hikoutei 0.5.11 → 0.5.13

package/dist/cli/setupFlow.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Orchestration for `hikoutei setup`.
+ *
+ * `runSetup` is the pure-ish core of the CLI: it receives an injected gcloud
+ * runner and spreadsheet creator, drives the bootstrap sequence (preflight,
+ * project, API enable, service account, key, spreadsheet, .env), and returns
+ * an explicit result union. Nothing here reads process state; the thin entry
+ * in `setup.ts` resolves defaults and prints output. `--dry-run` builds the
+ * exact command plan without invoking the runner or touching the filesystem.
+ */
+import { type SetupErrorCode } from "./errors.js";
+import type { GcloudRunner } from "./gcloudRunner.js";
+import type { SpreadsheetCreator } from "./sheetsFactory.js";
+/** Default service-account key file name, resolved against the current directory. */
+export declare const DEFAULT_KEY_FILE_NAME = "hikoutei-service-account.json";
+/** Prefix of the default spreadsheet title (`hikoutei-sync-<project>`). */
+export declare const DEFAULT_SPREADSHEET_TITLE_PREFIX = "hikoutei-sync";
+/** Service-account key file permission after setup (owner read/write only). */
+export declare const KEY_FILE_MODE = 384;
+/** Options for one setup run; paths are absolute and resolved by the entry. */
+export interface RunSetupOptions {
+    readonly runner: GcloudRunner;
+    readonly createSpreadsheet: SpreadsheetCreator;
+    /** Existing project id, or undefined to create `hikoutei-<slug>`. */
+    readonly projectId: string | undefined;
+    readonly saName: string;
+    /** Spreadsheet title override; defaults to `hikoutei-sync-<project>`. */
+    readonly spreadsheetTitle: string | undefined;
+    /** Absolute service-account key path. */
+    readonly keyPath: string;
+    /** Absolute .env output path. */
+    readonly outputPath: string;
+    readonly dryRun: boolean;
+}
+/** One planned or executed step of the setup flow. */
+export type PlannedCommand = {
+    readonly kind: "gcloud";
+    readonly command: readonly string[];
+    readonly outcome: string;
+} | {
+    readonly kind: "api";
+    readonly label: string;
+    readonly outcome: string;
+} | {
+    readonly kind: "file";
+    readonly label: string;
+    readonly outcome: string;
+};
+/** Outcome summary returned for a successful (non-dry-run) setup. */
+export interface SetupSummary {
+    readonly projectId: string;
+    readonly serviceAccountEmail: string;
+    readonly keyPath: string;
+    readonly spreadsheetId: string;
+    readonly spreadsheetUrl: string;
+    readonly spreadsheetTitle: string;
+    readonly outputPath: string;
+    readonly envFileCreated: boolean;
+    readonly envFileModified: boolean;
+    readonly projectReused: boolean;
+    readonly serviceAccountReused: boolean;
+    readonly keyReused: boolean;
+}
+/** Discriminated result of a setup run. */
+export type SetupResult = {
+    readonly status: "ok";
+    readonly dryRun: false;
+    readonly summary: SetupSummary;
+    readonly commands: readonly PlannedCommand[];
+} | {
+    readonly status: "ok";
+    readonly dryRun: true;
+    readonly commands: readonly PlannedCommand[];
+} | {
+    readonly status: "error";
+    readonly code: SetupErrorCode;
+    readonly message: string;
+};
+/** Derives the service-account email for a name and project. */
+export declare function serviceAccountEmail(saName: string, projectId: string): string;
+/** Default spreadsheet title for a project. */
+export declare function defaultSpreadsheetTitle(projectId: string): string;
+/**
+ * Generates a `hikoutei-<timestamp>-<random>` project id.
+ *
+ * The timestamp base-36 component sorts lexically and the random suffix makes
+ * parallel runs collision-resistant; if the id already exists the flow reuses
+ * the project instead of failing.
+ */
+export declare function generateProjectId(now?: number, random?: () => number): string;
+/**
+ * Builds the exact command plan for a dry run.
+ *
+ * Pure: does not execute anything and does not touch the filesystem. Each
+ * step carries a simulated outcome so `--dry-run` previews both the fresh
+ * path and the reuse branches.
+ */
+export declare function planSetupCommands(options: RunSetupOptions, slug: string): readonly PlannedCommand[];
+/** Renders a plan or executed-command list for `--dry-run` output. */
+export declare function formatPlan(commands: readonly PlannedCommand[]): string;
+/** Renders the human summary; never includes key contents or secrets. */
+export declare function formatSummary(summary: SetupSummary): string;
+/**
+ * Runs the full setup bootstrap.
