justfile

# systemprompt-template
set dotenv-load
# Without this, `just cli ... --full-name "Test User"` word-splits the quoted
# value into two arguments before the CLI ever parses it.
set positional-arguments

CLI_RELEASE := "target/release/systemprompt"

# Use newest binary (release vs debug, whichever is most recent)
CLI := if path_exists("target/release/systemprompt") == "true" { \
    if path_exists("target/debug/systemprompt") == "true" { \
        `[ target/release/systemprompt -nt target/debug/systemprompt ] && echo target/release/systemprompt || echo target/debug/systemprompt` \
    } else { \
        "target/release/systemprompt" \
    } \
} else if path_exists("target/debug/systemprompt") == "true" { \
    "target/debug/systemprompt" \
} else { \
    "echo 'ERROR: No CLI binary found. Run: just build' && exit 1" \
}

# Default: run CLI with any arguments
default *ARGS:
    {{CLI}} "$@"

# Run CLI with full session context (profile + auth token)
cli *ARGS:
    #!/usr/bin/env bash
    set -euo pipefail
    SESSION_FILE="{{justfile_directory()}}/.systemprompt/sessions/index.json"
    if [ -f "$SESSION_FILE" ]; then
        ACTIVE_KEY=$(jq -r '.active_key // "local"' "$SESSION_FILE")
        export SYSTEMPROMPT_PROFILE=$(jq -r ".sessions[\"$ACTIVE_KEY\"].profile_path // empty" "$SESSION_FILE")
        export SYSTEMPROMPT_AUTH_TOKEN=$(jq -r ".sessions[\"$ACTIVE_KEY\"].session_token // empty" "$SESSION_FILE")
    fi
    if [ -z "${SYSTEMPROMPT_PROFILE:-}" ]; then
        export SYSTEMPROMPT_PROFILE="{{justfile_directory()}}/.systemprompt/profiles/local/profile.yaml"
    fi
    exec {{CLI}} "$@"

# Get DATABASE_URL from profile secrets (for sqlx compile-time checks)
_db-url:
    @if [ -n "$SYSTEMPROMPT_PROFILE" ] && [ -f "$SYSTEMPROMPT_PROFILE" ]; then \
        PROFILE_DIR="$(dirname "$SYSTEMPROMPT_PROFILE")"; \
        SECRETS_PATH="$(yq -r '.secrets.secrets_path // "./secrets.json"' "$SYSTEMPROMPT_PROFILE")"; \
        if [ "${SECRETS_PATH#/}" = "$SECRETS_PATH" ]; then \
            SECRETS_FILE="$PROFILE_DIR/$SECRETS_PATH"; \
        else \
            SECRETS_FILE="$SECRETS_PATH"; \
        fi; \
        if [ -f "$SECRETS_FILE" ]; then \
            jq -r '.database_url' "$SECRETS_FILE"; \
        else \
            echo "postgres://systemprompt:systemprompt@localhost:5432/systemprompt"; \
        fi; \
    else \
        cat .systemprompt/tenants.json 2>/dev/null | jq -r '.tenants[] | select(.tenant_type == "local") | .database_url' | head -1 || echo "postgres://systemprompt:systemprompt@localhost:5432/systemprompt"; \
    fi

# ══════════════════════════════════════════════════════════════════════════════
# BUILD & CHECK
# ══════════════════════════════════════════════════════════════════════════════

# Build (Windows) - always uses offline mode
[windows]
build *FLAGS:
    $env:SQLX_OFFLINE="true"; cargo build --workspace {{FLAGS}}

# Build (Unix) - single-flight: dedupes concurrent identical builds across agents
[unix]
build *FLAGS:
    @scripts/build-coordinator.sh run build "{{FLAGS}}" -- {{just_executable()}} _build-uncoordinated {{FLAGS}}

# What is the build/lint/test state right now? Read this before running anything.
[unix]
build-status *RECIPE:
    @scripts/build-coordinator.sh status {{RECIPE}}

# Re-run even if the coordinator considers this source tree already green
[unix]
build-force *FLAGS:
    @BUILD_FORCE=1 scripts/build-coordinator.sh run build "{{FLAGS}}" -- {{just_executable()}} _build-uncoordinated {{FLAGS}}

# The real build. Call `just build` instead - this one skips coordination.
[unix]
_build-uncoordinated *FLAGS:
    #!/usr/bin/env bash
    set -euo pipefail
    # Default to the `local` profile when one is set up but no SYSTEMPROMPT_PROFILE
    # is explicitly exported — keeps the in-build migrate step from failing
    # with "Profile '' not found" on a fresh clone where setup-local writes
    # secrets.json before invoking `just build`.
    SECRETS_FILE_DEFAULT_PROFILE="{{justfile_directory()}}/.systemprompt/profiles/local/secrets.json"
    if [ -z "${SYSTEMPROMPT_PROFILE:-}" ] && [ -f "$SECRETS_FILE_DEFAULT_PROFILE" ]; then
        export SYSTEMPROMPT_PROFILE="local"
    else
        export SYSTEMPROMPT_PROFILE="${SYSTEMPROMPT_PROFILE:-}"
    fi
    # aws-lc-sys refuses to build with GCC <10 due to bug #95189.
    # Force clang if available so release (LTO) builds succeed.
    if command -v clang >/dev/null 2>&1; then
        export CC="${CC:-clang}"
        export CXX="${CXX:-clang++}"
    fi
    SECRETS_FILE="{{justfile_directory()}}/.systemprompt/profiles/local/secrets.json"
    USE_OFFLINE=false
    db_reachable() {
        local url="$1"
        local pgcmd=""
        if command -v pg_isready >/dev/null 2>&1; then pgcmd="pg_isready"
        elif [ -x /opt/homebrew/opt/libpq/bin/pg_isready ]; then pgcmd="/opt/homebrew/opt/libpq/bin/pg_isready"
        elif [ -x /usr/local/opt/libpq/bin/pg_isready ]; then pgcmd="/usr/local/opt/libpq/bin/pg_isready"
        fi
        if [ -n "$pgcmd" ]; then
            "$pgcmd" -d "$url" -t 2 >/dev/null 2>&1 && return 0 || return 1
        fi
        local hostport="${url#*@}"; hostport="${hostport%%/*}"
        local host="${hostport%:*}"; local port="${hostport##*:}"
        [ "$port" = "$host" ] && port=5432
        (exec 3<>/dev/tcp/"$host"/"$port") >/dev/null 2>&1 && { exec 3<&-; exec 3>&-; return 0; } || return 1
    }
    if [ -f "$SECRETS_FILE" ]; then
        DB_URL=$(sed -n 's/.*"database_url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$SECRETS_FILE" 2>/dev/null | head -1)
        if [ -n "$DB_URL" ] && [ "$DB_URL" != "null" ]; then
            if db_reachable "$DB_URL"; then
                export DATABASE_URL="$DB_URL"
                echo "Using database: $DB_URL"
            else
                echo "Database not reachable, using offline mode"
                USE_OFFLINE=true
            fi
        else
            echo "No database_url in secrets, using offline mode"
            USE_OFFLINE=true
        fi
    else
        echo "No local profile secrets found, using offline mode"
        USE_OFFLINE=true
    fi
    # Sync DATABASE_URL to MCP extension directories for sqlx compile-time checks
    if [ "$USE_OFFLINE" = "false" ]; then
        for dir in extensions/mcp/*/; do
            if [ -f "$dir/Cargo.toml" ]; then
                echo "DATABASE_URL=$DATABASE_URL" > "$dir/.env"
            fi
        done
    fi
    cargo update systemprompt --quiet 2>/dev/null || true
    if [ "$USE_OFFLINE" = "true" ]; then
        SQLX_OFFLINE=true cargo build --workspace {{FLAGS}}
    else
        # Apply pending schema migrations before the online sqlx compile-time
        # check sees the live DB. Build the CLI in offline mode first so
        # drift between checked-in `.sqlx/` and the unmigrated live schema
        # can't deadlock the bootstrap.
        echo "Applying pending migrations before online build..."
        SQLX_OFFLINE=true cargo build --bin systemprompt --quiet
        target/debug/systemprompt infra db migrate
        SQLX_OFFLINE=false cargo build --workspace {{FLAGS}}
    fi

