wizards 0.3.8 → 0.4.0

package/README.md

@@ -44,37 +44,50 @@ A wizard in use: it asks on one page, then on the next, and ends with the result
   <img src="docs/assets/wizard.png" alt="A wizard in use on a phone, three pictures: which week and how many children, what is on the table, and the finished weekly plan with PDF, PNG and sharing">
 </p>
 
-## Install
+## Get started
 
-On macOS or Linux, in a terminal:
+Create an account at [engenty.ai](https://engenty.ai): it is in a closed beta, so "Get started"
+takes your e-mail for an invitation, or your invitation code. Signed in, the studio asks who
+your team is, reads your website into your space, takes first documents, and you build your
+first wizard in the browser. Links run day and night on the team's credits.
+
+## Install it on your computer
+
+The same account on your own machine: it thinks with your Claude, ChatGPT, Gemini or Cursor
+subscription, reads your local files and browses for you, and what you publish keeps running in
+the cloud behind the same links. On macOS or Linux, in a terminal:
 
 ```bash
 curl -fsSL https://engenty.ai/install.sh | bash
 ```
 
-It needs nothing but `curl` and asks for no password. It brings its own Node.js (a Node you
-already have is left alone), installs engenty wizards into `~/.engenty/wizards` and then walks
-you through the rest:
+It needs nothing but `curl` and `tar` and asks for no password. It brings its own Node.js (a
+Node you already have is left alone), installs engenty wizards into `~/.engenty/wizards` and
+then walks you through the rest:
 
+- **Your engenty account.** A code and the browser for the sign-in; your team's space comes
+  down to this computer. "Later" skips it, `wizards account sign-in` does it any time.
+  `--local` leaves the account out: nothing leaves the computer, links answer on it only
+  ([local only](https://engenty.ai/docs/user/local-only)).
 - **Something to think with.** It looks for Codex, Claude Code, Gemini CLI and Cursor Agent and
   offers to install one if there is none — first the one whose app (Claude, ChatGPT, Cursor) is
   on your Mac, as its subscription is most likely yours already. The first page of the studio
-  installs them too. Or use an API key or [Ollama](https://ollama.com).
+  installs them too. Or use your account's credits, an API key or [Ollama](https://ollama.com).
 - **Google Chrome and ffmpeg** (optional): Chrome for PDF and PNG exports and for steps that use
   a browser, ffmpeg for MP4 videos of animated widgets.
 - **Start at login** (optional): engenty wizards starts in the background when you log in (a
   LaunchAgent on a Mac, a systemd user service on Linux). Links and AI clients then always
   reach it. `wizards autostart on` or `off` switches it later.
 
-Then it starts and the studio opens in your browser. Later, start it with:
+It starts nothing. Afterwards:
 
 ```bash
-wizards
+wizards start
 ```
 
-It runs while that terminal is open; Ctrl-C stops it. `wizards status` says what is
-installed and what runs, `wizards setup` runs the guided setup again, and
-`wizards --help` lists the rest.
+starts it and opens the studio; it runs while that terminal is open, Ctrl-C stops it.
+`wizards` opens a menu with all of it, `wizards status` says what is installed and what runs,
+`wizards setup` runs the guided setup again, and `wizards --help` lists the rest.
 
 **Install it as an app.** In Chrome or Edge the studio installs as an app: its own window, its
 own icon in the Dock or taskbar. The studio offers it in a banner at the top; or click the install
@@ -99,9 +112,10 @@ machine; a checkout brings its own sandbox, the installed version has none yet.
 
 ## First start
 
-The setup asks what engenty should think with. Pick an AI client that is installed on your
-computer — engenty uses your existing subscription and signs it in for you in a terminal right
-on the page — or enter your own keys. It stays until a test call works, then the studio opens.
+The setup shows your account at the top and asks what engenty should think with. Pick an AI
+client that is installed on your computer — engenty uses your existing subscription and signs
+it in for you in a terminal right on the page — your account's credits, or enter your own keys.
+It stays until a test call works, then the studio opens.
 
