOTICE) for attribution.
+Apache License 2.0. See [LICENSE](https://github.com/wardby/wardby/blob/main/LICENSE) for the license terms and
+[NOTICE](https://github.com/wardby/wardby/blob/main/NOTICE) for attribution.
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) to contribute and [SECURITY.md](SECURITY.md)
+See [CONTRIBUTING.md](https://github.com/wardby/wardby/blob/main/CONTRIBUTING.md) to contribute and [SECURITY.md](https://github.com/wardby/wardby/blob/main/SECURITY.md)
 to report a vulnerability privately.
 
-Built as an independent reimplementation. See [CLEANROOM.md](CLEANROOM.md).
+Built as an independent reimplementation. See [CLEANROOM.md](https://github.com/wardby/wardby/blob/main/CLEANROOM.md).

package/deploy/local/docker-compose.yml

@@ -2,15 +2,15 @@ services:
   postgres:
     image: postgres:16-alpine
     environment:
-      POSTGRES_USER: wardby
-      POSTGRES_PASSWORD: wardby
-      POSTGRES_DB: wardby
+      POSTGRES_USER: ${WARDBY_POSTGRES_USER:-wardby}
+      POSTGRES_PASSWORD: ${WARDBY_POSTGRES_PASSWORD:-wardby}
+      POSTGRES_DB: ${WARDBY_POSTGRES_DB:-wardby}
     ports:
-      - "55432:5432"
+      - "${WARDBY_POSTGRES_PORT:-55432}:5432"
     volumes:
       - wardby-postgres-data:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U wardby -d wardby"]
+      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
       interval: 5s
       timeout: 5s
       retries: 12

package/dist/cli-help.d.ts

@@ -1 +1 @@
-export declare const CLI_USAGE = "usage:\n  wardby agent create --name <n> --model <m> --prompt <p> --budget <usd> [--schedule \"<cron>\"] [--timezone <tz>] [--max-turns <n>]\n  wardby agent list\n  wardby agent schedule <name> --cron \"<expr>\" [--timezone <tz>] [--disable]\n  wardby tool create --name <n> --description <d> --params <file> --code <file>\n  wardby tool attach <tool-name> <agent-name>\n  wardby tool detach <tool-name> <agent-name>\n  wardby tool list [--agent <name>]\n  wardby run <name>\n  wardby runs [--agent <name>] [--limit N] [--status <s>]\n  wardby coding preflight   (JOB_LAUNCHER=docker or kubernetes)\n  wardby coding cleanup --run-id <id>\n  wardby scheduler [--scope default]\n  wardby mcp   (MCP_TRANSPORT=stdio|http selects the transport)\n  wardby serve [--scope default]   (mcp + scheduler + reconciler in one process; http only)\n  wardby import <bundle-dir> --owner <subject> [--public] [--include-secrets --transfer-key <pem>] [--default-budget <usd>] [--dry-run] [--prefix <p>] [--on-conflict fail|skip|rename] [--allow-open-fetch]\n\noptions:\n  -h, --help       Show this help\n  -v, --version    Show the installed Wardby version";
+export declare const CLI_USAGE = "usage:\n  wardby quickstart [--provider openai|anthropic] [--model <m>] [--budget <usd>] [--client none|codex|claude|both] [--skip-demo] [--non-interactive --yes]\n  wardby doctor\n  wardby status\n  wardby logs [--tail N] [--follow]\n  wardby down [--volumes]\n  wardby agent create --name <n> --model <m> --prompt <p> --budget <usd> [--schedule \"<cron>\"] [--timezone <tz>] [--max-turns <n>]\n  wardby agent list\n  wardby agent schedule <name> --cron \"<expr>\" [--timezone <tz>] [--disable]\n  wardby tool create --name <n> --description <d> --params <file> --code <file>\n  wardby tool attach <tool-name> <agent-name>\n  wardby tool detach <tool-name> <agent-name>\n  wardby tool list [--agent <name>]\n  wardby run <name>\n  wardby runs [--agent <name>] [--limit N] [--status <s>]\n  wardby coding preflight   (JOB_LAUNCHER=docker or kubernetes)\n  wardby coding cleanup --run-id <id>\n  wardby scheduler [--scope default]\n  wardby mcp   (MCP_TRANSPORT=stdio|http selects the transport)\n  wardby serve [--scope default]   (mcp + scheduler + reconciler in one process; http only)\n  wardby import <bundle-dir> --owner <subject> [--public] [--include-secrets --transfer-key <pem>] [--default-budget <usd>] [--dry-run] [--prefix <p>] [--on-conflict fail|skip|rename] [--allow-open-fetch]\n\noptions:\n  -h, --help       Show this help\n  -v, --version    Show the installed Wardby version";