# Clippy (Windows) - always uses offline mode
[windows]
clippy *FLAGS: lint-no-synthesis lint-gates
    $env:SQLX_OFFLINE="true"; cargo clippy --workspace {{FLAGS}} -- -D warnings

# Clippy (Unix) - single-flight, same coordinator as `just build`
[unix]
clippy *FLAGS:
    @scripts/build-coordinator.sh run clippy "{{FLAGS}}" -- {{just_executable()}} _clippy-uncoordinated {{FLAGS}}

# The real clippy. Call `just clippy` instead - this one skips coordination.
[unix]
_clippy-uncoordinated *FLAGS: lint-no-synthesis lint-gates
    #!/usr/bin/env bash
    set -euo pipefail
    SECRETS_FILE="{{justfile_directory()}}/.systemprompt/profiles/local/secrets.json"
    USE_OFFLINE=false
    db_reachable() {
        local url="$1"
        local pgcmd=""
        if command -v pg_isready >/dev/null 2>&1; then pgcmd="pg_isready"
        elif [ -x /opt/homebrew/opt/libpq/bin/pg_isready ]; then pgcmd="/opt/homebrew/opt/libpq/bin/pg_isready"
        elif [ -x /usr/local/opt/libpq/bin/pg_isready ]; then pgcmd="/usr/local/opt/libpq/bin/pg_isready"
        fi
        if [ -n "$pgcmd" ]; then
            "$pgcmd" -d "$url" -t 2 >/dev/null 2>&1 && return 0 || return 1
        fi
        local hostport="${url#*@}"; hostport="${hostport%%/*}"
        local host="${hostport%:*}"; local port="${hostport##*:}"
        [ "$port" = "$host" ] && port=5432
        (exec 3<>/dev/tcp/"$host"/"$port") >/dev/null 2>&1 && { exec 3<&-; exec 3>&-; return 0; } || return 1
    }
    if [ -f "$SECRETS_FILE" ]; then
        DB_URL=$(sed -n 's/.*"database_url"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$SECRETS_FILE" 2>/dev/null | head -1)
        if [ -n "$DB_URL" ] && [ "$DB_URL" != "null" ]; then
            if db_reachable "$DB_URL"; then
                export DATABASE_URL="$DB_URL"
            else
                USE_OFFLINE=true
            fi
        else
            USE_OFFLINE=true
        fi
    else
        USE_OFFLINE=true
    fi
    if [ "$USE_OFFLINE" = "true" ]; then
        SQLX_OFFLINE=true cargo clippy --workspace {{FLAGS}} -- -D warnings
    else
        SQLX_OFFLINE=false cargo clippy --workspace {{FLAGS}} -- -D warnings
    fi

# Unit tests: extensions/web/admin (main workspace) + the tests/ workspace.
# If sqlx offline errors appear, run `just prepare` first to refresh .sqlx.
test-unit:
    @scripts/build-coordinator.sh run test-unit "" -- {{just_executable()}} _test-unit-uncoordinated

_test-unit-uncoordinated:
    cargo nextest run -p systemprompt-web-admin --tests
    cargo nextest run -p systemprompt-web-extension --tests
    cargo nextest run --manifest-path tests/Cargo.toml -p mcp-unit-tests -p web-unit-tests

# DB-backed integration tests. Creates/drops throwaway mcp_ext_test_*
# databases on the maintenance DB; the harness guard refuses any database
# name that is not 'test', 'postgres', or '*_test'. Falls back to the local
# profile's server with the database swapped to 'postgres'.
test-integration:
    @scripts/build-coordinator.sh run test-integration "" -- {{just_executable()}} _test-integration-uncoordinated

_test-integration-uncoordinated:
    #!/usr/bin/env bash
    set -euo pipefail
    if [ -z "${SYSTEMPROMPT_TEST_DATABASE_URL:-}" ] && [ -f .systemprompt/profiles/local/secrets.json ]; then
        SYSTEMPROMPT_TEST_DATABASE_URL=$(python3 -c "
    import json, urllib.parse as up
    u = up.urlsplit(json.load(open('.systemprompt/profiles/local/secrets.json'))['database_url'])
    print(up.urlunsplit((u.scheme, u.netloc, '/postgres', '', '')))")
        export SYSTEMPROMPT_TEST_DATABASE_URL
    fi
    cargo nextest run --manifest-path tests/Cargo.toml -p mcp-integration-tests -p web-integration-tests -p admin-db-core-tests -p admin-db-config-tests

# HTTP contract suite: drives every admin route under three principals and
# diffs the result against tests/contract/admin/baseline.txt. Same throwaway-
# database convention as test-integration. A status change fails the run; if
# it is deliberate, re-record with UPDATE_CONTRACT_BASELINE=1 and list it in
# the PR.
test-contract:
    @scripts/build-coordinator.sh run test-contract "" -- {{just_executable()}} _test-contract-uncoordinated

_test-contract-uncoordinated:
    #!/usr/bin/env bash
    set -euo pipefail
    if [ -z "${SYSTEMPROMPT_TEST_DATABASE_URL:-}" ] && [ -f .systemprompt/profiles/local/secrets.json ]; then
        SYSTEMPROMPT_TEST_DATABASE_URL=$(python3 -c "
    import json, urllib.parse as up
    u = up.urlsplit(json.load(open('.systemprompt/profiles/local/secrets.json'))['database_url'])
    print(up.urlunsplit((u.scheme, u.netloc, '/postgres', '', '')))")
        export SYSTEMPROMPT_TEST_DATABASE_URL
    fi
    cargo nextest run --manifest-path tests/Cargo.toml -p admin-contract-tests

# All tests
test: test-unit test-integration test-contract

# Source gates ported from systemprompt-core (scripts/*.sh)
# Both workspaces must build on the declared minimum supported Rust version,
# and must declare the same one. The number is read from the manifests, never
# hardcoded — see scripts/check-msrv.sh for why that matters.
msrv-check:
    bash scripts/check-msrv.sh

lint-gates:
    @scripts/build-coordinator.sh run lint-gates "" -- {{just_executable()}} _lint-gates-uncoordinated

# Gates are independent read-only checks; they run concurrently and every
# failure is reported, so one red gate cannot hide the rest.
_lint-gates-uncoordinated:
    #!/usr/bin/env bash
    set -uo pipefail
    gates=(
        lint-schema.sh
        lint-extensions.sh
        check-sqlx.sh
        check-http-errors.sh
        check-test-value.sh
        lint-raw-ids.sh
        check-glob-reexports.sh
        check-comments.sh
        lint-inline-comments.sh
        check-duplicate-types.sh
        check-repository-naming.sh
        check-admin-template-links.sh
        check-admin-template-assets.sh
        # admin-css-classes + frontend-standards now run as cargo tests in
        # extensions/web/tests/ (admin_css_classes.rs, frontend_standards.rs).
        check-fork-drift.sh
        check-dead-repository-code.sh
        check-file-headers.sh
        check-file-size.sh
        check-asset-reachability.sh
        check-workspace-deps.sh
        validate-services.sh
        check-release-tag.sh
    )
    logdir=$(mktemp -d)
    trap 'rm -rf "$logdir"' EXIT
    pids=()
    for gate in "${gates[@]}"; do
        bash "scripts/$gate" >"$logdir/$gate.log" 2>&1 &
        pids+=("$!:$gate")
    done
    failed=()
    for entry in "${pids[@]}"; do
        pid=${entry%%:*}
        gate=${entry#*:}
        if ! wait "$pid"; then
            failed+=("$gate")
        fi
    done
    if [ ${#failed[@]} -gt 0 ]; then
        for gate in "${failed[@]}"; do
            echo "==== FAILED: $gate ===="
            cat "$logdir/$gate.log"
        done
        echo "lint gates failed: ${failed[*]}"
        exit 1
    fi
    echo "all ${#gates[@]} lint gates passed"