 Change it later under Settings.
 

package/apps/runtime/dist/auth/account.js

@@ -9,9 +9,11 @@ import { deleteSetting, readSetting, writeSetting } from "../settings.js";
  * browser at the Manage-App, the code comes back to this server on the loopback interface. The
  * account is optional; it unlocks credits through the gateway and publishing to the cloud.
  */
-const CLIENT = { id: "wizards-desktop" };
+export const CLIENT = { id: "wizards-desktop" };
 const REFRESH = "account.refresh";
-const SCOPE = "openid profile email offline_access wizards:read wizards:write wizards:publish";
+export const SCOPE = "openid profile email offline_access wizards:read wizards:write wizards:publish";
+/** The team of the linked account as the Manage-App last named it, for lines that must not wait on it. */
+const TEAM = "account.team";
 /** Loopback redirect on the port this server listens on (RFC 8252). */
 function redirectUri() {
     return `http://127.0.0.1:${env.port}/api/auth/callback`;
@@ -48,7 +50,11 @@ export async function startLink(options = {}) {
     return signUp.toString();
 }
 let cached = null;
-async function keep(tokens) {
+/**
+ * Keeps what the token endpoint handed out: the refresh token in the vault, the account in the
+ * settings. The browser flow (finishLink) and the device flow (device.ts) end here alike.
+ */
+export async function keep(tokens) {
     const claims = unverifiedClaims(tokens.access_token);
     if (!claims) {
         throw new Error("The account's token names no tenant.");
@@ -128,6 +134,25 @@ export async function unlink() {
     cached = null;
     await vaultDelete(REFRESH);
     await deleteSetting("account");
+    await deleteSetting(TEAM);
+}
+/** The team as the Manage-App last named it: `wizards status` and the menu show it without a round trip. */
+export function knownTeam() {
+    return readSetting(TEAM);
+}
+let rememberedTeam = null;
+async function rememberTeam(tenant) {
+    const same = `${tenant.id}\n${tenant.name}\n${tenant.balanceCredits}`;
+    if (same === rememberedTeam) {
+        return;
+    }
+    rememberedTeam = same;
+    await writeSetting(TEAM, {
+        tenantId: tenant.id,
+        name: tenant.name,
+        balanceCredits: tenant.balanceCredits,
+        at: new Date().toISOString(),
+    });
 }
 /** Balance and tenants of the linked account, straight from the Manage-App. */
 export async function accountOverview() {
@@ -139,5 +164,12 @@ export async function accountOverview() {
         headers: { authorization: `Bearer ${token}` },
         signal: AbortSignal.timeout(10_000),
     }).catch(() => null);
-    return res?.ok ? (await res.json()) : null;
+    if (!res?.ok) {
+        return null;
+    }
+    const overview = (await res.json());
+    if (overview?.tenant) {
+        await rememberTeam(overview.tenant).catch(() => undefined);
+    }
+    return overview;
 }