package/dist/cli-help.js

@@ -1,4 +1,9 @@
 export const CLI_USAGE = `usage:
+  wardby quickstart [--provider openai|anthropic] [--model <m>] [--budget <usd>] [--client none|codex|claude|both] [--skip-demo] [--non-interactive --yes]
+  wardby doctor
+  wardby status
+  wardby logs [--tail N] [--follow]
+  wardby down [--volumes]
   wardby agent create --name <n> --model <m> --prompt <p> --budget <usd> [--schedule "<cron>"] [--timezone <tz>] [--max-turns <n>]
   wardby agent list
   wardby agent schedule <name> --cron "<expr>" [--timezone <tz>] [--disable]

package/dist/env.js

@@ -10,4 +10,11 @@
  */
 import "./core/http-runtime.js";
 import dotenvFlow from "dotenv-flow";
-dotenvFlow.config();
+import { join, resolve } from "node:path";
+const projectDir = resolve(process.env.WARDBY_PROJECT_DIR || process.cwd());
+// A quickstart installation owns this directory, so load it before an
+// application's root env files. dotenv-flow never overwrites an existing
+// process variable, preserving explicit shell/container configuration as the
+// highest-priority source in either mode.
+dotenvFlow.config({ path: join(projectDir, ".wardby"), silent: true });
+dotenvFlow.config({ path: projectDir });

package/dist/quickstart/config.d.ts

@@ -0,0 +1,30 @@
+export type QuickstartProvider = "openai" | "anthropic";
+export type McpClient = "none" | "codex" | "claude" | "both";
+export interface QuickstartState {
+    version: 1;
+    projectDir: string;
+    composeProject: string;
+    postgresPort: number;
+    provider: QuickstartProvider;
+    model: string;
+    packageVersion: string;
+    createdAt: string;
+}
+export interface QuickstartPaths {
+    projectDir: string;
+    wardbyDir: string;
+    envFile: string;
+    stateFile: string;
+}
+export declare function resolveProjectDir(cwd?: string, env?: NodeJS.ProcessEnv): string;
+export declare function quickstartPaths(projectDir: string): QuickstartPaths;
+export declare function composeProjectName(projectDir: string): string;
+export declare function parseEnvFile(contents: string): Record<string, string>;
+export declare function readQuickstartEnv(paths: QuickstartPaths): Record<string, string>;
+export declare function writeQuickstartEnv(paths: QuickstartPaths, values: Record<string, string>): void;
+export declare function readQuickstartState(paths: QuickstartPaths): QuickstartState | undefined;
+export declare function writeQuickstartState(paths: QuickstartPaths, state: QuickstartState): void;
+export declare function generatedSecret(): string;
+export declare function ensureWardbyIgnored(projectDir: string): void;
+export declare function defaultModel(provider: QuickstartProvider): string;
+export declare function providerKeyName(provider: QuickstartProvider): "OPENAI_API_KEY" | "ANTHROPIC_API_KEY";