# Cross-file referential integrity for services/ (ACL entity ids, MCP ports)
validate:
    bash scripts/validate-services.sh

# Shared sources that differ from the sibling fork must be recorded in
# .fork-divergence. Needs SIBLING_REPO; skips cleanly without it.
check-fork-drift:
    bash scripts/check-fork-drift.sh

# Verify every production extension source has a `//!` module head
check-headers:
    bash scripts/check-file-headers.sh

# Observational Rust-standards audit — appends to ISSUE.md, never blocks
audit-standards:
    bash scripts/audit-rust-standards.sh

# 300-line ceiling on extension sources (same script CI runs)
file-size:
    bash scripts/check-file-size.sh

# Detect unused dependencies (same check the CI machete job runs)
machete:
    cargo machete

# Supply-chain gates: cargo-deny (licenses/bans/advisories) and cargo-audit
deny:
    cargo deny check

check-bans:
    cargo deny check bans

audit:
    cargo audit

# Structural guard: no string-literal `UserId::new("...")` in extension code.
# String literals are how principal synthesis sneaks in — every legitimate
# UserId::new call takes a validated identifier as a variable, never a literal.
# Allowlisted: test code (regression tests intentionally construct ids) and
# any future bootstrap/provisioning module.
lint-no-synthesis:
    #!/usr/bin/env bash
    set -euo pipefail
    hits=$(grep -rEn 'UserId::new\("' extensions/ \
        --include='*.rs' \
        --exclude-dir=tests \
        --exclude-dir=bootstrap \
        || true)
    if [ -n "$hits" ]; then
        echo "error: forbidden synthesized principal — UserId::new with string literal"
        echo "$hits"
        echo
        echo "UserId::new must take a validated identifier (from cookie, query,"
        echo "JWT claim, or DB row), never a hard-coded literal. If this is"
        echo "legitimate bootstrap code, move it to extensions/**/bootstrap/."
        exit 1
    fi

# Prepare SQLx offline query cache (requires running database)
prepare:
    #!/usr/bin/env bash
    set -euo pipefail
    SECRETS_FILE="{{justfile_directory()}}/.systemprompt/profiles/local/secrets.json"
    if [ ! -f "$SECRETS_FILE" ]; then
        echo "Error: No local profile secrets found at $SECRETS_FILE"
        echo "Run 'just db-up' first to start the database"
        exit 1
    fi
    DB_URL=$(jq -r '.database_url // empty' "$SECRETS_FILE" 2>/dev/null)
    if [ -z "$DB_URL" ] || [ "$DB_URL" = "null" ]; then
        echo "Error: No database_url in secrets"
        exit 1
    fi
    PG_ISREADY=""
    if command -v pg_isready >/dev/null 2>&1; then PG_ISREADY="pg_isready"
    elif [ -x /opt/homebrew/opt/libpq/bin/pg_isready ]; then PG_ISREADY="/opt/homebrew/opt/libpq/bin/pg_isready"
    elif [ -x /usr/local/opt/libpq/bin/pg_isready ]; then PG_ISREADY="/usr/local/opt/libpq/bin/pg_isready"
    fi
    if [ -z "$PG_ISREADY" ] || ! "$PG_ISREADY" -d "$DB_URL" -t 2 >/dev/null 2>&1; then
        echo "Error: Database not reachable at $DB_URL"
        echo "Run 'just db-up' first to start the database"
        exit 1
    fi
    # Apply pending migrations before sqlx prepare — otherwise the macros
    # see a schema older than the code references and fail with
    # "relation ... does not exist". Skipped if no CLI binary exists yet
    # (first-time bootstrap before any build).
    if [ -x "{{CLI}}" ]; then
        echo "Applying pending migrations..."
        {{CLI}} infra db migrate --profile local
    else
        echo "Warning: no systemprompt binary yet; skipping migrate step."
        echo "  If sqlx prepare fails with 'relation does not exist',"
        echo "  build first ('just build') then re-run 'just prepare'."
    fi
    echo "Preparing SQLx offline cache..."
    export DATABASE_URL="$DB_URL"
    # Drop the incremental artifacts of every crate that uses sqlx, so each
    # query macro re-expands against the freshly-migrated schema.
    #
    # This has to be all of them, not just the crate whose schema changed.
    # `cargo sqlx prepare` collects query data emitted by macro expansion, so
    # a crate cargo considers fresh contributes nothing to the run and its
    # queries are pruned from .sqlx as though they no longer existed. That is
    # what made prepare non-deterministic: a cold cache re-expanded everything
    # and kept the full set, while a warm one silently dropped whatever it did
    # not rebuild (the event_outbox queries from systemprompt-events being the
    # usual casualty). The emitted set must not depend on target/ state.
    #
    # Dependencies count too, not just workspace members — their queries land
    # in the workspace cache the same way.
    SQLX_PKGS=$(cargo metadata --format-version 1 2>/dev/null \
        | jq -r '.packages[] | select(.dependencies[]?.name == "sqlx") | .name' \
        | sort -u)
    if [ -z "$SQLX_PKGS" ]; then
        echo "Error: could not resolve the sqlx-dependent package list."
        echo "Without it, prepare would prune queries it simply did not rebuild."
        exit 1
    fi
    for pkg in $SQLX_PKGS; do
        cargo clean -p "$pkg" 2>/dev/null || true
    done
    # Workspace-level prepare (catches lib crates)
    cargo sqlx prepare --workspace
    # Per-crate prepare for binary/extension crates that cargo sqlx skips.
    #
    # These caches are SCRATCH, not artefacts: each crate's queries are copied
    # into the root .sqlx below and the per-crate directory is then removed.
    # Every crate here is a root workspace member, so the root cache is the one
    # the macros resolve against — `extensions/mcp/systemprompt` is a member
    # that has never had its own cache and builds fine, and a workspace-wide
    # `SQLX_OFFLINE=true cargo check --all-targets` passes with them deleted.
    # Leaving them on disk committed a duplicate copy of the root cache, which
    # is why a routine prepare showed up as a large unrelated diff.
    EXTENSION_DIRS="extensions/web extensions/mcp/shared extensions/mcp/systemprompt"
    for dir in $EXTENSION_DIRS; do
        if [ -f "{{justfile_directory()}}/$dir/Cargo.toml" ]; then
            # Skip crates with no sqlx dependency — prepare would only
            # resurrect an orphaned .sqlx cache.
            if ! grep -qE '^sqlx' "{{justfile_directory()}}/$dir/Cargo.toml"; then
                continue
            fi
            echo "  Preparing $dir..."
            (cd "{{justfile_directory()}}/$dir" && cargo sqlx prepare 2>&1 | tail -1) || true
            if ls "{{justfile_directory()}}/$dir/.sqlx/"*.json >/dev/null 2>&1; then
                cp "{{justfile_directory()}}/$dir/.sqlx/"*.json "{{justfile_directory()}}/.sqlx/"
            fi
            # Scratch, not an artefact — the queries now live in the root cache.
            rm -rf "{{justfile_directory()}}/$dir/.sqlx"
        fi
    done
    echo "SQLx cache prepared successfully ($(ls {{justfile_directory()}}/.sqlx/ | wc -l) queries cached)"

# ══════════════════════════════════════════════════════════════════════════════
# SERVICES & DATABASE
# ══════════════════════════════════════════════════════════════════════════════