package/apps/runtime/dist/auth/device.js

@@ -0,0 +1,101 @@
+import { env } from "../env.js";
+import { discovery, ManageError, tokenRequest } from "../manage.js";
+import { CLIENT, keep, SCOPE } from "./account.js";
+/**
+ * Signing in from a terminal (RFC 8628): the Manage-App hands out a code, the person types it
+ * on any browser at the account's /device page and allows it, and this process asks the token
+ * endpoint until they did. For `wizards setup` and `wizards account sign-in`; the studio keeps
+ * the browser flow of account.ts. Both end in the same keep(): the refresh token in the vault,
+ * the account in the settings, so the runtime picks it up wherever it runs.
+ *
+ *   POST <account>/api/auth/device/code      client_id, scope, resource → the codes
+ *   POST <token endpoint of the discovery>   grant_type device_code, every `interval` seconds,
+ *                                            until tokens come, or the code expired or was refused
+ */
+const GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/** Why a sign-in ended without an account; the message is for the person. */
+export class DeviceSignInError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+    }
+}
+/** Asks the Manage-App for a code to sign this install in with. */
+export async function requestDeviceCode() {
+    const base = env.local.accountUrl;
+    // The discovery names the endpoint when the Manage-App advertises it.
+    const d = (await discovery(base).catch(() => null));
+    const res = await fetch(d?.device_authorization_endpoint ?? `${base}/api/auth/device/code`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            client_id: CLIENT.id,
+            scope: SCOPE,
+            resource: env.local.cloudUrl,
+        }),
+        signal: AbortSignal.timeout(15_000),
+    }).catch(() => null);
+    if (!res) {
+        throw new DeviceSignInError("unreachable", `${base} is not reachable right now.`);
+    }
+    const data = (await res.json().catch(() => ({})));
+    if (!(res.ok && data.device_code && data.user_code && data.verification_uri)) {
+        throw new DeviceSignInError("refused", data.error_description ||
+            (data.error
+                ? `The account refused the sign-in (${data.error}).`
+                : `The account did not hand out a code (${res.status}).`));
+    }
+    return {
+        deviceCode: data.device_code,
+        userCode: data.user_code,
+        verificationUri: data.verification_uri,
+        verificationUriComplete: data.verification_uri_complete ?? null,
+        expiresAt: Date.now() + (data.expires_in ?? 1800) * 1000,
+        interval: Math.max(1, data.interval ?? 5),
+    };
+}
+const pause = (ms) => new Promise((done) => setTimeout(done, ms));
+/**
+ * Asks the token endpoint until the person allowed the code in the browser, and keeps the
+ * tokens as the browser flow does. `authorization_pending` asks again after `interval`;
+ * `slow_down` asks five seconds later each time (RFC 8628 §3.5); a network error is tried
+ * again a few times. `expired_token` and `access_denied` end it.
+ */
+export async function waitForDeviceSignIn(code, options = {}) {
+    const wait = options.wait ?? pause;
+    let interval = code.interval;
+    let failures = 0;
+    for (;;) {
+        await wait(interval * 1000);
+        if (Date.now() >= code.expiresAt) {
+            throw new DeviceSignInError("expired", "The code has expired. Start the sign-in again.");
+        }
+        try {
+            const tokens = await tokenRequest({ grant_type: GRANT, device_code: code.deviceCode, resource: env.local.cloudUrl }, CLIENT, env.local.accountUrl);
+            return await keep(tokens);
+        }
+        catch (err) {
+            if (!(err instanceof ManageError)) {
+                if (++failures >= 5) {
+                    throw new DeviceSignInError("unreachable", `${env.local.accountUrl} stopped answering. Start the sign-in again.`);
+                }
+                continue;
+            }
+            failures = 0;
+            switch (err.code) {
+                case "authorization_pending":
+                    continue;
+                case "slow_down":
+                    interval += 5;
+                    continue;
+                case "expired_token":
+                    throw new DeviceSignInError("expired", "The code has expired. Start the sign-in again.");
+                case "access_denied":
+                    throw new DeviceSignInError("denied", "The sign-in was refused in the browser.");
+                default:
+                    throw new DeviceSignInError("refused", `The account refused the sign-in (${err.code}).`);
+            }
+        }
+    }
+}

package/apps/runtime/dist/auth/index.js

@@ -273,7 +273,7 @@ export const authRoutes = new Hono()
     if (!managed) {
         // The linked account of a runtime that runs alone: the system browser lands here.
         if (!code) {
-            return c.html(closePage("Anmeldung abgebrochen. Du kannst dieses Fenster schließen."), 400);
+            return c.html(closePage("Sign-in cancelled. You can close this window."), 400);
         }
         try {
             await finishLink(code, rawState);
@@ -281,11 +281,11 @@ export const authRoutes = new Hono()
             void firstSync();
             // The Pro modules the account's plan includes.
             void refreshPro();
-            return c.html(closePage("Angemeldet. Du kannst dieses Fenster schließen."));
+            return c.html(closePage("Signed in. You can close this window."));
         }
         catch (err) {
             console.error("[account]", err);
-            return c.html(closePage("Anmeldung hat nicht geklappt. Bitte noch einmal versuchen."), 400);
+            return c.html(closePage("The sign-in did not work. Please try again."), 400);
         }
     }
     const state = unseal(getCookie(c, STATE_COOKIE) ?? "");
@@ -322,7 +322,7 @@ export const authRoutes = new Hono()
                 exp: Date.now() + 2 * 60_000,
             });
             const link = `engenty-wizards://signin?code=${encodeURIComponent(code)}`;
-            return c.html(`${closePage("Angemeldet. Kehre jetzt zu engenty wizards zurück.")}
+            return c.html(`${closePage("Signed in. Go back to engenty wizards now.")}
 <script>location.href = ${JSON.stringify(link)};</script>`);
         }
         setSessionCookie(c, id);