package/dist/quickstart/config.js

@@ -0,0 +1,106 @@
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+export function resolveProjectDir(cwd = process.cwd(), env = process.env) {
+    return resolve(env.WARDBY_PROJECT_DIR || cwd);
+}
+export function quickstartPaths(projectDir) {
+    const wardbyDir = join(projectDir, ".wardby");
+    return {
+        projectDir,
+        wardbyDir,
+        envFile: join(wardbyDir, ".env"),
+        stateFile: join(wardbyDir, "state.json"),
+    };
+}
+export function composeProjectName(projectDir) {
+    const slug = basename(projectDir)
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 30);
+    const digest = createHash("sha256").update(resolve(projectDir)).digest("hex").slice(0, 10);
+    return `wardby-${slug || "project"}-${digest}`;
+}
+export function parseEnvFile(contents) {
+    const values = {};
+    for (const rawLine of contents.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const equals = line.indexOf("=");
+        if (equals <= 0)
+            continue;
+        const key = line.slice(0, equals).trim();
+        const rawValue = line.slice(equals + 1).trim();
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            continue;
+        if (rawValue.startsWith('"') && rawValue.endsWith('"')) {
+            try {
+                values[key] = JSON.parse(rawValue);
+                continue;
+            }
+            catch {
+                // Preserve malformed quoted values verbatim so setup never destroys them.
+            }
+        }
+        values[key] = rawValue.startsWith("'") && rawValue.endsWith("'") ? rawValue.slice(1, -1) : rawValue;
+    }
+    return values;
+}
+export function readQuickstartEnv(paths) {
+    if (!existsSync(paths.envFile))
+        return {};
+    return parseEnvFile(readFileSync(paths.envFile, "utf8"));
+}
+export function writeQuickstartEnv(paths, values) {
+    mkdirSync(paths.wardbyDir, { recursive: true, mode: 0o700 });
+    const heading = [
+        "# Managed by `wardby quickstart`.",
+        "# Keep this file private; it contains local credentials and encryption keys.",
+    ];
+    const lines = Object.entries(values)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, value]) => `${key}=${JSON.stringify(value)}`);
+    writeFileSync(paths.envFile, `${[...heading, ...lines].join("\n")}\n`, { mode: 0o600 });
+    chmodSync(paths.wardbyDir, 0o700);
+    chmodSync(paths.envFile, 0o600);
+}
+export function readQuickstartState(paths) {
+    if (!existsSync(paths.stateFile))
+        return undefined;
+    const value = JSON.parse(readFileSync(paths.stateFile, "utf8"));
+    if (value.version !== 1 ||
+        typeof value.projectDir !== "string" ||
+        typeof value.composeProject !== "string" ||
+        typeof value.postgresPort !== "number" ||
+        (value.provider !== "openai" && value.provider !== "anthropic") ||
+        typeof value.model !== "string" ||
+        typeof value.packageVersion !== "string" ||
+        typeof value.createdAt !== "string") {
+        throw new Error(`invalid Wardby quickstart state: ${paths.stateFile}`);
+    }
+    return value;
+}
+export function writeQuickstartState(paths, state) {
+    mkdirSync(paths.wardbyDir, { recursive: true, mode: 0o700 });
+    writeFileSync(paths.stateFile, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(paths.stateFile, 0o600);
+}
+export function generatedSecret() {
+    return randomBytes(32).toString("hex");
+}
+export function ensureWardbyIgnored(projectDir) {
+    const gitignore = join(projectDir, ".gitignore");
+    const existing = existsSync(gitignore) ? readFileSync(gitignore, "utf8") : "";
+    if (existing.split(/\r?\n/).some((line) => line.trim() === ".wardby/"))
+        return;
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    writeFileSync(gitignore, `${existing}${prefix}\n# Wardby local runtime and credentials\n.wardby/\n`);
+}
+export function defaultModel(provider) {
+    return provider === "openai" ? "gpt-5.6-luna" : "claude-haiku-4-5";
+}
+export function providerKeyName(provider) {
+    return provider === "openai" ? "OPENAI_API_KEY" : "ANTHROPIC_API_KEY";
+}

package/dist/quickstart/index.d.ts

@@ -0,0 +1,5 @@
+export declare function quickstartCommand(args: string[]): Promise<void>;
+export declare function doctorCommand(args: string[]): Promise<void>;
+export declare function statusCommand(args: string[]): Promise<void>;
+export declare function logsCommand(args: string[]): Promise<void>;
+export declare function downCommand(args: string[]): Promise<void>;