# Start server (always uses local profile)
start:
    #!/usr/bin/env bash
    set -euo pipefail
    if [ -f .systemprompt/docker/local.yaml ]; then
        just db-up local
    fi
    exec {{CLI}} infra services start --profile local

# Optional: running server + binary provenance + recent build/lint/test results
[unix]
server-status:
    @scripts/server-state.sh report

# Start server with release binary
start-release:
    #!/usr/bin/env bash
    set -euo pipefail
    if [ -f .systemprompt/docker/local.yaml ]; then
        just db-up local
    fi
    exec {{CLI_RELEASE}} infra services start --profile local

# Run migrations
migrate:
    #!/usr/bin/env bash
    set -euo pipefail
    if [ -z "${SYSTEMPROMPT_PROFILE:-}" ]; then
        export SYSTEMPROMPT_PROFILE="{{justfile_directory()}}/.systemprompt/profiles/local/profile.yaml"
    fi
    {{CLI}} infra db migrate

# When an already-applied migration file is edited (e.g. a seed fix), its
# stored checksum stops matching the file and `migrate` / `start` refuse to
# proceed. `infra db migrate-repair` re-aligns the tracking table by dropping
# the drifted rows and re-applying those migrations — every migration is
# idempotent (guarded seeds or CREATE ... IF NOT EXISTS), so re-running them
# re-records the current checksum without touching your data.
# Repair migration checksum drift in place — no data loss, no destructive reset.
repair-migrations:
    {{CLI}} infra db migrate-repair --apply

# Per-clone docker compose project name. Derived from the absolute justfile directory
# so a second clone on the same host gets its own containers and volumes.
_project_name TENANT:
    #!/usr/bin/env bash
    set -euo pipefail
    HASH=$(printf '%s' "{{justfile_directory()}}" | { sha256sum 2>/dev/null || shasum -a 256; } | cut -c1-8)
    LEAF=$(basename "{{justfile_directory()}}" | tr '_' '-' | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9-]/-/g')
    printf 'sp-%s-%s-%s\n' "$LEAF" "$HASH" "{{TENANT}}"

# Start PostgreSQL for a specific tenant (default: local)
db-up TENANT="local":
    docker compose -p "$(just _project_name {{TENANT}})" -f .systemprompt/docker/{{TENANT}}.yaml up -d

# Stop PostgreSQL for a specific tenant
db-down TENANT="local":
    docker compose -p "$(just _project_name {{TENANT}})" -f .systemprompt/docker/{{TENANT}}.yaml down

# Show PostgreSQL logs for a specific tenant
db-logs TENANT="local":
    docker compose -p "$(just _project_name {{TENANT}})" -f .systemprompt/docker/{{TENANT}}.yaml logs -f

# List all tenant databases
db-list:
    @ls -1 .systemprompt/docker/*.yaml 2>/dev/null | xargs -I {} basename {} .yaml || echo "No tenant databases found"

# ══════════════════════════════════════════════════════════════════════════════
# AUTH & TENANT & PROFILE
# ══════════════════════════════════════════════════════════════════════════════