package/apps/runtime/dist/cli/account.js

@@ -0,0 +1,289 @@
+import * as p from "@clack/prompts";
+import { accountOverview, knownTeam, linkedAccount, unlink, } from "../auth/account.js";
+import { DeviceSignInError, requestDeviceCode, waitForDeviceSignIn } from "../auth/device.js";
+import { migrateControlDb } from "../db/client.js";
+import { env } from "../env.js";
+import { featuresFile, fileFeatures, writeFeature } from "../features.js";
+import { command, readInstallNote, writeInstallNote } from "./home.js";
+import { openBrowser, runningRuntime, settings } from "./start.js";
+import { bold, busy, cyan, dim, tilde } from "./ui.js";
+/**
+ * The account of this install, from the terminal. `wizards account` says where it stands,
+ * `sign-in` runs the device flow (auth/device.ts), `sign-out` ends the link the way the
+ * studio does. The setup's first step is the same sign-in. `--local` keeps an install off the
+ * account altogether: `account=off` in the install's `.features` hides every account surface
+ * (packages/shared/src/feature-flags.ts), and a note in install.json says so.
+ *
+ * Everything here reads and writes the install's settings and vault through the runtime's own
+ * modules, with or without a runtime running (install-env.ts puts this process where the
+ * runtime is). A runtime that runs reads the account from the settings as it goes; what it
+ * holds from its start is brought in line by a restart, which is offered.
+ */
+export const INTRO = "Your team, its space and your wizards live in the account. This computer joins the space.";
+let prepared = null;
+/** The control database as the runtime keeps it: a fresh install has none until something opens it. */
+function ready() {
+    prepared ??= migrateControlDb();
+    return prepared;
+}
+/** Set up with `--local`: the install's `.features` says `account=off`. */
+export function isLocalOnly(file = featuresFile()) {
+    return fileFeatures(file).account === false;
+}
+/** `--local`: the switch into the file, the note into install.json. */
+export function localOnly(paths, file = featuresFile()) {
+    writeFeature("account", false, file);
+    writeInstallNote({ ...readInstallNote(paths), local: true }, paths);
+}
+/** A sign-in ends local-only: the switch follows the default again, the note goes. */
+export function joinedAccount(paths, file = featuresFile()) {
+    if (isLocalOnly(file)) {
+        writeFeature("account", null, file);
+    }
+    const note = readInstallNote(paths);
+    if (note.local) {
+        const { local: _, ...rest } = note;
+        writeInstallNote(rest, paths);
+    }
+}
+/** Where the account stands, from this machine alone: no round trip. */
+export async function accountState() {
+    if (isLocalOnly()) {
+        return { kind: "local" };
+    }
+    await ready();
+    const account = await linkedAccount();
+    if (!account) {
+        return { kind: "none" };
+    }
+    return { kind: "linked", account, team: await knownTeam() };
+}
+/** "Matthias · team Platzer Fenster & Türen · 120 credits", as far as it is known. */
+export function described(account, team, credits = true) {
+    const parts = [account.name || account.email];
+    if (team) {
+        parts.push(`team ${team.name}`);
+        if (credits) {
+            parts.push(`${team.balanceCredits} credits`);
+        }
+    }
+    return parts.join(" · ");
+}
+/** One line for the menu and `wizards status`, after the symbol. */
+export function describeAccount(state) {
+    switch (state.kind) {
+        case "local":
+            return "local only";
+        case "none":
+            return "not signed in";
+        default:
+            return described(state.account, state.team, false);
+    }
+}
+/** The account's site, as people know it: engenty.ai for account.engenty.ai. */
+const host = () => new URL(env.local.accountUrl).host.replace(/^account\./, "");
+/** `wizards account`: where it stands, with the Manage-App's word when it answers. */
+async function status() {
+    const state = await accountState();
+    if (state.kind === "local") {
+        console.log(`Local only (no account). ${dim(`\`${command()} account sign-in\` connects one.`)}`);
+        return 0;
+    }
+    if (state.kind === "none") {
+        console.log(`Not signed in. ${dim(`\`${command()} account sign-in\``)}`);
+        return 0;
+    }
+    const overview = await accountOverview();
+    const team = overview?.tenant ?? state.team;
+    console.log(`Signed in as ${described(state.account, team)} · ${host()}${overview ? "" : dim(`  (${host()} did not answer${team ? "; this is from last time" : ""})`)}`);
+    return 0;
+}
+/**
+ * The device flow on the terminal: the link and the code, the browser opened where there is
+ * one, then a wait while the person allows it. Null when it ended without an account.
+ */
+async function deviceSignIn() {
+    let code;
+    try {
+        code = await requestDeviceCode();
+    }
+    catch (err) {
+        p.log.error(err.message);
+        return null;
+    }
+    const link = code.verificationUriComplete ?? code.verificationUri;
+    p.log.message(`Open ${cyan(link)} and type ${bold(code.userCode)}`);
+    if (openBrowser(link)) {
+        p.log.message(dim("The page opens in your browser."));
+    }
+    const spinner = busy("Waiting for you to allow it in the browser");
+    try {
+        const account = await waitForDeviceSignIn(code);
+        const overview = await accountOverview();
+        spinner.stop(`Signed in as ${described(account, overview?.tenant ?? null)}`);
+        return account;
+    }
+    catch (err) {
+        spinner.fail(err instanceof DeviceSignInError
+            ? err.message
+            : `The sign-in did not work. ${err.message}`);
+        return null;
+    }
+}
+/**
+ * A runtime that runs reads the account from the settings as it goes, but holds a few things
+ * from its start: the Pro modules it loaded, which source the models run on, what was sent to