package/dist/quickstart/index.js

@@ -0,0 +1,536 @@
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { createServer } from "node:net";
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import { createInterface } from "node:readline/promises";
+import { composeProjectName, defaultModel, ensureWardbyIgnored, generatedSecret, providerKeyName, quickstartPaths, readQuickstartEnv, readQuickstartState, resolveProjectDir, writeQuickstartEnv, writeQuickstartState, } from "./config.js";
+const packageRoot = fileURLToPath(new URL("../../", import.meta.url));
+const composeFile = join(packageRoot, "deploy/local/docker-compose.yml");
+const schemaFile = join(packageRoot, "prisma/schema.prisma");
+const wardbyBin = join(packageRoot, "bin/wardby.js");
+const packageJson = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"));
+const require = createRequire(import.meta.url);
+const DEMO_AGENT = "hello-wardby";
+const DEMO_PROMPT = "You are the Wardby quickstart agent. Reply with a short greeting, then explain in one sentence that Wardby admitted this run against an explicit maximum budget. Do not call tools.";
+function runCommand(command, args, options = {}) {
+    const spawnOptions = {
+        cwd: options.cwd,
+        env: options.env,
+        encoding: "utf8",
+        stdio: options.inherit ? "inherit" : "pipe",
+    };
+    const result = spawnSync(command, args, spawnOptions);
+    if (result.error) {
+        return { status: 1, stdout: result.stdout ?? "", stderr: result.error.message };
+    }
+    return { status: result.status ?? 1, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+}
+function commandFailure(label, result) {
+    const detail = (result.stderr || result.stdout).trim();
+    throw new Error(`${label} failed${detail ? `: ${detail}` : ""}`);
+}
+function runtimeEnv(paths, values = readQuickstartEnv(paths)) {
+    return { ...process.env, ...values, WARDBY_PROJECT_DIR: paths.projectDir };
+}
+function composeArgs(paths, state, args) {
+    return [
+        "compose",
+        "--project-name",
+        state.composeProject,
+        "--env-file",
+        paths.envFile,
+        "--file",
+        composeFile,
+        ...args,
+    ];
+}
+function runCompose(paths, state, args, options = {}) {
+    return runCommand("docker", composeArgs(paths, state, args), {
+        cwd: paths.projectDir,
+        env: runtimeEnv(paths),
+        inherit: options.inherit,
+    });
+}
+function nodeMajor() {
+    return Number(process.versions.node.split(".")[0]);
+}
+function assertPrerequisites() {
+    if (nodeMajor() < 24)
+        throw new Error(`Node.js 24 or newer is required; found ${process.versions.node}.`);
+    const docker = runCommand("docker", ["--version"]);
+    if (docker.status !== 0)
+        throw new Error("Docker is not installed or is not on PATH.");
+    const compose = runCommand("docker", ["compose", "version"]);
+    if (compose.status !== 0)
+        throw new Error("Docker Compose v2 is required (`docker compose`).");
+    const daemon = runCommand("docker", ["info"]);
+    if (daemon.status !== 0)
+        throw new Error("Docker is installed but its daemon is not available.");
+}
+async function portAvailable(port) {
+    return await new Promise((resolve) => {
+        const server = createServer();
+        server.unref();
+        server.once("error", () => resolve(false));
+        server.listen({ host: "0.0.0.0", port }, () => server.close(() => resolve(true)));
+    });
+}
+async function selectPostgresPort(firstPort = 55432) {
+    for (let port = firstPort; port <= 55532; port += 1) {
+        if (await portAvailable(port))
+            return port;
+    }
+    throw new Error("No available local port was found between 55432 and 55532.");
+}
+async function startPostgres(paths, state, config) {
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+        const up = runCompose(paths, state, ["up", "--detach", "--wait", "--wait-timeout", "90"]);
+        if (up.status === 0)
+            return;
+        const output = `${up.stderr}\n${up.stdout}`;
+        if (!/port is already allocated|address already in use|bind for .* failed/i.test(output)) {
+            commandFailure("PostgreSQL startup", up);
+        }
+        // Docker Desktop's port forwarder is not always visible to a host socket
+        // probe. Clean up the failed container and converge on the next port.
+        runCompose(paths, state, ["down"]);
+        state.postgresPort = await selectPostgresPort(state.postgresPort + 1);
+        config.WARDBY_POSTGRES_PORT = String(state.postgresPort);
+        config.DATABASE_URL = databaseUrl(config, state.postgresPort);
+        writeQuickstartEnv(paths, config);
+        writeQuickstartState(paths, state);
+        console.log(`! Port was occupied; retrying PostgreSQL on ${state.postgresPort}`);
+    }
+    throw new Error("PostgreSQL startup could not find a usable port after 10 attempts.");
+}
+function databaseUrl(config, port) {
+    const user = encodeURIComponent(config.WARDBY_POSTGRES_USER);
+    const password = encodeURIComponent(config.WARDBY_POSTGRES_PASSWORD);
+    const database = encodeURIComponent(config.WARDBY_POSTGRES_DB);
+    return `postgresql://${user}:${password}@127.0.0.1:${port}/${database}`;
+}
+async function promptLine(question, fallback) {
+    const terminal = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await terminal.question(question)).trim();
+        return answer || fallback || "";
+    }
+    finally {
+        terminal.close();
+    }
+}
+async function promptYesNo(question, defaultYes) {
+    const suffix = defaultYes ? " [Y/n] " : " [y/N] ";
