import { browserKeyFlow } from './cli-auth.ts'

import type { Detection } from './detect.ts'

import {

type EnvFile,

generateSecret,

isPlaceholder,

isTruthy,

isUsableSecret,

SECRET_KEYS,

secretRequirement,

} from './env-files.ts'

import * as p from './prompter.ts'

import { link, theme } from './theme.ts'

import { FLAG_TWINS, hasMailProvider, LOGIN_PROVIDERS, SELF_HOST_UNLOCKS } from './twins.ts'

/** Where the Chat key is minted when SIM_CLI_AUTH_ORIGIN is unset. */

const DEFAULT_CLI_AUTH_ORIGIN = 'https://www.sim.ai'

/** Reuses existing valid secrets (never regenerates them) and generates the rest. */

export function collectSecrets(existing: EnvFile): Record<string, string> {

const secrets: Record<string, string> = {}

const generated: string[] = []

const replaced: string[] = []

for (const key of SECRET_KEYS) {

const current = existing.vars.get(key)

if (current && isUsableSecret(key, current)) {

secrets[key] = current

} else {

secrets[key] = generateSecret()

// A key the app would reject never successfully encrypted anything, so

// replacing it cannot orphan existing ciphertext.

if (current && !isPlaceholder(current)) replaced.push(key)

else generated.push(key)

}

}

if (replaced.length > 0) {

const detail = replaced.map((key) => `${key} (${secretRequirement(key)})`).join(', ')

p.log.warn(`Replaced ${detail} — the app rejects the existing value at runtime.`)

}

if (generated.length > 0) {

p.log.step(`Generated ${generated.join(', ')}`)

}

return secrets

}

export async function promptCopilotKey(existing?: string): Promise<string | null> {

if (existing) {

const keep = await p.confirm({

message: 'COPILOT_API_KEY is already set — keep it?',

initialValue: true,

})

if (keep) return existing

}

p.log.info('Chat is how you talk to Sim — build and manage everything in natural language.')

const wants = await p.confirm({

message: 'Generate your Chat API key in the browser?',

initialValue: true,

})

if (!wants) {

p.log.info(theme.muted('Skipping — the Chat module stays hidden until you re-run setup.'))

return null

}

const key = await browserKeyFlow(process.env.SIM_CLI_AUTH_ORIGIN ?? DEFAULT_CLI_AUTH_ORIGIN)

if (!key) {

// Both halves, because the caller writes the opt-out for a null key: a

// hand-set credential alone restores capability while Chat stays hidden.

p.log.warn(

'No key received — re-run bun run setup to retry, or set COPILOT_API_KEY and NEXT_PUBLIC_CHAT_DISABLED=false yourself.'

)

return null

}

return key

}

/**

* Hides the Chat module when the user skipped the chat key, so a fresh install

* gets no Chat surfaces rather than ones that reject every message. Written in

* both directions on every run, so obtaining a key later un-hides it.

*

* Only the wizard writes this. Chat is on by default everywhere else, which is

* what keeps existing deployments unaffected.

*/

export function chatFlagValues(copilotKey: string | null): Record<string, string> {

return { NEXT_PUBLIC_CHAT_DISABLED: copilotKey ? 'false' : 'true' }

}

/**

* Escape hatch for Sim devs pointing an install at a non-prod mothership:

*

* SIM_CLI_AUTH_ORIGIN=https://www.staging.sim.ai \

* SIM_AGENT_API_URL=https://www.staging.copilot.sim.ai \

* bun run setup

*

* The two belong together — SIM_CLI_AUTH_ORIGIN decides where the Chat key is

* minted, SIM_AGENT_API_URL decides which backend validates it, and a key from

* one environment is rejected by the other. Persisting the URL keeps later

* `docker compose up` / dev runs on the same backend instead of silently

* reverting to prod once the shell that exported it is gone.