+ * the cloud. A restart brings it in line; the person is asked, or told how.
+ */
+async function pickUp(paths, interactive, why) {
+    if (!(await runningRuntime(settings(paths).dataDir))) {
+        return;
+    }
+    const how = `${command()} restart`;
+    if (!interactive) {
+        p.log.info(`The studio that runs ${why} after ${cyan(how)}.`);
+        return;
+    }
+    const answer = await p.confirm({
+        message: `Restart the studio that runs, so it ${why}?`,
+        initialValue: true,
+    });
+    if (p.isCancel(answer) || !answer) {
+        p.log.info(dim(`Later: ${how}`));
+        return;
+    }
+    // status.ts shows the account; loaded here when needed, so neither module waits on the other.
+    const { restart } = await import("./status.js");
+    await restart(paths);
+}
+const SIGNED_IN = "fetches the Pro modules of your plan and sends what is published to the cloud";
+async function signIn(paths, interactive) {
+    await ready();
+    const linked = await linkedAccount();
+    if (linked) {
+        p.log.info(`Already signed in as ${described(linked, await knownTeam(), false)}. ${dim(`To switch: \`${command()} account sign-out\` first.`)}`);
+        return 0;
+    }
+    const account = await deviceSignIn();
+    if (!account) {
+        return 1;
+    }
+    joinedAccount(paths);
+    p.log.message(dim("What you publish here runs in the cloud too."));
+    await pickUp(paths, interactive, SIGNED_IN);
+    return 0;
+}
+async function signOut(paths, interactive) {
+    const state = await accountState();
+    if (state.kind !== "linked") {
+        console.log(state.kind === "local" ? "Local only: there is no account to sign out." : "Not signed in.");
+        return 0;
+    }
+    const spinner = busy(`Signing out ${state.account.name || state.account.email}`);
+    await unlink();
+    // The same as the studio's sign-out (DELETE /api/studio/account): what was sent to the cloud
+    // is forgotten, the entitlement goes with the account's plan, and models that ran on its
+    // credits run on own keys again. This process never loaded Pro modules or models, so only the
+    // settings change here; a runtime that runs lets go of its modules on restart.
+    const [{ forgetCloud }, { refreshPro }, models] = await Promise.all([
+        import("../services/cloud.js"),
+        import("../plugins/pro.js"),
+        import("../models.js"),
+    ]);
+    await forgetCloud();
+    await refreshPro();
+    await models.loadLocalModels();
+    if (models.localModelSettings().source === "account") {
+        await models.saveLocalModels({ source: "own" });
+    }
+    spinner.stop("Signed out. Your wizards and results stay on this computer.");
+    await pickUp(paths, interactive, "lets go of the account");
+    return 0;
+}
+/** `wizards account [sign-in|sign-out]`. */
+export async function accountCommand(paths, value, options) {
+    const interactive = !options.yes && Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    switch (value) {
+        case "":
+            return status();
+        case "sign-in":
+        case "signin":
+        case "login":
+            return signIn(paths, interactive);
+        case "sign-out":
+        case "signout":
+        case "logout":
+            return signOut(paths, interactive);
+        default:
+            console.error(`${command()} account [sign-in|sign-out]`);
+            return 2;
+    }
+}
+/** The menu's "Account": where it stands, and the way in or out. */
+export async function accountMenu(paths) {
+    await status();
+    const state = await accountState();
+    const action = await p.select({
+        message: "Account",
+        options: [
+            state.kind === "linked"
+                ? { value: "sign-out", label: "Sign out", hint: "your wizards and results stay here" }
+                : { value: "sign-in", label: "Sign in", hint: "with a code, in your browser" },
+            { value: "back", label: "Back" },
+        ],
+    });
+    if (p.isCancel(action) || action === "back") {
+        return;
+    }
+    if (action === "sign-in") {
+        await signIn(paths, true);
+    }
+    else {
+        await signOut(paths, true);
+    }
+}
+/**
+ * The setup's first step. `--local` keeps the install off the account; else the person is
+ * asked to sign in, unless the setup runs without a terminal (`--yes`), which says how to do
+ * it later.
+ */
+export async function accountStep(paths, options, interactive) {
+    if (options.local) {
+        localOnly(paths);
+        p.log.warn(`Local only. No account, nothing leaves this computer. Wizards, the space and results stay in ${tilde(settings(paths).dataDir)}. Links answer on this computer only.`);
+        p.log.message(dim(`Connect an account any time: ${command()} account`));
+        return;
+    }
+    const state = await accountState();
+    if (state.kind === "local") {
+        p.log.info(`Local only (no account). ${dim(`\`${command()} account sign-in\` connects one.`)}`);
+        return;
+    }
+    if (state.kind === "linked") {
+        const overview = await accountOverview();
+        p.log.success(`Signed in as ${described(state.account, overview?.tenant ?? state.team)}`);
+        return;
+    }
+    p.note(INTRO, "Your engenty account");
+    if (!interactive) {
+        p.log.info(dim(`Sign in later: ${command()} account sign-in`));
+        return;
+    }
+    const answer = await p.confirm({ message: "Sign in now?", initialValue: true });
+    if (p.isCancel(answer)) {
+        p.cancel(`Setup stopped. Run it again with \`${command()} setup\`.`);
+        return "cancelled";
+    }
+    if (!answer) {
+        p.log.info(dim(`Later: ${command()} account`));
+        return;
+    }
+    const account = await deviceSignIn();
+    if (!account) {
+        p.log.info(dim(`Later: ${command()} account sign-in`));
+        return;
+    }
+    joinedAccount(paths);
+    p.log.message(dim("What you publish here runs in the cloud too."));
+    await pickUp(paths, interactive, SIGNED_IN);
+}