+ *
+ * In dry-run mode returns the command plan without invoking the runner or
+ * touching the filesystem. Otherwise the sequence is: preflight (gcloud
+ * present, active account), project verify/create, `config set project`,
+ * enable the Sheets API, service account list/create, key create (or reuse
+ * an existing key file) with chmod 600, spreadsheet creation through the
+ * injected creator, and finally the .env write. Every phase maps to a stable
+ * error code on failure; key material is never included in messages.
+ */
+export declare function runSetup(options: RunSetupOptions): Promise<SetupResult>;
+/** The two .env keys the setup CLI manages. */
+export declare const SETUP_ENV_KEYS: {
+    readonly CREDENTIALS: "GOOGLE_APPLICATION_CREDENTIALS";
+    readonly SPREADSHEET_URL: "HIKOUTEI_SYNC_SPREADSHEET_URL";
+};
+/** Result of writing the .env output file. */
+export interface EnvFileWriteResult {
+    /** True when the file did not exist before this write. */
+    readonly created: boolean;
+    /** True when the file content changed (created or keys added/updated). */
+    readonly modified: boolean;
+}
+/**
+ * Writes or updates the .env output file.
+ *
+ * Reads the existing file (if any), keeps every unrelated line untouched,
+ * replaces any existing managed key lines, appends the two managed keys, and
+ * writes back only when the content changed. A missing file is created.
+ * Throws on filesystem failure; the caller maps the throw to
+ * `output_write_failed`.
+ */
+export declare function writeSetupEnvFile(outputPath: string, credentialsPath: string, spreadsheetUrl: string): EnvFileWriteResult;
+//# sourceMappingURL=setupFlow.d.ts.map

package/dist/cli/setupFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupFlow.d.ts","sourceRoot":"","sources":["../../src/cli/setupFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAmB,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAA2B,MAAM,oBAAoB,CAAC;AAEtF,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,kCAAkC,CAAC;AAErE,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,kBAAkB,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,aAAa,MAAQ,CAAC;AAEnC,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAC/C,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,sDAAsD;AACtD,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF,qEAAqE;AACrE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,2CAA2C;AAC3C,MAAM,MAAM,WAAW,GACnB;IACA,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C,GACC;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,GAC9F;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAO1F,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,+CAA+C;AAC/C,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAmB,EAAE,MAAM,GAAE,MAAM,MAAoB,GAAG,MAAM,CAItG;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,cAAc,EAAE,CA8EnG;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAatE;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAe3D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CA0O7E;AAED,+CAA+C;AAC/C,eAAO,MAAM,cAAc;;;CAGjB,CAAC;AAEX,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AASD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,cAAc,EAAE,MAAM,GACrB,kBAAkB,CA6BpB"}

package/dist/cli/setupFlow.js

@@ -0,0 +1,443 @@
+/**
+ * Orchestration for `hikoutei setup`.
+ *
+ * `runSetup` is the pure-ish core of the CLI: it receives an injected gcloud
+ * runner and spreadsheet creator, drives the bootstrap sequence (preflight,
+ * project, API enable, service account, key, spreadsheet, .env), and returns
+ * an explicit result union. Nothing here reads process state; the thin entry
+ * in `setup.ts` resolves defaults and prints output. `--dry-run` builds the
+ * exact command plan without invoking the runner or touching the filesystem.
+ */
+import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { SETUP_ERROR_CODES } from "./errors.js";
+/** Default service-account key file name, resolved against the current directory. */
+export const DEFAULT_KEY_FILE_NAME = "hikoutei-service-account.json";
+/** Prefix of the default spreadsheet title (`hikoutei-sync-<project>`). */
+export const DEFAULT_SPREADSHEET_TITLE_PREFIX = "hikoutei-sync";
+/** Service-account key file permission after setup (owner read/write only). */
+export const KEY_FILE_MODE = 0o600;
+const AUTH_LIST_ARGS = ["auth", "list", "--filter=status:ACTIVE", "--format=value(account)"];
+/** gcloud error text that signals an already-existing project on create. */
+const PROJECT_ALREADY_EXISTS_MARKER = "already exists";
+/** Derives the service-account email for a name and project. */
+export function serviceAccountEmail(saName, projectId) {
+    return `${saName}@${projectId}.iam.gserviceaccount.com`;
+}
+/** Default spreadsheet title for a project. */
+export function defaultSpreadsheetTitle(projectId) {
+    return `${DEFAULT_SPREADSHEET_TITLE_PREFIX}-${projectId}`;
+}
+/**
+ * Generates a `hikoutei-<timestamp>-<random>` project id.