# Authenticate with SystemPrompt Cloud
login ENV="production":
    {{CLI}} cloud auth login {{ENV}}

# Clear saved credentials
logout:
    {{CLI}} cloud auth logout

# Show current user and tenant
whoami:
    {{CLI}} cloud auth whoami

# Tenant operations (interactive menu)
tenant:
    {{CLI}} cloud tenant

# Set up a local-only profile + Docker Postgres (no cloud, no login required).
# Pass keys as positional args, or leave blank to be prompted interactively:
#   just setup-local sk-ant-... sk-... AIza...
# Port and Postgres port can be overridden for running multiple clones on one host:
#   just setup-local sk-ant-... "" "" 8081 5433
# A bare re-run preserves the ports chosen at first setup (read back from the
# profile/compose files), so it never reverts a non-default install to 8080/5432.
# ADMIN_EMAIL defaults to `git config user.email`.
setup-local ANTHROPIC_KEY="" OPENAI_KEY="" GEMINI_KEY="" HTTP_PORT="8080" PG_PORT="5432" ADMIN_EMAIL="":
    #!/usr/bin/env bash
    set -euo pipefail
    ROOT="{{justfile_directory()}}"
    PROFILE_DIR="$ROOT/.systemprompt/profiles/local"
    DOCKER_DIR="$ROOT/.systemprompt/docker"
    ANTHROPIC_KEY="{{ANTHROPIC_KEY}}"
    OPENAI_KEY="{{OPENAI_KEY}}"
    GEMINI_KEY="{{GEMINI_KEY}}"
    HTTP_PORT="{{HTTP_PORT}}"
    PG_PORT="{{PG_PORT}}"
    ADMIN_EMAIL="{{ADMIN_EMAIL}}"
    if [ -z "$ADMIN_EMAIL" ]; then
        ADMIN_EMAIL="$(git config user.email 2>/dev/null || true)"
    fi
    if [ -z "$ADMIN_EMAIL" ]; then
        ADMIN_EMAIL="admin@localhost.localdomain"
    fi
    export SYSTEMPROMPT_PROFILE="$PROFILE_DIR/profile.yaml"
    # Default ports on a re-run mean "keep what I had", not "move me back to
    # 8080/5432": read the original choice back from the files setup wrote.
    if [ "$HTTP_PORT" = "8080" ] && [ -f "$PROFILE_DIR/profile.yaml" ]; then
        SAVED_HTTP="$(sed -n 's/^ *port: //p' "$PROFILE_DIR/profile.yaml" | head -1)"
        if [ -n "$SAVED_HTTP" ]; then
            HTTP_PORT="$SAVED_HTTP"
        fi
    fi
    if [ "$PG_PORT" = "5432" ] && [ -f "$DOCKER_DIR/local.yaml" ]; then
        SAVED_PG="$(sed -n 's/.*"\([0-9][0-9]*\):5432".*/\1/p' "$DOCKER_DIR/local.yaml" | head -1)"
        if [ -n "$SAVED_PG" ]; then
            PG_PORT="$SAVED_PG"
        fi
    fi
    # Whether a key was passed as a positional arg. When none is and there is
    # nothing to preserve, generation still needs a provider: on a TTY we let
    # `admin setup` drive its own "Select your AI provider" menu (the CLI owns
    # the prompt); off a TTY we cannot prompt, so keys must come as args. A
    # developer who keeps .systemprompt/ across reclones re-runs with no args
    # and is never asked again (the profile.yaml guard below skips generation).
    HAS_KEY=false
    if [ -n "$ANTHROPIC_KEY" ] || [ -n "$OPENAI_KEY" ] || [ -n "$GEMINI_KEY" ]; then
        HAS_KEY=true
    fi
    if [ "$HAS_KEY" = false ] && [ ! -f "$PROFILE_DIR/secrets.json" ] && [ ! -t 0 ]; then
        echo ""
        echo "================================================================"
        echo "  setup-local needs an AI provider API key"
        echo "================================================================"
        echo ""
        echo "  Not running on a TTY, so the provider menu can't be shown."
        echo "  Pass a key as an argument (one of Anthropic, OpenAI, Gemini):"
        echo "    just setup-local <anthropic_key> [openai_key] [gemini_key]"
        echo ""
        exit 1
    fi
    if [ ! -x target/debug/systemprompt ] && [ ! -x target/release/systemprompt ]; then
        echo "Building debug binary..."
        just build
    fi
    # Resolve the binary at runtime: the {{CLI}} variable is evaluated by `just`
    # at parse time, so on a cold clone (no binary yet) it expands to an error
    # stub — useless for the bootstrap/keygen calls below, which run only after
    # the build above has produced the binary.
    if [ -x target/release/systemprompt ]; then
        BIN="$ROOT/target/release/systemprompt"
    else
        BIN="$ROOT/target/debug/systemprompt"
    fi
    mkdir -p "$PROFILE_DIR" "$DOCKER_DIR"
    # Rewrite the compose file when it exists but pins a different host port.
    # Guarding only on existence meant a re-run with a new PG_PORT kept the old
    # mapping, brought Postgres up on the old port, and then waited 60s for the
    # new one before dying on "Postgres did not become ready" — which names the
    # symptom and hides the cause.
    if [ -f "$DOCKER_DIR/local.yaml" ] \
        && ! grep -q "\"${PG_PORT}:5432\"" "$DOCKER_DIR/local.yaml"; then
        echo "Docker compose pins a different host port; rewriting for $PG_PORT."
        echo "Recreating the container so the new mapping takes effect..."
        docker compose -p "$(just _project_name local)" -f "$DOCKER_DIR/local.yaml" down 2>/dev/null || true
        rm -f "$DOCKER_DIR/local.yaml"
    fi
    if [ ! -f "$DOCKER_DIR/local.yaml" ]; then
        echo "Writing Docker compose for local Postgres (host port $PG_PORT)..."
        cat > "$DOCKER_DIR/local.yaml" <<YAML
    services:
      postgres:
        image: postgres:18-alpine
        restart: unless-stopped
        environment:
          POSTGRES_USER: systemprompt
          POSTGRES_PASSWORD: 123
          POSTGRES_DB: systemprompt
        ports:
          - "${PG_PORT}:5432"
        volumes:
          - postgres_data:/var/lib/postgresql
        healthcheck:
          test: ["CMD-SHELL", "pg_isready -U systemprompt -d systemprompt"]
          interval: 5s
          timeout: 5s
          retries: 5
    volumes:
      postgres_data: {}
    YAML
    fi
    echo "Starting local Postgres via Docker..."
    just db-up local
    echo "Waiting for Postgres to accept connections on localhost:${PG_PORT}..."
    for i in $(seq 1 60); do
        if (exec 3<>/dev/tcp/127.0.0.1/${PG_PORT}) 2>/dev/null; then
            exec 3<&- 3>&-
            # Also confirm the server actually answers pg_isready, not just a half-open socket.
            CONTAINER=$(docker compose -p "$(just _project_name local)" -f .systemprompt/docker/local.yaml ps -q postgres)
            if [ -n "$CONTAINER" ] && docker exec "$CONTAINER" pg_isready -U systemprompt -d systemprompt >/dev/null 2>&1; then
                echo "Postgres is ready."
                break
            fi
        fi
        if [ "$i" = "60" ]; then
            echo "ERROR: Postgres did not become ready within 60s." >&2
            exit 1
        fi
        sleep 1
    done
    if [ ! -f "$PROFILE_DIR/profile.yaml" ]; then
        echo "Generating profile + provider registry + secrets via 'admin setup'..."
        if [ "$HAS_KEY" = true ]; then
            # Keys supplied as args: fully non-interactive. The default provider
            # is the first key given, so the generated config (the providers
            # registry, gateway default, ai/config.yaml) is consistent with the
            # single key.
            KEY_ARGS=()
            DEFAULT_PROVIDER=""
            if [ -n "$ANTHROPIC_KEY" ]; then KEY_ARGS+=(--anthropic-key "$ANTHROPIC_KEY"); [ -z "$DEFAULT_PROVIDER" ] && DEFAULT_PROVIDER=anthropic; fi
            if [ -n "$OPENAI_KEY" ]; then KEY_ARGS+=(--openai-key "$OPENAI_KEY"); [ -z "$DEFAULT_PROVIDER" ] && DEFAULT_PROVIDER=openai; fi
            if [ -n "$GEMINI_KEY" ]; then KEY_ARGS+=(--gemini-key "$GEMINI_KEY"); [ -z "$DEFAULT_PROVIDER" ] && DEFAULT_PROVIDER=gemini; fi
            "$BIN" admin setup --yes --no-migrate --environment local \
                --db-host localhost --db-port "$PG_PORT" \
                --db-user systemprompt --db-password 123 --db-name systemprompt \
                --admin-email "$ADMIN_EMAIL" \
                --default-provider "$DEFAULT_PROVIDER" \
                "${KEY_ARGS[@]}"
        else
            # No key arg: let the CLI prompt for which provider to use. DB,
            # environment, and migrations stay non-interactive (flags + env);
            # only the provider selection is interactive, and the chosen
            # provider becomes the default.
            SYSTEMPROMPT_NON_INTERACTIVE=1 "$BIN" admin setup --no-migrate --environment local \
                --db-host localhost --db-port "$PG_PORT" \
                --db-user systemprompt --db-password 123 --db-name systemprompt \
                --admin-email "$ADMIN_EMAIL"
        fi
        if [ "$HTTP_PORT" != "8080" ]; then
            "$BIN" admin config server set --port "$HTTP_PORT" \
                --api-server-url "http://localhost:${HTTP_PORT}" \
                --api-internal-url "http://localhost:${HTTP_PORT}" \
                --api-external-url "http://localhost:${HTTP_PORT}"
            # The authz hook URL is an absolute webhook target baked at
            # `admin setup` time on the default port; re-point it at the
            # chosen port so the gateway's govern callback reaches this server.
            "$BIN" admin config governance set --mode webhook \
                --url "http://localhost:${HTTP_PORT}/api/public/govern/authz"
            # Tokens carry the issuer, and a validator resolves (issuer, kid)
            # by fetching that issuer's JWKS. Left on the default port it
            # points at whatever else owns 8080, so every MCP tool call fails
            # with "kid does not match any known signing key".
            "$BIN" admin config security set --jwt-issuer "http://localhost:${HTTP_PORT}"
            # CORS is seeded on the default port too, so the admin UI served
            # from the chosen port is refused by its own API.
            "$BIN" admin config server cors add "http://localhost:${HTTP_PORT}" || true
            "$BIN" admin config server cors add "http://127.0.0.1:${HTTP_PORT}" || true
            "$BIN" admin config server cors remove "http://localhost:8080" || true
            "$BIN" admin config server cors remove "http://127.0.0.1:8080" || true
        fi
    elif [ "$HAS_KEY" = true ]; then
        # Profile generation is one-shot, guarded on profile.yaml. `just db-down`
        # drops the database but leaves the profile, so a re-run with different
        # keys would silently keep the old provider registry. Say so loudly and
        # point at the one command that actually re-provisions.
        echo ""
        echo "================================================================"
        echo "  Existing profile reused — supplied keys were NOT applied"
        echo "================================================================"
        echo ""
        echo "  $PROFILE_DIR/profile.yaml already exists, so 'admin setup' was"
        echo "  skipped and the provider registry/keys are unchanged."
        echo "  To re-provision from the keys you just passed:"
        echo ""
        echo "    rm -rf \"$PROFILE_DIR\" && just setup-local <keys...> $HTTP_PORT $PG_PORT"
        echo ""
    fi
    mkdir -p "$ROOT/web/dist"
    echo "Building binaries (release, full workspace)..."
    just build --release
    echo "Running database migrations..."
    just migrate
    echo "Ensuring bootstrap admin user ($ADMIN_EMAIL)..."
    "$BIN" admin bootstrap --email "$ADMIN_EMAIL"
    if [ ! -f "$ROOT/signing_key.pem" ]; then
        echo "Generating JWT signing key..."
        "$BIN" admin keys generate --output "$ROOT/signing_key.pem"
    fi
    echo "Publishing assets..."
    just publish
    echo ""
    echo "Local setup complete. Run: just start"

# List all tenants
tenants:
    {{CLI}} cloud tenant list

# Profile operations (interactive menu)
profile:
    {{CLI}} cloud profile

# List all profiles
profiles:
    {{CLI}} cloud profile list

# ══════════════════════════════════════════════════════════════════════════════
# SYNC
# ══════════════════════════════════════════════════════════════════════════════

# Content and skills are ingested from services/ at server startup and by
# `just publish` (publish_pipeline job); there is no separate local sync command.