package/apps/runtime/dist/cli/install-env.js

@@ -0,0 +1,33 @@
+import { mkdirSync } from "node:fs";
+import { resolve } from "node:path";
+import { layout, readEnvFile } from "./home.js";
+/**
+ * Imported first by the command: before the runtime's modules load, this process sees the
+ * install the way its runtime does. env.ts reads the process once, when it is first imported,
+ * and `.env` from the working directory; the runtime starts in the install's folder (start.ts)
+ * and so reads the install's `.env`, with its data folder beside it. The command goes there
+ * too — else `wizards account` or `wizards status` from another folder would open a `data/`
+ * of its own there, with a secret of its own, and a vault the runtime cannot read.
+ *
+ * What the terminal exports for other projects never reaches the runtime (environment.ts); a
+ * few keys that would make this process another runtime are taken from the install's `.env`
+ * alone. The rest the runtime inherits, so the terminal's word stands.
+ */
+const paths = layout();
+const fileEnv = readEnvFile(paths.envFile);
+/** The install's data folder, as start.ts hands it to the runtime: the terminal's word first. */
+const given = process.env.DATA_DIR?.trim() || fileEnv.DATA_DIR?.trim();
+process.env.DATA_DIR = given ? resolve(paths.home, given) : paths.data;
+for (const key of ["MANAGE_URL", "APP_SECRET", "DATABASE_URL", "DATABASE_AUTH_TOKEN"]) {
+    process.env[key] = fileEnv[key] ?? "";
+}
+// Keys and the account's sign-in live in the Keychain on a Mac, as the runtime keeps them.
+if (process.platform === "darwin" &&
+    process.env.SECRETS === undefined &&
+    fileEnv.SECRETS === undefined) {
+    process.env.SECRETS = "keychain";
+}
+/** Where the command was typed: `wizards validate ./my.wizard` means a path from there. */
+export const startedIn = process.cwd();
+mkdirSync(paths.home, { recursive: true });
+process.chdir(paths.home);