*/

export function mothershipOverride(): Record<string, string> {

const agentUrl = process.env.SIM_AGENT_API_URL

const authOrigin = process.env.SIM_CLI_AUTH_ORIGIN

// Either half alone produces the same cross-environment rejection, just in

// opposite directions — mint here, validate there. Warning on only one of them

// would leave the other silent while the copy claims both matter.

if (authOrigin && !agentUrl) {

p.log.warn(

`SIM_CLI_AUTH_ORIGIN mints the Chat key at ${authOrigin}, but SIM_AGENT_API_URL is unset — the app validates against production, which will reject that key. Set both, or neither.`

)

} else if (agentUrl && !authOrigin) {

p.log.warn(

`SIM_AGENT_API_URL points the app at ${agentUrl}, but SIM_CLI_AUTH_ORIGIN is unset — the Chat key is minted at ${DEFAULT_CLI_AUTH_ORIGIN}, which that backend will reject. Set both, or neither.`

)

}

if (!agentUrl) return {}

p.log.step(`Using mothership ${agentUrl} (SIM_AGENT_API_URL)`)

return { SIM_AGENT_API_URL: agentUrl }

}

export async function promptLlmKeys(

detection: Detection,

custom: boolean

): Promise<Record<string, string>> {

const values: Record<string, string> = {}

if (detection.shellLlmKeys.length > 0) {

const adopt = await p.multiselect({

message: 'Found LLM API keys in your shell — copy into apps/sim/.env?',

options: detection.shellLlmKeys.map((key) => ({ value: key, label: key })),

initialValues: detection.shellLlmKeys,

})

for (const key of adopt) {

const value = process.env[key]

if (!value) throw new Error(`${key} disappeared from the environment mid-run`)

values[key] = value

}

}

if (detection.ollamaReachable) {

const useOllama = await p.confirm({

message: 'Ollama is running on :11434 — wire it up for local models?',

initialValue: true,

})

if (useOllama) values.OLLAMA_URL = 'http://localhost:11434'

}

if (custom && Object.keys(values).length === 0 && detection.shellLlmKeys.length === 0) {

p.log.info(

theme.muted('No LLM keys configured — you can add keys per-workspace in the UI later (BYOK).')

)

}

return values

}

type StorageBackend = 'local' | 's3' | 's3compat' | 'azure' | 'gcs'

function detectStorageBackend(vars: Map<string, string>): StorageBackend {

if (vars.get('AZURE_CONNECTION_STRING') || vars.get('AZURE_ACCOUNT_NAME')) return 'azure'

if (vars.get('S3_ENDPOINT')) return 's3compat'

if (vars.get('S3_BUCKET_NAME') || vars.get('AWS_REGION')) return 's3'

if (vars.get('GCS_BUCKET_NAME')) return 'gcs'

return 'local'

}

async function required(message: string, initialValue?: string): Promise<string> {

return p.text({ message, initialValue, validate: (v) => (v ? undefined : 'required') })

}

/**

* Custom-flow storage step. Local disk is the default; a cloud backend is

* strongly recommended for containerized deployments (uploads are ephemeral

* there). Returns the env vars for the chosen backend, or null to keep local.

*/

export async function promptStorage(

vars: Map<string, string>,

containerized: boolean

): Promise<Record<string, string> | null> {

const current = detectStorageBackend(vars)

const backend = await p.select<StorageBackend>({

message: 'File storage?',

options: [

{

value: 'local',

label: 'Local disk',

hint: containerized

? 'files live in the container — LOST on restart; fine only for evaluation'

: 'fine for local dev (external-fetch flows like Instagram publish need cloud storage)',

},

{ value: 's3', label: 'AWS S3', hint: 'region + bucket; keys optional with IAM/IRSA' },

{

value: 's3compat',

label: 'S3-compatible (R2, MinIO, B2)',

hint: 'custom endpoint — fully self-hostable with MinIO',

},

{ value: 'azure', label: 'Azure Blob', hint: 'connection string or account name + key' },

{

value: 'gcs',

label: 'Google Cloud Storage',

hint: 'bucket; credentials via ADC by default',

},

],

initialValue: current,

})

if (backend === 'local') return null

const values: Record<string, string> = {}

if (backend === 's3' || backend === 's3compat') {

if (backend === 's3compat') {

values.S3_ENDPOINT = await required(

'S3_ENDPOINT (e.g. https://<account>.r2.cloudflarestorage.com)',

vars.get('S3_ENDPOINT')