+    const answer = (await promptLine(`${question}${suffix}`)).toLowerCase();
+    if (!answer)
+        return defaultYes;
+    return answer === "y" || answer === "yes";
+}
+async function promptSecret(question) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY || !process.stdin.setRawMode) {
+        throw new Error("A provider key is required in the environment when stdin is not an interactive terminal.");
+    }
+    process.stdout.write(question);
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    return await new Promise((resolve, reject) => {
+        let value = "";
+        const finish = (error) => {
+            process.stdin.off("data", onData);
+            process.stdin.setRawMode(false);
+            process.stdin.pause();
+            process.stdout.write("\n");
+            if (error)
+                reject(error);
+            else
+                resolve(value);
+        };
+        const onData = (chunk) => {
+            for (const character of chunk) {
+                if (character === "\u0003")
+                    return finish(new Error("cancelled"));
+                if (character === "\r" || character === "\n")
+                    return finish();
+                if (character === "\u007f" || character === "\b")
+                    value = value.slice(0, -1);
+                else if (character >= " ")
+                    value += character;
+            }
+        };
+        process.stdin.on("data", onData);
+    });
+}
+function parseProvider(value) {
+    if (value === undefined)
+        return undefined;
+    if (value !== "openai" && value !== "anthropic") {
+        throw new Error(`--provider must be openai or anthropic; got "${value}".`);
+    }
+    return value;
+}
+function parseClient(value) {
+    if (value === undefined)
+        return undefined;
+    if (!["none", "codex", "claude", "both"].includes(value)) {
+        throw new Error(`--client must be none, codex, claude, or both; got "${value}".`);
+    }
+    return value;
+}
+async function chooseProvider(requested, previous, existing, nonInteractive) {
+    if (requested)
+        return requested;
+    if (previous)
+        return previous.provider;
+    if (existing.LLM_PROVIDER === "openai" || existing.LLM_PROVIDER === "anthropic")
+        return existing.LLM_PROVIDER;
+    if (process.env.OPENAI_API_KEY || existing.OPENAI_API_KEY)
+        return "openai";
+    if (process.env.ANTHROPIC_API_KEY || existing.ANTHROPIC_API_KEY)
+        return "anthropic";
+    if (nonInteractive)
+        throw new Error("--provider is required in non-interactive mode.");
+    const answer = (await promptLine("Model provider: [1] OpenAI, [2] Anthropic [1] ", "1")).toLowerCase();
+    if (answer === "1" || answer === "openai")
+        return "openai";
+    if (answer === "2" || answer === "anthropic")
+        return "anthropic";
+    throw new Error(`Unknown provider selection "${answer}".`);
+}
+function prismaCliPath() {
+    return require.resolve("prisma/build/index.js");
+}
+function applyMigrations(paths) {
+    const result = runCommand(process.execPath, [prismaCliPath(), "migrate", "deploy", "--schema", schemaFile], {
+        cwd: paths.projectDir,
+        env: runtimeEnv(paths),
+    });
+    if (result.status !== 0)
+        commandFailure("Database migration", result);
+}
+async function seedDemo(paths, state, budget) {
+    const previousDatabaseUrl = process.env.DATABASE_URL;
+    process.env.DATABASE_URL = readQuickstartEnv(paths).DATABASE_URL;
+    const { PrismaClient } = await import("@prisma/client");
+    const db = new PrismaClient();
+    try {
+        const existing = await db.agent.findUnique({ where: { name: DEMO_AGENT } });
+        if (existing && existing.systemPrompt !== DEMO_PROMPT) {
+            throw new Error(`An agent named "${DEMO_AGENT}" already exists and was not created by quickstart; rename it or use --skip-demo.`);
+        }
+        if (existing) {
+            await db.agent.update({
+                where: { name: DEMO_AGENT },
+                data: { model: state.model, budgetUsd: budget, maxTurns: 2 },
+            });
+        }
+        else {
+            await db.agent.create({
+                data: {
+                    name: DEMO_AGENT,
+                    model: state.model,
+                    budgetUsd: budget,
+                    maxTurns: 2,
+                    systemPrompt: DEMO_PROMPT,
+                },
+            });
+        }
+    }
+    finally {
+        await db.$disconnect();
+        if (previousDatabaseUrl === undefined)
+            delete process.env.DATABASE_URL;
+        else
+            process.env.DATABASE_URL = previousDatabaseUrl;
+    }
+}
+function runDemo(paths) {
+    const result = runCommand(process.execPath, [wardbyBin, "run", DEMO_AGENT], {
+        cwd: paths.projectDir,
+        env: runtimeEnv(paths),
+        inherit: true,
+    });
+    if (result.status !== 0)
+        throw new Error("The sample agent run failed; run `wardby doctor` for diagnostics.");
+}
+function clientInstalled(command) {
+    return runCommand(command, ["--version"]).status === 0;
+}
+function configureOneMcpClient(client, paths) {
+    if (!clientInstalled(client)) {
+        console.warn(`! ${client} is not installed; skipped its MCP configuration.`);
+        return;
+    }
+    const existing = runCommand(client, ["mcp", "get", "wardby"], { cwd: paths.projectDir });
+    if (existing.status === 0) {
+        console.log(`✓ ${client} already has an MCP server named wardby.`);
+        return;
+    }
+    const packageSpec = `@wardby/cli@${packageJson.version}`;