+ *
+ * The timestamp base-36 component sorts lexically and the random suffix makes
+ * parallel runs collision-resistant; if the id already exists the flow reuses
+ * the project instead of failing.
+ */
+export function generateProjectId(now = Date.now(), random = Math.random) {
+    const timestampPart = now.toString(36);
+    const randomPart = Math.floor(random() * 36 ** 4).toString(36).padStart(4, "0");
+    return `hikoutei-${timestampPart}-${randomPart}`;
+}
+/**
+ * Builds the exact command plan for a dry run.
+ *
+ * Pure: does not execute anything and does not touch the filesystem. Each
+ * step carries a simulated outcome so `--dry-run` previews both the fresh
+ * path and the reuse branches.
+ */
+export function planSetupCommands(options, slug) {
+    const projectId = options.projectId ?? slug;
+    const email = serviceAccountEmail(options.saName, projectId);
+    const title = options.spreadsheetTitle ?? defaultSpreadsheetTitle(projectId);
+    const commands = [
+        { kind: "gcloud", command: ["--version"], outcome: "gcloud is installed" },
+        { kind: "gcloud", command: [...AUTH_LIST_ARGS], outcome: "an active account is logged in" },
+    ];
+    if (options.projectId !== undefined) {
+        commands.push({
+            kind: "gcloud",
+            command: ["projects", "describe", options.projectId],
+            outcome: "project verified",
+        });
+    }
+    else {
+        commands.push({
+            kind: "gcloud",
+            command: ["projects", "create", slug],
+            outcome: "project created (reused when it already exists)",
+        });
+    }
+    commands.push({
+        kind: "gcloud",
+        command: ["config", "set", "project", projectId],
+        outcome: "default project selected",
+    }, {
+        kind: "gcloud",
+        command: ["services", "enable", "sheets.googleapis.com", "--project", projectId],
+        outcome: "Sheets API enabled (idempotent)",
+    }, {
+        kind: "gcloud",
+        command: ["iam", "service-accounts", "list", "--project", projectId, "--format=value(email)"],
+        outcome: "no matching service account; create follows",
+    }, {
+        kind: "gcloud",
+        command: [
+            "iam",
+            "service-accounts",
+            "create",
+            options.saName,
+            "--project",
+            projectId,
+            "--display-name",
+            "hikoutei setup",
+        ],
+        outcome: "service account created (reused when it already exists)",
+    }, {
+        kind: "gcloud",
+        command: [
+            "iam",
+            "service-accounts",
+            "keys",
+            "create",
+            options.keyPath,
+            "--iam-account",
+            email,
+            "--project",
+            projectId,
+        ],
+        outcome: `key written to ${options.keyPath} with mode 600 (reused when the file already exists)`,
+    }, {
+        kind: "api",
+        label: `spreadsheets.create (title "${title}") with the new service-account key`,
+        outcome: `spreadsheet owned by ${email}; no sharing step required`,
+    }, {
+        kind: "file",
+        label: `write ${options.outputPath}`,
+        outcome: "GOOGLE_APPLICATION_CREDENTIALS and HIKOUTEI_SYNC_SPREADSHEET_URL set; unrelated lines preserved",
+    });
+    return commands;
+}
+/** Renders a plan or executed-command list for `--dry-run` output. */
+export function formatPlan(commands) {
+    return commands
+        .map((step) => {
+        switch (step.kind) {
+            case "gcloud":
+                return `$ gcloud ${step.command.join(" ")}\n  # ${step.outcome}`;
+            case "api":
+                return `$ ${step.label}\n  # ${step.outcome}`;
+            case "file":
+                return `# ${step.label}: ${step.outcome}`;
+        }
+    })
+        .join("\n");
+}
+/** Renders the human summary; never includes key contents or secrets. */
+export function formatSummary(summary) {
+    const envState = summary.envFileCreated
+        ? "created"
+        : summary.envFileModified
+            ? "updated"
+            : "unchanged";
+    return [
+        "Hikoutei setup complete.",
+        `  project:              ${summary.projectId} (${summary.projectReused ? "reused" : "created"})`,
+        `  service account:      ${summary.serviceAccountEmail} (${summary.serviceAccountReused ? "reused" : "created"})`,
+        `  service account key:  ${summary.keyPath} (${summary.keyReused ? "reused" : "created"})`,
+        `  spreadsheet:          ${summary.spreadsheetTitle} (${summary.spreadsheetId})`,
+        `  spreadsheet URL:      ${summary.spreadsheetUrl}`,
+        `  env file:             ${summary.outputPath} (${envState})`,
+    ].join("\n");
+}
+/**
+ * Runs the full setup bootstrap.