# Core 0.29.0 removed `cloud sync`. Pushing is `just deploy` (cloud deploy),
# and pulling is `cloud backup`, which downloads the tenant's runtime services/
# tree. The old sync-push / sync-pull recipes called a command that no longer
# exists, so they are gone rather than aliased to something they never were.

# Download the tenant's runtime services/ tree (--list to inspect first)
backup *ARGS:
    {{CLI}} cloud backup "$@"

# ══════════════════════════════════════════════════════════════════════════════
# DEPLOY
# ══════════════════════════════════════════════════════════════════════════════

# Deploy to cloud
# Note: publish_pipeline runs automatically on server startup with correct profile URLs
deploy *FLAGS:
    just build --release
    {{CLI_RELEASE}} cloud deploy {{FLAGS}}

# Check deployment status
status:
    {{CLI}} cloud status

# ══════════════════════════════════════════════════════════════════════════════
# MCP & BUILD ALL
# ══════════════════════════════════════════════════════════════════════════════

# Build all MCP servers (reads from manifest.yaml files)
# Single-flight and fingerprint-skipped: a tree whose MCP servers already
# built returns immediately instead of re-paying the per-package rebuild.
build-mcp:
    @scripts/build-coordinator.sh run build-mcp "" -- {{just_executable()}} _build-mcp-uncoordinated

_build-mcp-uncoordinated:
    DATABASE_URL="$(just _db-url)" {{CLI}} build mcp --release

# Build everything for deployment (Rust binary + MCP servers + web assets)
build-all:
    just build --release
    just build-mcp
    just web-build
    {{CLI_RELEASE}} infra jobs run publish_pipeline
    @echo "All components built"

# ══════════════════════════════════════════════════════════════════════════════
# WEB ASSETS & PUBLISHING
# ══════════════════════════════════════════════════════════════════════════════

# Copy web assets to dist (CSS, JS, images)
web-assets:
    {{CLI}} infra jobs run copy_extension_assets

# Publish: compile templates, bundle CSS/JS, copy assets, prerender content
publish:
    #!/usr/bin/env bash
    set -euo pipefail
    if [ -z "${SYSTEMPROMPT_PROFILE:-}" ]; then
        export SYSTEMPROMPT_PROFILE="{{justfile_directory()}}/.systemprompt/profiles/local/profile.yaml"
    fi
    {{CLI}} infra jobs run publish_pipeline

# Build web assets only (templates + CSS + JS + copy to dist)
web-build:
    {{CLI}} infra jobs run bundle_admin_css
    {{CLI}} infra jobs run copy_extension_assets

# ══════════════════════════════════════════════════════════════════════════════
# DOCKER
# ══════════════════════════════════════════════════════════════════════════════

# Build Docker image for local testing
docker-build TAG="local":
    docker build -f Dockerfile -t systemprompt-template:{{TAG}} .

# Run image locally for testing
docker-run TAG="local":
    docker run -p 8080:8080 --env-file .env systemprompt-template:{{TAG}}

# Test build without pushing
docker-test:
    just build-all
    just docker-build test
    @echo "Docker build successful! Image: systemprompt-template:test"

# ══════════════════════════════════════════════════════════════════════════════
# AIR-GAPPED SCENARIO
# ══════════════════════════════════════════════════════════════════════════════

# Bring up the network-isolated air-gap stack (postgres + mock-inference + app + monitor + ingress)
airgap-up:
    #!/usr/bin/env bash
    set -euo pipefail
    # Dockerfile.airgap-prebuilt COPYs the host-built binaries from
    # deploy/scenarios/airgap/.bin/ — `target` is a symlink to a shared cargo
    # cache that buildkit can't follow, so we dereference-copy them in first
    # (mirrors scaled-up).
    if [[ ! -x target/release/systemprompt || ! -x target/release/systemprompt-mcp-agent ]]; then
        echo "ERROR: release binaries missing. Run: just build --release" >&2
        exit 1
    fi
    mkdir -p deploy/scenarios/airgap/.bin
    cp -L target/release/systemprompt           deploy/scenarios/airgap/.bin/systemprompt
    cp -L target/release/systemprompt-mcp-agent deploy/scenarios/airgap/.bin/systemprompt-mcp-agent
    docker compose -f deploy/scenarios/airgap/docker-compose.airgap.yml up -d --build

# Tear down the air-gap stack and remove its volumes
airgap-down:
    docker compose -f deploy/scenarios/airgap/docker-compose.airgap.yml down -v

# ONE-COMMAND air-gap proof. Ensures the sealed stack is up (builds the image
# only if it is missing), warm-builds the loadtest crate so the run emits no
# compiler spew, runs all three assertion scripts (01 egress, 02 load,
# 03 governance) WITHOUT dying on the first failure, then prints a single
# PASS/FAIL summary. Leaves the stack up for inspection by default — pass
# TEARDOWN=true to remove it (and its volumes) at the end.
#
#   just airgap                # run, leave stack up
#   just airgap TEARDOWN=true  # run, then tear down
airgap TEARDOWN="false":
    #!/usr/bin/env bash
    set -uo pipefail
    COMPOSE_FILE="deploy/scenarios/airgap/docker-compose.airgap.yml"
    PORT="${AIRGAP_HTTP_PORT:-8090}"
    LOADTEST_MANIFEST="../systemprompt-core/crates/tests/loadtest/Cargo.toml"

    # 1. Ensure the stack is up. Build the image only if it is not present yet
    #    (a first-time build pulls in ../systemprompt-core and takes ~10 min).
    if curl -fsS -o /dev/null --max-time 3 "http://localhost:${PORT}/api/v1/health" 2>/dev/null; then
      echo "  air-gap stack already healthy on :${PORT}"
    else
      if docker compose -f "$COMPOSE_FILE" config --images 2>/dev/null \
         | xargs -r -I{} docker image inspect {} >/dev/null 2>&1; then
        echo "  air-gap image present — starting stack (no rebuild)"
        docker compose -f "$COMPOSE_FILE" up -d
      else
        echo "  air-gap image missing — building stack (first run, ~10 min)"
        docker compose -f "$COMPOSE_FILE" up -d --build
      fi
      echo "  waiting for app healthcheck on :${PORT} ..."
      for i in $(seq 1 120); do
        if curl -fsS -o /dev/null "http://localhost:${PORT}/api/v1/health" 2>/dev/null; then
          echo "  app healthy after ${i}s"
          break
        fi
        sleep 1
      done
    fi

    # 2. Warm-build the loadtest crate quietly so STEP 02's `cargo run` emits no
    #    build output mid-demo. Non-fatal: 02-load.sh re-checks the manifest.
    if [[ -f "$LOADTEST_MANIFEST" ]]; then
      echo "  warm-building the loadtest crate ..."
      cargo build --quiet --manifest-path "$LOADTEST_MANIFEST" 2>/dev/null || true
    else
      echo "  loadtest crate not found at ${LOADTEST_MANIFEST} — skipping warm-build" >&2
      echo "  (it is unpublished systemprompt-core dev tooling; 02-load.sh will build it on demand if present)" >&2
    fi

    # 3. Run all three scripts, capturing each exit code (do NOT stop on first
    #    failure — the operator must see the full picture).
    declare -A RESULT
    for s in 01-egress-assert 02-load 03-governance; do
      echo ""
      if "./demo/scenarios/airgap/${s}.sh"; then
        RESULT[$s]="PASS"
      else
        RESULT[$s]="FAIL"
      fi
    done