)

const pathStyle = await p.confirm({

message: 'Force path-style addressing? (required for MinIO/Ceph, not for R2)',

initialValue: false,

})

if (pathStyle) values.S3_FORCE_PATH_STYLE = 'true'

}

values.AWS_REGION = await required(

'AWS_REGION',

vars.get('AWS_REGION') ?? (backend === 's3compat' ? 'auto' : undefined)

)

values.S3_BUCKET_NAME = await required('S3_BUCKET_NAME', vars.get('S3_BUCKET_NAME'))

const accessKey = await p.password({

message: 'AWS_ACCESS_KEY_ID (empty = IAM/instance credential chain)',

})

if (accessKey) {

values.AWS_ACCESS_KEY_ID = accessKey

values.AWS_SECRET_ACCESS_KEY = await p.password({

message: 'AWS_SECRET_ACCESS_KEY',

validate: (v) => (v ? undefined : 'required when an access key id is set'),

})

}

} else if (backend === 'azure') {

const connectionString = await p.password({

message: 'AZURE_CONNECTION_STRING (empty = use account name + key)',

})

if (connectionString) {

values.AZURE_CONNECTION_STRING = connectionString

} else {

values.AZURE_ACCOUNT_NAME = await required(

'AZURE_ACCOUNT_NAME',

vars.get('AZURE_ACCOUNT_NAME')

)

values.AZURE_ACCOUNT_KEY = await p.password({

message: 'AZURE_ACCOUNT_KEY',

validate: (v) => (v ? undefined : 'required'),

})

}

values.AZURE_STORAGE_CONTAINER_NAME = await required(

'AZURE_STORAGE_CONTAINER_NAME',

vars.get('AZURE_STORAGE_CONTAINER_NAME') ?? 'sim-files'

)

} else {

values.GCS_BUCKET_NAME = await required('GCS_BUCKET_NAME', vars.get('GCS_BUCKET_NAME'))

p.log.info(

theme.muted(

'Credentials use Application Default Credentials unless GCS_CREDENTIALS_JSON is set.'

)

)

}

return values

}

const PROVIDER_CONSOLES: Record<string, string> = {

google: 'https://console.cloud.google.com/apis/credentials',

github: 'https://github.com/settings/developers',

microsoft: 'https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade',

}

/** Sign-in providers step: credentials in, exact redirect URIs out. */

export async function promptSignInProviders(

vars: Map<string, string>,

appUrl: string

): Promise<Record<string, string>> {

const configured = LOGIN_PROVIDERS.filter((prov) => vars.get(prov.idKey)).map((prov) => prov.id)

const wanted = await p.multiselect({

message: 'Social sign-in providers? (email/password login works without any)',

options: LOGIN_PROVIDERS.map((prov) => ({

value: prov.id,

label: prov.label,

hint: configured.includes(prov.id) ? 'already configured' : undefined,

})),

initialValues: configured,

})

const values: Record<string, string> = {}

for (const id of wanted) {

const provider = LOGIN_PROVIDERS.find((prov) => prov.id === id)

if (!provider) throw new Error(`unknown provider ${id}`)

p.log.info(

`${provider.label}: create an OAuth app at ${link(PROVIDER_CONSOLES[id], PROVIDER_CONSOLES[id])}\n Redirect URI: ${theme.command(`${appUrl}/api/auth/callback/${id}`)}`

)

values[provider.idKey] = await p.text({

message: provider.idKey,

initialValue: vars.get(provider.idKey),

validate: (v) => (v ? undefined : 'required'),

})

values[provider.secretKey] = await p.password({

message: provider.secretKey,

validate: (v) => (v ? undefined : 'required'),

})

}

return values

}

/** Email step: console logging is the default; MailHog is the one-tap local option. */

export async function promptEmail(vars: Map<string, string>): Promise<Record<string, string>> {

const choice = await p.select({

message: 'Email sending?',

options: [

{

value: 'console',

label: 'None',

hint: 'emails are logged to the console — fine for local',

},

{ value: 'mailhog', label: 'MailHog (local)', hint: 'wires SMTP to localhost:1025' },