+ *
+ * In dry-run mode returns the command plan without invoking the runner or
+ * touching the filesystem. Otherwise the sequence is: preflight (gcloud
+ * present, active account), project verify/create, `config set project`,
+ * enable the Sheets API, service account list/create, key create (or reuse
+ * an existing key file) with chmod 600, spreadsheet creation through the
+ * injected creator, and finally the .env write. Every phase maps to a stable
+ * error code on failure; key material is never included in messages.
+ */
+export async function runSetup(options) {
+    if (options.dryRun) {
+        return {
+            status: "ok",
+            dryRun: true,
+            commands: planSetupCommands(options, options.projectId ?? generateProjectId()),
+        };
+    }
+    const executed = [];
+    const { runner } = options;
+    // Preflight: gcloud must exist and an active account must be logged in.
+    const version = await runner.run(["--version"]);
+    executed.push({ kind: "gcloud", command: ["--version"], outcome: outcomeOf(version, "gcloud is installed") });
+    if (version.status === "not_found") {
+        return errorResult(SETUP_ERROR_CODES.GCLOUD_MISSING, "gcloud CLI was not found on PATH; install it from https://cloud.google.com/sdk and try again");
+    }
+    if (version.status === "failed") {
+        return errorResult(SETUP_ERROR_CODES.GCLOUD_MISSING, `gcloud --version failed: ${describeGcloudFailure(version)}`);
+    }
+    const auth = await runner.run([...AUTH_LIST_ARGS]);
+    executed.push({ kind: "gcloud", command: [...AUTH_LIST_ARGS], outcome: outcomeOf(auth, "active account found") });
+    if (auth.status !== "ok") {
+        return errorResult(SETUP_ERROR_CODES.GCLOUD_NOT_LOGGED_IN, `could not list active gcloud accounts: ${describeGcloudFailure(auth)}`);
+    }
+    if (auth.stdout.trim() === "") {
+        return errorResult(SETUP_ERROR_CODES.GCLOUD_NOT_LOGGED_IN, "no active gcloud account; run `gcloud auth login` first");
+    }
+    // Project: verify an explicit one, or create `hikoutei-<slug>` idempotently.
+    let projectId;
+    let projectReused = false;
+    if (options.projectId !== undefined) {
+        const describe = await runner.run(["projects", "describe", options.projectId]);
+        executed.push({
+            kind: "gcloud",
+            command: ["projects", "describe", options.projectId],
+            outcome: outcomeOf(describe, "project verified"),
+        });
+        if (describe.status !== "ok") {
+            return errorResult(SETUP_ERROR_CODES.PROJECT_NOT_FOUND, `project "${options.projectId}" could not be verified: ${describeGcloudFailure(describe)}`);
+        }
+        projectId = options.projectId;
+    }
+    else {
+        projectId = generateProjectId();
+        const create = await runner.run(["projects", "create", projectId]);
+        if (create.status !== "ok") {
+            if (create.status === "failed" && create.stderr.includes(PROJECT_ALREADY_EXISTS_MARKER)) {
+                projectReused = true;
+                executed.push({ kind: "gcloud", command: ["projects", "create", projectId], outcome: "reused (project already exists)" });
+            }
+            else {
+                return errorResult(SETUP_ERROR_CODES.PROJECT_CREATE_FAILED, `could not create project "${projectId}": ${describeGcloudFailure(create)}`);
+            }
+        }
+        else {
+            executed.push({ kind: "gcloud", command: ["projects", "create", projectId], outcome: "created" });
+        }
+    }
+    const configSet = await runner.run(["config", "set", "project", projectId]);
+    executed.push({ kind: "gcloud", command: ["config", "set", "project", projectId], outcome: outcomeOf(configSet, "default project selected") });
+    if (configSet.status !== "ok") {
+        return errorResult(SETUP_ERROR_CODES.PROJECT_SELECT_FAILED, `could not select project "${projectId}": ${describeGcloudFailure(configSet)}`);
+    }
+    const enable = await runner.run(["services", "enable", "sheets.googleapis.com", "--project", projectId]);
+    executed.push({
+        kind: "gcloud",
+        command: ["services", "enable", "sheets.googleapis.com", "--project", projectId],
+        outcome: outcomeOf(enable, "Sheets API enabled"),
+    });
+    if (enable.status !== "ok") {
+        return errorResult(SETUP_ERROR_CODES.API_ENABLE_FAILED, `could not enable sheets.googleapis.com: ${describeGcloudFailure(enable)}`);
+    }
+    // Service account: reuse by email when it already exists.