    # 4. Single PASS/FAIL summary.
    echo ""
    echo "══════════════════════════════════════════════════════════"
    echo "  AIR-GAP PROOF SUMMARY"
    echo "══════════════════════════════════════════════════════════"
    OVERALL=0
    for s in 01-egress-assert 02-load 03-governance; do
      printf "  %-22s %s\n" "$s" "${RESULT[$s]}"
      [[ "${RESULT[$s]}" == "PASS" ]] || OVERALL=1
    done
    echo "══════════════════════════════════════════════════════════"
    [[ "$OVERALL" -eq 0 ]] && echo "  RESULT: PASS" || echo "  RESULT: FAIL"

    # 5. Optional teardown.
    if [[ "{{TEARDOWN}}" == "true" ]]; then
      echo ""
      echo "  TEARDOWN=true — removing the air-gap stack and volumes"
      just airgap-down
    fi

    exit "$OVERALL"

# Run the air-gap demo scripts in sequence, stopping on first failure.
# Policies (quotas/safety) ship as services/gateway/policies.yaml and are
# ingested by the publish_pipeline job at server boot. Model exposure lives
# in the profile provider registry (profile.providers in
# .systemprompt/profiles/airgap/profile.yaml).
airgap-test:
    #!/usr/bin/env bash
    set -euo pipefail
    ./demo/scenarios/airgap/01-egress-assert.sh
    ./demo/scenarios/airgap/02-load.sh
    ./demo/scenarios/airgap/03-governance.sh

# Reproducibility proof: tear down (incl. volumes), bring back up reusing the
# already-built image, run the full assertion suite from zero state. Prints
# wall-clock time. Use this in front of a reviewer who wants to see the demo
# work from a clean container + clean database, without a 10-minute image
# rebuild. Image-level reproducibility is a separate concern — see
# demo/scenarios/airgap/architecture.md §9 (the [patch.crates-io] block
# requires systemprompt-core >= 0.10.4 to be published before the image can
# be rebuilt from this repo in isolation).
airgap-fresh-test:
    #!/usr/bin/env bash
    set -euo pipefail
    COMPOSE_FILE="deploy/scenarios/airgap/docker-compose.airgap.yml"
    # Refuse to run if the image isn't already built — the rebuild path needs
    # the sibling systemprompt-core repo and a 10-minute window, and silently
    # falling into that on a demo machine is a bad surprise.
    if ! docker image inspect airgap-app >/dev/null 2>&1 \
       && ! docker compose -f "$COMPOSE_FILE" config --images 2>/dev/null | head -1 | xargs -I{} docker image inspect {} >/dev/null 2>&1; then
      echo "ERROR: app image not present. First-time build needed:" >&2
      echo "  just airgap-up   # builds the image (~10 min, needs ../systemprompt-core)" >&2
      exit 1
    fi
    START=$(date +%s)
    just airgap-down
    # No --build: reuse the existing image. This is the from-zero DATA reset,
    # not the from-zero BUILD reset.
    docker compose -f "$COMPOSE_FILE" up -d
    echo "Waiting for app healthcheck..."
    for i in $(seq 1 120); do
      if curl -fsS -o /dev/null "http://localhost:${AIRGAP_HTTP_PORT:-8090}/api/v1/health" 2>/dev/null; then
        echo "App healthy after ${i}s"
        break
      fi
      sleep 1
    done
    just airgap-test
    END=$(date +%s)
    echo ""
    echo "═══════════════════════════════════════════════════════"
    echo "  FRESH AIR-GAP RUN COMPLETE in $((END - START))s"
    echo "═══════════════════════════════════════════════════════"

# ══════════════════════════════════════════════════════════════════════════════
# SCALED / DISTRIBUTED SCENARIO
# ══════════════════════════════════════════════════════════════════════════════

# Bring up the multi-replica scaled stack (postgres primary/replica + N app replicas + 1 scheduler + nginx LB)
scaled-up REPLICAS="3":
    #!/usr/bin/env bash
    set -euo pipefail
    # Stage the host-built binaries into a real dir inside the build context —
    # `target` is a symlink to a shared cargo cache that buildkit can't follow.
    if [[ ! -x target/release/systemprompt || ! -x target/release/systemprompt-mcp-agent ]]; then
        echo "ERROR: release binaries missing. Run: just build --release" >&2
        exit 1
    fi
    mkdir -p deploy/scenarios/scaled/.bin
    cp -L target/release/systemprompt           deploy/scenarios/scaled/.bin/systemprompt
    cp -L target/release/systemprompt-mcp-agent deploy/scenarios/scaled/.bin/systemprompt-mcp-agent
    docker compose -f deploy/scenarios/scaled/docker-compose.scaled.yml up -d --build --scale app={{REPLICAS}}

# Tear down the scaled stack and remove its volumes
scaled-down:
    docker compose -f deploy/scenarios/scaled/docker-compose.scaled.yml down -v

# ONE COMMAND: reset → build → up → wait-for-health → mint token → run all fast
# proofs → capture logs → single verdict. Leaves the stack up by default.
#   just scaled-demo                # 3 replicas, stack left up
#   REPLICAS=5 just scaled-demo     # scale wider
#   KEEP=0 just scaled-demo         # tear down at the end
#   SOAK=1 just scaled-demo         # also run the ~1h soak (long!)
scaled-demo:
    #!/usr/bin/env bash
    set -uo pipefail
    chmod +x demo/scenarios/scaled/run.sh
    ./demo/scenarios/scaled/run.sh

# Run the scaled demo scripts in sequence against an ALREADY-RUNNING stack.
# Prefer `just scaled-demo` (full lifecycle). Use this only when the stack is
# already up and healthy. Skips 02-soak.sh — the long (~1h) sustained soak; run
# it on its own when needed: ./demo/scenarios/scaled/02-soak.sh
scaled-test:
    #!/usr/bin/env bash
    set -euo pipefail
    chmod +x demo/scenarios/scaled/01-load.sh \
             demo/scenarios/scaled/03-replica-distribution.sh \
             demo/scenarios/scaled/04-scheduler-exactly-once.sh
    ./demo/scenarios/scaled/01-load.sh
    ./demo/scenarios/scaled/03-replica-distribution.sh
    ./demo/scenarios/scaled/04-scheduler-exactly-once.sh

# ══════════════════════════════════════════════════════════════════════════════
# ADMIN & PLUGINS
# ══════════════════════════════════════════════════════════════════════════════

# Generate WebAuthn setup token for admin user
webauthn-admin EMAIL:
    {{CLI}} admin users webauthn generate-setup-token --email "{{EMAIL}}"

# Generate plugin output
marketplace:
    {{CLI}} core plugins generate

# Update Anthropic official plugins from vendor submodule and reimport
update-anthropic-plugins:
    git submodule update --remote vendor/knowledge-work-plugins
    {{CLI}} infra jobs run import_anthropic_plugins

# ══════════════════════════════════════════════════════════════════════════════
# TERMINAL RECORDINGS (README SVGs)
# ══════════════════════════════════════════════════════════════════════════════

# Regenerate terminal SVG recordings. Pass numbers to limit scope, e.g. `just record-svgs 3 7`.
record-svgs *NUMBERS:
    ./demo/recording/svg/record.sh {{NUMBERS}}

# ══════════════════════════════════════════════════════════════════════════════
# BENCHMARKS
# ══════════════════════════════════════════════════════════════════════════════