+    const args = client === "codex"
+        ? [
+            "mcp",
+            "add",
+            "--env",
+            `WARDBY_PROJECT_DIR=${paths.projectDir}`,
+            "wardby",
+            "--",
+            "npx",
+            "--yes",
+            packageSpec,
+            "mcp",
+        ]
+        : [
+            "mcp",
+            "add",
+            "--scope",
+            "local",
+            "-e",
+            `WARDBY_PROJECT_DIR=${paths.projectDir}`,
+            "wardby",
+            "--",
+            "npx",
+            "--yes",
+            packageSpec,
+            "mcp",
+        ];
+    const result = runCommand(client, args, { cwd: paths.projectDir });
+    if (result.status !== 0)
+        commandFailure(`${client} MCP configuration`, result);
+    console.log(`✓ Configured Wardby MCP for ${client}.`);
+}
+function configureMcpClients(client, paths) {
+    if (client === "codex" || client === "both")
+        configureOneMcpClient("codex", paths);
+    if (client === "claude" || client === "both")
+        configureOneMcpClient("claude", paths);
+}
+async function chooseClient(nonInteractive) {
+    if (nonInteractive)
+        return "none";
+    const answer = (await promptLine("Configure MCP: [n]one, [c]odex, c[l]aude, [b]oth [n] ", "n")).toLowerCase();
+    if (answer === "" || answer === "n" || answer === "none")
+        return "none";
+    if (answer === "c" || answer === "codex")
+        return "codex";
+    if (answer === "l" || answer === "claude")
+        return "claude";
+    if (answer === "b" || answer === "both")
+        return "both";
+    throw new Error(`Unknown MCP client selection "${answer}".`);
+}
+export async function quickstartCommand(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            provider: { type: "string" },
+            model: { type: "string" },
+            budget: { type: "string" },
+            client: { type: "string" },
+            "non-interactive": { type: "boolean" },
+            "skip-demo": { type: "boolean" },
+            yes: { type: "boolean", short: "y" },
+        },
+    });
+    const nonInteractive = values["non-interactive"] ?? false;
+    const skipDemo = values["skip-demo"] ?? false;
+    const budget = values.budget === undefined ? 1 : Number(values.budget);
+    if (!Number.isFinite(budget) || budget <= 0)
+        throw new Error(`--budget must be positive; got "${values.budget}".`);
+    if (nonInteractive && !skipDemo && !values.yes) {
+        throw new Error("Non-interactive demo execution requires --yes because it may incur provider charges.");
+    }
+    console.log("Wardby quickstart\n");
+    assertPrerequisites();
+    console.log(`✓ Node.js ${process.versions.node}`);
+    console.log("✓ Docker and Docker Compose are available");
+    const projectDir = resolveProjectDir();
+    const paths = quickstartPaths(projectDir);
+    const previous = readQuickstartState(paths);
+    const existing = readQuickstartEnv(paths);
+    const provider = await chooseProvider(parseProvider(values.provider), previous, existing, nonInteractive);
+    const model = values.model ?? (previous?.provider === provider ? previous.model : defaultModel(provider));
+    const keyName = providerKeyName(provider);
+    let providerKey = process.env[keyName] || existing[keyName];
+    if (!providerKey && !skipDemo) {
+        if (nonInteractive)
+            throw new Error(`${keyName} is required in non-interactive mode unless --skip-demo is used.`);
+        providerKey = await promptSecret(`${keyName}: `);
+        if (!providerKey)
+            throw new Error(`${keyName} cannot be empty.`);
+    }
+    const postgresPort = previous?.postgresPort ?? (await selectPostgresPort());
+    const postgresUser = existing.WARDBY_POSTGRES_USER || "wardby";
+    const postgresDatabase = existing.WARDBY_POSTGRES_DB || "wardby";
+    const postgresPassword = existing.WARDBY_POSTGRES_PASSWORD || generatedSecret();
+    const config = {
+        ...existing,
+        LLM_PROVIDER: provider,
+        LOCAL_PRINCIPAL: existing.LOCAL_PRINCIPAL || "local",
+        MCP_TRANSPORT: "stdio",
+        SECRET_APP_KEY: existing.SECRET_APP_KEY || generatedSecret(),
+        WARDBY_POSTGRES_DB: postgresDatabase,
+        WARDBY_POSTGRES_PASSWORD: postgresPassword,
+        WARDBY_POSTGRES_PORT: String(postgresPort),
+        WARDBY_POSTGRES_USER: postgresUser,
+    };
+    config.DATABASE_URL = databaseUrl(config, postgresPort);
+    if (providerKey)
+        config[keyName] = providerKey;
+    ensureWardbyIgnored(projectDir);
+    writeQuickstartEnv(paths, config);
+    const state = {
+        version: 1,
+        projectDir,
+        composeProject: previous?.composeProject ?? composeProjectName(projectDir),
+        postgresPort,
+        provider,
+        model,
+        packageVersion: packageJson.version,
+        createdAt: previous?.createdAt ?? new Date().toISOString(),
+    };
+    writeQuickstartState(paths, state);
+    console.log(`✓ Configuration ready in ${paths.wardbyDir}`);
+    await startPostgres(paths, state, config);
+    console.log(`✓ PostgreSQL is healthy on 127.0.0.1:${state.postgresPort}`);
+    applyMigrations(paths);
+    console.log("✓ Database migrations applied");
+    if (!skipDemo) {
+        await seedDemo(paths, state, budget);
+        console.log(`✓ Sample agent "${DEMO_AGENT}" is ready`);
+        const approved = values.yes || (await promptYesNo(`Run it now with a maximum budget of $${budget.toFixed(2)}?`, true));
+        if (approved)
+            runDemo(paths);
+        else
+            console.log(`Skipped the billed run. Start it later with: npx @wardby/cli@latest run ${DEMO_AGENT}`);