+    const email = serviceAccountEmail(options.saName, projectId);
+    let serviceAccountReused = false;
+    const saList = await runner.run(["iam", "service-accounts", "list", "--project", projectId, "--format=value(email)"]);
+    executed.push({
+        kind: "gcloud",
+        command: ["iam", "service-accounts", "list", "--project", projectId, "--format=value(email)"],
+        outcome: outcomeOf(saList, "service account lookup complete"),
+    });
+    if (saList.status !== "ok") {
+        return errorResult(SETUP_ERROR_CODES.SA_CREATE_FAILED, `could not list service accounts: ${describeGcloudFailure(saList)}`);
+    }
+    const existingEmails = saList.stdout.split("\n").map((line) => line.trim());
+    if (existingEmails.includes(email)) {
+        serviceAccountReused = true;
+    }
+    else {
+        const saCreate = await runner.run([
+            "iam",
+            "service-accounts",
+            "create",
+            options.saName,
+            "--project",
+            projectId,
+            "--display-name",
+            "hikoutei setup",
+        ]);
+        executed.push({
+            kind: "gcloud",
+            command: [
+                "iam",
+                "service-accounts",
+                "create",
+                options.saName,
+                "--project",
+                projectId,
+                "--display-name",
+                "hikoutei setup",
+            ],
+            outcome: outcomeOf(saCreate, "service account created"),
+        });
+        if (saCreate.status !== "ok") {
+            return errorResult(SETUP_ERROR_CODES.SA_CREATE_FAILED, `could not create service account "${options.saName}": ${describeGcloudFailure(saCreate)}`);
+        }
+    }
+    // Key: reuse an existing key file instead of overwriting it.
+    let keyReused = false;
+    if (existsSync(options.keyPath)) {
+        keyReused = true;
+    }
+    else {
+        const keyCreate = await runner.run([
+            "iam",
+            "service-accounts",
+            "keys",
+            "create",
+            options.keyPath,
+            "--iam-account",
+            email,
+            "--project",
+            projectId,
+        ]);
+        executed.push({
+            kind: "gcloud",
+            command: [
+                "iam",
+                "service-accounts",
+                "keys",
+                "create",
+                options.keyPath,
+                "--iam-account",
+                email,
+                "--project",
+                projectId,
+            ],
+            outcome: outcomeOf(keyCreate, "key created"),
+        });
+        if (keyCreate.status !== "ok") {
+            return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not create a service-account key for ${email}: ${describeGcloudFailure(keyCreate)}`);
+        }
+    }
+    try {
+        chmodSync(options.keyPath, KEY_FILE_MODE);
+    }
+    catch (error) {
+        return errorResult(SETUP_ERROR_CODES.KEY_CREATE_FAILED, `could not secure the key file ${options.keyPath}: ${messageOf(error)}`);
+    }
+    // Spreadsheet: created with the new key, so the SA owns it.
+    const title = options.spreadsheetTitle ?? defaultSpreadsheetTitle(projectId);
+    let spreadsheet;
+    try {
+        spreadsheet = await options.createSpreadsheet({ keyPath: options.keyPath, title });
+    }
+    catch (error) {
+        return errorResult(SETUP_ERROR_CODES.SHEET_CREATE_FAILED, `could not create spreadsheet "${title}": ${messageOf(error)}`);
+    }
+    // .env: update only the two managed keys, preserving unrelated lines.