{ value: 'resend', label: 'Resend', hint: 'paste an API key' },

{ value: 'smtp', label: 'SMTP', hint: 'any SMTP relay' },

],

initialValue: hasMailProvider(vars) ? (vars.get('SMTP_HOST') ? 'smtp' : 'resend') : 'console',

})

if (choice === 'console') return {}

if (choice === 'mailhog') return { SMTP_HOST: 'localhost', SMTP_PORT: '1025' }

if (choice === 'resend') {

return {

RESEND_API_KEY: await p.password({

message: 'RESEND_API_KEY',

validate: (v) => (v ? undefined : 'required'),

}),

}

}

const values: Record<string, string> = {

SMTP_HOST: await p.text({

message: 'SMTP_HOST',

initialValue: vars.get('SMTP_HOST'),

validate: (v) => (v ? undefined : 'required'),

}),

SMTP_PORT: await p.text({ message: 'SMTP_PORT', initialValue: vars.get('SMTP_PORT') ?? '587' }),

}

const user = await p.text({

message: 'SMTP_USER (empty for unauthenticated relays)',

defaultValue: '',

})

if (user) {

values.SMTP_USER = user

values.SMTP_PASS = await p.password({ message: 'SMTP_PASS' })

}

return values

}

export interface SecurityStepResult {

sim: Record<string, string>

mirrorToRealtime: Record<string, string>

}

/** Auth loosening + admin key. DISABLE_AUTH must reach BOTH env files. */

export async function promptSecurity(vars: Map<string, string>): Promise<SecurityStepResult> {

const sim: Record<string, string> = {}

const mirrorToRealtime: Record<string, string> = {}

const disableAuth = await p.confirm({

message: 'Disable auth entirely? (anonymous access — ONLY for a private network)',

initialValue: isTruthy(vars.get('DISABLE_AUTH')),

})

if (disableAuth) {

p.log.warn('Anyone who can reach this instance has full access. Never expose it publicly.')

sim.DISABLE_AUTH = 'true'

mirrorToRealtime.DISABLE_AUTH = 'true'

}

const privateHosts = await p.confirm({

message:

'Allow DB/connector tools to reach private hosts? (Docker/K8s service names, localhost — loosens the SSRF guard)',

initialValue: isTruthy(vars.get('ALLOW_PRIVATE_DATABASE_HOSTS')),

})

if (privateHosts) sim.ALLOW_PRIVATE_DATABASE_HOSTS = 'true'

const existingAdminKey = vars.get('ADMIN_API_KEY')

if (!existingAdminKey || isPlaceholder(existingAdminKey)) {

const wantsAdmin = await p.confirm({

message: 'Generate an ADMIN_API_KEY? (enables the admin API for workflow export/import)',

initialValue: false,

})

if (wantsAdmin) {

sim.ADMIN_API_KEY = generateSecret()

p.log.step('Generated ADMIN_API_KEY')

}

}

return { sim, mirrorToRealtime }

}

/** Self-host feature unlocks — always writes BOTH members of each twin pair. */

export async function promptUnlocks(vars: Map<string, string>): Promise<Record<string, string>> {

const selected = await p.multiselect({

message: 'Unlock self-host features? (bypasses hosted plan gating)',

options: SELF_HOST_UNLOCKS.map((unlock) => ({

value: unlock.server,

label: unlock.label,

hint: unlock.hint || undefined,

})),

initialValues: SELF_HOST_UNLOCKS.filter((u) => isTruthy(vars.get(u.server))).map(

(u) => u.server

),

})

if (selected.length === 0) return {}

const flags = new Set(selected)

if (flags.has('ENTERPRISE_ENABLED')) {

p.log.info(

theme.muted(

'The enterprise switch covers every feature below — pick individual ones only to override it.'

)

)

}

if (flags.has('ACCESS_CONTROL_ENABLED') && !flags.has('ORGANIZATIONS_ENABLED')) {

flags.add('ORGANIZATIONS_ENABLED')

p.log.info(theme.muted('Access control requires organizations — enabling both.'))

}

const values: Record<string, string> = {}

for (const server of flags) {

values[server] = 'true'

const twin = FLAG_TWINS.find((pair) => pair.server === server)

if (twin) values[twin.client] = 'true'

}

return values

}