+    }
+    const client = parseClient(values.client) ?? (await chooseClient(nonInteractive));
+    if (client !== "none")
+        configureMcpClients(client, paths);
+    console.log("\nWardby is ready.");
+    console.log("  npx @wardby/cli@latest status");
+    console.log("  npx @wardby/cli@latest doctor");
+    console.log("  npx @wardby/cli@latest down");
+}
+async function databaseHealthy(paths) {
+    const env = readQuickstartEnv(paths);
+    if (!env.DATABASE_URL)
+        return false;
+    const previous = process.env.DATABASE_URL;
+    process.env.DATABASE_URL = env.DATABASE_URL;
+    const { PrismaClient } = await import("@prisma/client");
+    const db = new PrismaClient();
+    try {
+        await db.$queryRawUnsafe("SELECT 1");
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        await db.$disconnect();
+        if (previous === undefined)
+            delete process.env.DATABASE_URL;
+        else
+            process.env.DATABASE_URL = previous;
+    }
+}
+export async function doctorCommand(args) {
+    parseArgs({ args, options: {} });
+    const paths = quickstartPaths(resolveProjectDir());
+    const checks = [];
+    checks.push(["Node.js 24 or newer", nodeMajor() >= 24, process.versions.node]);
+    checks.push(["Docker CLI", runCommand("docker", ["--version"]).status === 0]);
+    checks.push(["Docker Compose v2", runCommand("docker", ["compose", "version"]).status === 0]);
+    checks.push(["Docker daemon", runCommand("docker", ["info"]).status === 0]);
+    let state;
+    try {
+        state = readQuickstartState(paths);
+        checks.push(["Quickstart state", state !== undefined, paths.stateFile]);
+    }
+    catch (error) {
+        checks.push(["Quickstart state", false, error instanceof Error ? error.message : String(error)]);
+    }
+    const env = readQuickstartEnv(paths);
+    const key = state ? providerKeyName(state.provider) : undefined;
+    checks.push(["Private configuration", Object.keys(env).length > 0, paths.envFile]);
+    if (Object.keys(env).length > 0) {
+        const mode = statSync(paths.envFile).mode & 0o777;
+        checks.push(["Configuration permissions", (mode & 0o077) === 0, mode.toString(8)]);
+        checks.push(["Secret encryption key", /^[a-f0-9]{64}$/i.test(env.SECRET_APP_KEY ?? "")]);
+        if (key)
+            checks.push([`${key} configured`, Boolean(env[key] || process.env[key])]);
+    }
+    if (state) {
+        const ps = runCompose(paths, state, ["ps", "--status", "running", "--quiet"]);
+        checks.push(["PostgreSQL container", ps.status === 0 && ps.stdout.trim().length > 0]);
+        checks.push(["Database connection", await databaseHealthy(paths)]);
+        const migrations = runCommand(process.execPath, [prismaCliPath(), "migrate", "status", "--schema", schemaFile], {
+            cwd: paths.projectDir,
+            env: runtimeEnv(paths),
+        });
+        checks.push(["Database migrations", migrations.status === 0]);
+    }
+    let failed = false;
+    for (const [name, ok, detail] of checks) {
+        failed ||= !ok;
+        console.log(`${ok ? "✓" : "✗"} ${name}${detail ? ` (${detail})` : ""}`);
+    }
+    if (failed)
+        process.exitCode = 1;
+}
+export async function statusCommand(args) {
+    parseArgs({ args, options: {} });
+    const paths = quickstartPaths(resolveProjectDir());
+    const state = readQuickstartState(paths);
+    if (!state)
+        throw new Error(`Wardby is not initialized in ${paths.projectDir}; run \`wardby quickstart\`.`);
+    console.log(`project: ${state.projectDir}`);
+    console.log(`version: ${state.packageVersion}`);
+    console.log(`provider/model: ${state.provider} / ${state.model}`);
+    console.log(`postgres: 127.0.0.1:${state.postgresPort}`);
+    const ps = runCompose(paths, state, ["ps"]);
+    if (ps.status !== 0)
+        commandFailure("Docker Compose status", ps);
+    process.stdout.write(ps.stdout);
+    const healthy = await databaseHealthy(paths);
+    console.log(`database: ${healthy ? "healthy" : "unavailable"}`);
+    if (!healthy)
+        process.exitCode = 1;
+}
+export async function logsCommand(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            follow: { type: "boolean", short: "f" },
+            tail: { type: "string" },
+        },
+    });
+    const paths = quickstartPaths(resolveProjectDir());
+    const state = readQuickstartState(paths);
+    if (!state)
+        throw new Error(`Wardby is not initialized in ${paths.projectDir}; run \`wardby quickstart\`.`);
+    const composeLogArgs = ["logs", "--tail", values.tail ?? "100"];
+    if (values.follow)
+        composeLogArgs.push("--follow");
+    const result = runCompose(paths, state, composeLogArgs, { inherit: true });
+    if (result.status !== 0)
+        throw new Error("Docker Compose logs failed.");
+}
+export async function downCommand(args) {
+    const { values } = parseArgs({ args, options: { volumes: { type: "boolean" } } });
+    const paths = quickstartPaths(resolveProjectDir());
+    const state = readQuickstartState(paths);
+    if (!state)
+        throw new Error(`Wardby is not initialized in ${paths.projectDir}; nothing to stop.`);
+    const composeDownArgs = ["down"];
+    if (values.volumes)
+        composeDownArgs.push("--volumes");
+    const result = runCompose(paths, state, composeDownArgs, { inherit: true });
+    if (result.status !== 0)
+        throw new Error("Docker Compose shutdown failed.");
+    console.log(values.volumes ? "Wardby stopped and its local database volume was removed." : "Wardby stopped; data retained.");
+}