+    let envResult;
+    try {
+        envResult = writeSetupEnvFile(options.outputPath, options.keyPath, spreadsheet.spreadsheetUrl);
+    }
+    catch (error) {
+        return errorResult(SETUP_ERROR_CODES.OUTPUT_WRITE_FAILED, `could not write ${options.outputPath}: ${messageOf(error)}`);
+    }
+    return {
+        status: "ok",
+        dryRun: false,
+        commands: executed,
+        summary: {
+            projectId,
+            serviceAccountEmail: email,
+            keyPath: options.keyPath,
+            spreadsheetId: spreadsheet.spreadsheetId,
+            spreadsheetUrl: spreadsheet.spreadsheetUrl,
+            spreadsheetTitle: title,
+            outputPath: options.outputPath,
+            envFileCreated: envResult.created,
+            envFileModified: envResult.modified,
+            projectReused,
+            serviceAccountReused,
+            keyReused,
+        },
+    };
+}
+/** The two .env keys the setup CLI manages. */
+export const SETUP_ENV_KEYS = {
+    CREDENTIALS: "GOOGLE_APPLICATION_CREDENTIALS",
+    SPREADSHEET_URL: "HIKOUTEI_SYNC_SPREADSHEET_URL",
+};
+function isManagedEnvLine(line) {
+    return (line.startsWith(`${SETUP_ENV_KEYS.CREDENTIALS}=`) ||
+        line.startsWith(`${SETUP_ENV_KEYS.SPREADSHEET_URL}=`));
+}
+/**
+ * Writes or updates the .env output file.
+ *
+ * Reads the existing file (if any), keeps every unrelated line untouched,
+ * replaces any existing managed key lines, appends the two managed keys, and
+ * writes back only when the content changed. A missing file is created.
+ * Throws on filesystem failure; the caller maps the throw to
+ * `output_write_failed`.
+ */
+export function writeSetupEnvFile(outputPath, credentialsPath, spreadsheetUrl) {
+    let existing = "";
+    let created = false;
+    try {
+        existing = readFileSync(outputPath, "utf8");
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT") {
+            created = true;
+        }
+        else {
+            throw error;
+        }
+    }
+    const rawLines = existing === "" ? [] : existing.split("\n");
+    // A trailing empty element comes from the final newline; drop it so
+    // unrelated content is preserved without a spurious blank line.
+    const lines = rawLines.length > 0 && rawLines[rawLines.length - 1] === "" ? rawLines.slice(0, -1) : rawLines;
+    const next = [
+        ...lines.filter((line) => !isManagedEnvLine(line)),
+        `${SETUP_ENV_KEYS.CREDENTIALS}=${credentialsPath}`,
+        `${SETUP_ENV_KEYS.SPREADSHEET_URL}=${spreadsheetUrl}`,
+    ];
+    const content = `${next.join("\n")}\n`;
+    const modified = created || content !== existing;
+    if (modified) {
+        writeFileSync(outputPath, content, "utf8");
+    }
+    return { created, modified };
+}
+function errorResult(code, message) {
+    return { status: "error", code, message };
+}
+function outcomeOf(result, okOutcome) {
+    if (result.status === "ok") {
+        return okOutcome;
+    }
+    return `failed: ${describeGcloudFailure(result)}`;
+}
+function describeGcloudFailure(result) {
+    if (result.status === "not_found") {
+        return "gcloud CLI not found on PATH";
+    }
+    if (result.status === "failed") {
+        return (firstNonEmptyLine(result.stderr) ??
+            firstNonEmptyLine(result.stdout) ??
+            `gcloud exited with status ${result.code === null ? "unknown" : String(result.code)}`);
+    }
+    return "unexpected gcloud outcome";
+}
+function firstNonEmptyLine(text) {
+    for (const line of text.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed !== "") {
+            return trimmed;
+        }
+    }
+    return undefined;
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
+//# sourceMappingURL=setupFlow.js.map

package/dist/cli/setupFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupFlow.js","sourceRoot":"","sources":["../../src/cli/setupFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAuB,MAAM,aAAa,CAAC;AAIrE,qFAAqF;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAErE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gCAAgC,GAAG,eAAe,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAmDnC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,yBAAyB,CAAU,CAAC;AAEtG,4EAA4E;AAC5E,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;AAEvD,gEAAgE;AAChE,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,SAAiB;IACnE,OAAO,GAAG,MAAM,IAAI,SAAS,0BAA0B,CAAC;AAC1D,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,GAAG,gCAAgC,IAAI,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE,EAAE,SAAuB,IAAI,CAAC,MAAM;IAC5F,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChF,OAAO,YAAY,aAAa,IAAI,UAAU,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE,IAAY;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAqB;QACjC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE;QAC1E,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE;KAC5F,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;YACpD,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC;YACrC,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,IAAI,CACX;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC;QAChD,OAAO,EAAE,0BAA0B;KACpC,EACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,WAAW,EAAE,SAAS,CAAC;QAChF,OAAO,EAAE,iCAAiC;KAC3C,EACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,uBAAuB,CAAC;QAC7F,OAAO,EAAE,6CAA6C;KACvD,EACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,OAAO,CAAC,MAAM;YACd,WAAW;YACX,SAAS;YACT,gBAAgB;YAChB,gBAAgB;SACjB;QACD,OAAO,EAAE,yDAAyD;KACnE,EACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE;YACP,KAAK;YACL,kBAAkB;YAClB,MAAM;YACN,QAAQ;YACR,OAAO,CAAC,OAAO;YACf,eAAe;YACf,KAAK;YACL,WAAW;YACX,SAAS;SACV;QACD,OAAO,EAAE,kBAAkB,OAAO,CAAC,OAAO,sDAAsD;KACjG,EACD;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,+BAA+B,KAAK,qCAAqC;QAChF,OAAO,EAAE,wBAAwB,KAAK,4BAA4B;KACnE,EACD;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,SAAS,OAAO,CAAC,UAAU,EAAE;QACpC,OAAO,EAAE,iGAAiG;KAC3G,CACF,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,QAAmC;IAC5D,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,QAAQ;gBACX,OAAO,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YACnE,KAAK,KAAK;gBACR,OAAO,KAAK,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YAChD,KAAK,MAAM;gBACT,OAAO,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc;QACrC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC;IAClB,OAAO;QACL,0BAA0B;QAC1B,2BAA2B,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG;QAChG,2BAA2B,OAAO,CAAC,mBAAmB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG;QACjH,2BAA2B,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG;QAC1F,2BAA2B,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,aAAa,GAAG;QAChF,2BAA2B,OAAO,CAAC,cAAc,EAAE;QACnD,2BAA2B,OAAO,CAAC,UAAU,KAAK,QAAQ,GAAG;KAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACrD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,iBAAiB,EAAE,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAE3B,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC9G,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,WAAW,CAChB,iBAAiB,CAAC,cAAc,EAChC,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,iBAAiB,CAAC,cAAc,EAAE,4BAA4B,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAClH,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,WAAW,CAChB,iBAAiB,CAAC,oBAAoB,EACtC,0CAA0C,qBAAqB,CAAC,IAAI,CAAC,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO,WAAW,CAChB,iBAAiB,CAAC,oBAAoB,EACtC,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,IAAI,SAAiB,CAAC;IACtB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC;YACpD,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,WAAW,CAChB,iBAAiB,CAAC,iBAAiB,EACnC,YAAY,OAAO,CAAC,SAAS,4BAA4B,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAChC,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,EAAE,CAAC;gBACxF,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC5H,CAAC;iBAAM,CAAC;gBACN,OAAO,WAAW,CAChB,iBAAiB,CAAC,qBAAqB,EACvC,6BAA6B,SAAS,MAAM,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAC/I,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,WAAW,CAChB,iBAAiB,CAAC,qBAAqB,EACvC,6BAA6B,SAAS,MAAM,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IACzG,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,WAAW,EAAE,SAAS,CAAC;QAChF,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,oBAAoB,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,WAAW,CAChB,iBAAiB,CAAC,iBAAiB,EACnC,2CAA2C,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7D,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACtH,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,uBAAuB,CAAC;QAC7F,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,iCAAiC,CAAC;KAC9D,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,oCAAoC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,oBAAoB,GAAG,IAAI,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;YAChC,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,OAAO,CAAC,MAAM;YACd,WAAW;YACX,SAAS;YACT,gBAAgB;YAChB,gBAAgB;SACjB,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACP,KAAK;gBACL,kBAAkB;gBAClB,QAAQ;gBACR,OAAO,CAAC,MAAM;gBACd,WAAW;gBACX,SAAS;gBACT,gBAAgB;gBAChB,gBAAgB;aACjB;YACD,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,WAAW,CAChB,iBAAiB,CAAC,gBAAgB,EAClC,qCAAqC,OAAO,CAAC,MAAM,MAAM,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;YACjC,KAAK;YACL,kBAAkB;YAClB,MAAM;YACN,QAAQ;YACR,OAAO,CAAC,OAAO;YACf,eAAe;YACf,KAAK;YACL,WAAW;YACX,SAAS;SACV,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACP,KAAK;gBACL,kBAAkB;gBAClB,MAAM;gBACN,QAAQ;gBACR,OAAO,CAAC,OAAO;gBACf,eAAe;gBACf,KAAK;gBACL,WAAW;gBACX,SAAS;aACV;YACD,OAAO,EAAE,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO,WAAW,CAChB,iBAAiB,CAAC