package/dist/wardby-bin.js

@@ -8,13 +8,39 @@ function packageVersion() {
     }
     return packageJson.version;
 }
-const command = process.argv[2];
-if (command === undefined || command === "--help" || command === "-h") {
-    process.stdout.write(`${CLI_USAGE}\n`);
-}
-else if (command === "--version" || command === "-v") {
-    process.stdout.write(`${packageVersion()}\n`);
-}
-else {
-    await import("./cli.js");
+async function main() {
+    const command = process.argv[2];
+    if (command === undefined || command === "--help" || command === "-h") {
+        process.stdout.write(`${CLI_USAGE}\n`);
+    }
+    else if (command === "--version" || command === "-v") {
+        process.stdout.write(`${packageVersion()}\n`);
+    }
+    else if (command === "quickstart") {
+        const { quickstartCommand } = await import("./quickstart/index.js");
+        await quickstartCommand(process.argv.slice(3));
+    }
+    else if (command === "doctor") {
+        const { doctorCommand } = await import("./quickstart/index.js");
+        await doctorCommand(process.argv.slice(3));
+    }
+    else if (command === "status") {
+        const { statusCommand } = await import("./quickstart/index.js");
+        await statusCommand(process.argv.slice(3));
+    }
+    else if (command === "logs") {
+        const { logsCommand } = await import("./quickstart/index.js");
+        await logsCommand(process.argv.slice(3));
+    }
+    else if (command === "down") {
+        const { downCommand } = await import("./quickstart/index.js");
+        await downCommand(process.argv.slice(3));
+    }
+    else {
+        await import("./cli.js");
+    }
 }
+main().catch((error) => {
+    console.error(`error: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wardby/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Self-hosted control plane for budget-guarded AI agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/wardby/wardby#readme",
@@ -119,5 +119,8 @@
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.69.0",
     "vitest": "^4.1.11"
+  },
+  "overrides": {
+    "deepmerge-ts": "8.0.2"
   }
 }

package/dist/providers/auth/release-gate.d.ts

@@ -1 +0,0 @@
-export declare function assertSelfHostedReleased(): void;

package/dist/providers/auth/release-gate.js

@@ -1,4 +0,0 @@
-// Remove only after the database, browser, migration, and independent review gates pass.
-export function assertSelfHostedReleased() {
-    throw new Error("Self-hosted OAuth issuance is quarantined pending the security release gates. Use delegating OAuth or stdio.");
-}