,iBAAiB,EACnC,8CAA8C,KAAK,KAAK,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAC3F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAChB,iBAAiB,CAAC,iBAAiB,EACnC,iCAAiC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,WAAoC,CAAC;IACzC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAChB,iBAAiB,CAAC,mBAAmB,EACrC,iCAAiC,KAAK,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAChB,iBAAiB,CAAC,mBAAmB,EACrC,mBAAmB,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE;YACP,SAAS;YACT,mBAAmB,EAAE,KAAK;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,gBAAgB,EAAE,KAAK;YACvB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,SAAS,CAAC,OAAO;YACjC,eAAe,EAAE,SAAS,CAAC,QAAQ;YACnC,aAAa;YACb,oBAAoB;YACpB,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,WAAW,EAAE,gCAAgC;IAC7C,eAAe,EAAE,+BAA+B;CACxC,CAAC;AAUX,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,WAAW,GAAG,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,CAAC,eAAe,GAAG,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,eAAuB,EACvB,cAAsB;IAEtB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjG,MAAM,IAAI,GAAG;QACX,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClD,GAAG,cAAc,CAAC,WAAW,IAAI,eAAe,EAAE;QAClD,GAAG,cAAc,CAAC,eAAe,IAAI,cAAc,EAAE;KACtD,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,IAAI,OAAO,KAAK,QAAQ,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,IAAoB,EAAE,OAAe;IACxD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,SAAS,CAAC,MAAuB,EAAE,SAAiB;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAuB;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,CACL,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC;YAChC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC;YAChC,6BAA6B,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnD,CAAC"}

package/dist/cli/sheetsFactory.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Spreadsheet creation for `hikoutei setup`.
+ *
+ * The setup CLI creates the sync spreadsheet with the freshly provisioned
+ * service-account key, so the service account owns the spreadsheet and no
+ * sharing step is needed. The production implementation uses
+ * google-auth-library plus @googleapis/sheets (already root dependencies);
+ * tests inject a fake creator, so unit tests never touch the network.
+ *
+ * The API response is treated as untrusted input: it is validated by a
+ * runtime guard before it is promoted into the internal result shape.
+ */
+/** OAuth scope required to create and write spreadsheets. */
+export declare const SPREADSHEETS_SCOPE = "https://www.googleapis.com/auth/spreadsheets";
+/** Template for the human-facing spreadsheet edit URL. */
+export declare const SPREADSHEET_EDIT_URL_TEMPLATE = "https://docs.google.com/spreadsheets/d/<id>/edit";
+export interface SpreadsheetCreateRequest {
+    /** Absolute path to the service-account key JSON file. */
+    readonly keyPath: string;
+    /** Spreadsheet title to create. */
+    readonly title: string;
+}
+export interface SpreadsheetCreateResult {
+    readonly spreadsheetId: string;
+    readonly spreadsheetUrl: string;
+}
+/** Creates a spreadsheet as the service account identified by `keyPath`. */
+export type SpreadsheetCreator = (request: SpreadsheetCreateRequest) => Promise<SpreadsheetCreateResult>;
+/**
+ * Production spreadsheet creator.
+ *
+ * Authenticates with the given service-account key file and calls
+ * `spreadsheets.create`. Throws on failure; the setup flow maps any throw to
+ * the `sheet_create_failed` error code. The key file path is never included
+ * in error output.
+ */
+export declare function createGoogleSheetsSpreadsheetCreator(): SpreadsheetCreator;
+/** Builds the public edit URL for a spreadsheet id. */
+export declare function spreadsheetEditUrl(spreadsheetId: string): string;
+/**
+ * Validates the raw `spreadsheets.create` payload and promotes it into the
+ * internal result shape.
+ *
+ * The response is untrusted SDK data, so `spreadsheetId` must be proven to be
+ * a non-empty string. When the API omits `spreadsheetUrl` (it can), the URL
+ * is derived from the id deterministically.
+ */
+export declare function extractSpreadsheetCreateResult(data: unknown): SpreadsheetCreateResult;
+//# sourceMappingURL=sheetsFactory.d.ts.map

package/dist/cli/sheetsFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sheetsFactory.d.ts","sourceRoot":"","sources":["../../src/cli/sheetsFactory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,iDAAiD,CAAC;AAEjF,0DAA0D;AAC1D,eAAO,MAAM,6BAA6B,qDAAqD,CAAC;AAEhG,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,wBAAwB,KAC9B,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAKtC;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,IAAI,kBAAkB,CAezE;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEhE;AAMD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,OAAO,GAAG,uBAAuB,CAYrF"}