# Benchmark the governance endpoint against the running profile.
#
# Why the URL is derived and not hardcoded: this recipe pointed at
# http://localhost:8080 regardless of the profile. On an instance brought up by
# `just setup-local <keys> <http_port> <pg_port>` that benchmarks nothing, or
# worse, whichever unrelated instance happens to hold 8080 -- and it reports a
# number either way. The demos already solve this in demo/_common.sh; this reads
# the same api_server_url.
#
# `hey` must be installed. The old auto-download from
# hey-release.s3.us-east-2.amazonaws.com now answers 403 for every asset, so the
# fallback could only ever produce a confusing failure part-way through a run.
benchmark REQUESTS="200" CONCURRENCY="100":
    #!/usr/bin/env bash
    set -euo pipefail
    ROOT="{{justfile_directory()}}"
    if ! command -v hey >/dev/null 2>&1; then
        echo "benchmark: 'hey' is not installed." >&2
        echo "  Debian/Ubuntu: sudo apt-get install hey" >&2
        echo "  macOS:         brew install hey" >&2
        echo "  Any platform:  go install github.com/rakyll/hey@latest" >&2
        exit 1
    fi
    # SYSTEMPROMPT_PROFILE is not always a profile NAME. `set dotenv-load` pulls
    # in .env, where it is conventionally an absolute path to a profile.yaml --
    # and in a copied .env, a path into a different checkout entirely. Accept
    # both forms and never build a directory out of a path.
    PROFILE_YAML=""
    case "${SYSTEMPROMPT_PROFILE:-}" in
        */*.yaml|*/*.yml) PROFILE_YAML="$SYSTEMPROMPT_PROFILE" ;;
        "")               PROFILE_YAML="$ROOT/.systemprompt/profiles/local/profile.yaml" ;;
        *)                PROFILE_YAML="$ROOT/.systemprompt/profiles/${SYSTEMPROMPT_PROFILE}/profile.yaml" ;;
    esac
    # A profile belonging to another checkout describes another server; prefer
    # this one's if the pointed-at file is outside the tree.
    case "$PROFILE_YAML" in
        "$ROOT"/*) ;;
        *) [ -f "$ROOT/.systemprompt/profiles/local/profile.yaml" ] \
             && PROFILE_YAML="$ROOT/.systemprompt/profiles/local/profile.yaml" ;;
    esac
    BASE_URL="${BASE_URL:-}"
    if [ -z "$BASE_URL" ] && [ -f "$PROFILE_YAML" ]; then
        BASE_URL=$(grep -E '^[[:space:]]*api_server_url:' "$PROFILE_YAML" | head -1 \
            | sed -E 's/.*api_server_url:[[:space:]]*//; s/[[:space:]]*$//; s/^"//; s/"$//')
    fi
    [ -n "$BASE_URL" ] && [ "$BASE_URL" != "null" ] || BASE_URL="http://localhost:8080"
    TOKEN_FILE="$ROOT/demo/.token"
    if [ ! -s "$TOKEN_FILE" ]; then
        echo "benchmark: no token at $TOKEN_FILE — run ./demo/00-preflight.sh first." >&2
        exit 1
    fi
    TOKEN=$(cat "$TOKEN_FILE")
    echo "Governance endpoint at $BASE_URL: {{REQUESTS}} requests, {{CONCURRENCY}} concurrent"
    echo ""
    hey -n {{REQUESTS}} -c {{CONCURRENCY}} -m POST \
        -H "Authorization: Bearer $TOKEN" \
        -H "Content-Type: application/json" \
        -d '{"hook_event_name":"PreToolUse","tool_name":"Read","agent_id":"developer_agent","session_id":"bench","tool_input":{"file_path":"/src/main.rs"}}' \
        "$BASE_URL/api/public/hooks/govern?plugin_id=enterprise-demo"

# Syntax-check install.sh (install.sh is the user-facing installer)
install-sh-test:
    bash -n scripts/install.sh
    shellcheck scripts/install.sh 2>/dev/null || echo "(install shellcheck to lint: apt install shellcheck)"

# Check the Nix flake builds + runs
flake-check:
    nix flake check
    nix run .# -- --version

# --- Release ------------------------------------------------------------

# Step A of a release: bump every version pin to the new core release and
# gate locally (migrate + build + clippy). Review + commit + push, then
# `just release <version>`. See docs/RELEASING.md.
core-bump version:
    @! grep -q '^\[patch\.crates-io\]' Cargo.toml || (echo "ERROR: [patch.crates-io] is active — publish core and re-comment it first" && exit 1)
    scripts/sync-release-version.sh {{version}}
    cargo update -w
    just db-up
    cargo run --bin systemprompt -- infra db migrate || true
    just build
    just clippy
    @echo "core-bump {{version}} complete — review the diff, run tests, commit to main, push, then: just release {{version}}"

# Step B: push the release tag. Everything downstream (image, chart,
# tarballs, smoke tests, GHCR pruning) is automatic from the tag.
release version:
    @test -z "$(git status --porcelain)" || (echo "ERROR: working tree not clean" && exit 1)
    git fetch origin main
    @test "$(git rev-parse HEAD)" = "$(git rev-parse origin/main)" || (echo "ERROR: HEAD != origin/main — push first" && exit 1)
    scripts/sync-release-version.sh {{version}} --check
    git tag "v{{version}}"
    git push origin "v{{version}}"
    @echo "v{{version}} pushed — watch Actions: docker (image), release-gateway (tarballs), helm (chart), smoke-tests"

# Run every pre-release gate against a ref (default: the tip of `next`).
#
# Dispatches the gate workflows on GitHub and waits for them, so the heavy
# compile happens on runners rather than this machine. Nothing runs on a
# schedule and nothing runs on a push to `next` — this is how the gates get
# run, when you decide to run them.
gate REF="":
    #!/usr/bin/env bash
    set -euo pipefail
    REPO=$(gh repo view --json nameWithOwner --jq .nameWithOwner)
    REF="{{REF}}"; [ -n "$REF" ] || REF=$(git rev-parse origin/next)
    REF=$(git rev-parse "$REF")
    echo "Gating ${REF:0:9} on $REPO"
    WFS=(ci.yml quality.yml)
    [ -f .github/workflows/supply-chain.yml ] && WFS+=(supply-chain.yml)
    for wf in "${WFS[@]}"; do
        gh workflow run "$wf" --ref "$(git rev-parse --abbrev-ref HEAD)" -f ref="$REF"
        echo "  dispatched $wf"
    done
    echo "Waiting for results (ctrl-c is safe; the runs continue)..."
    sleep 15
    FAIL=0
    for wf in "${WFS[@]}"; do
        ID=$(gh run list --workflow="$wf" --limit 1 --json databaseId --jq '.[0].databaseId')
        gh run watch "$ID" --exit-status >/dev/null 2>&1 && R=pass || { R=FAIL; FAIL=1; }
        printf "  %-18s %s\n" "$wf" "$R"
    done
    [ "$FAIL" = 0 ] && echo "All gates green for ${REF:0:9} — 'just promote ${REF:0:9}' to open the release PR." \
                    || { echo "Gates failed; main untouched."; exit 1; }

# Open the release pull request from a gated commit onto the protected `main`.
#
# `main` refuses direct pushes, so a PR is the only way in. The commit is frozen
# on the `promote` ref first: a PR headed at `next` would merge whatever `next`
# points at when you merge it, so anything pushed meanwhile would ride along
# ungated. This only OPENS the PR — you review and merge it.
promote SHA="":
    #!/usr/bin/env bash
    set -euo pipefail
    REPO=$(gh repo view --json nameWithOwner --jq .nameWithOwner)
    SHA="{{SHA}}"; [ -n "$SHA" ] || SHA=$(git rev-parse origin/next)
    SHA=$(git rev-parse "$SHA")
    git fetch -q origin main
    if git merge-base --is-ancestor "$SHA" origin/main; then
        echo "main already contains ${SHA:0:9} — nothing to promote."; exit 0
    fi
    echo "Release PR will carry ${SHA:0:9} onto main:"
    git log --oneline origin/main.."$SHA" | sed 's/^/    /'
    git push --force origin "$SHA:refs/heads/promote"
    NUM=$(gh pr list --base main --head promote --state open --json number --jq '.[0].number // empty')
    if [ -z "$NUM" ]; then
        NUM=$(gh api -X POST "repos/$REPO/pulls" -f title="Release: promote next to main" \
                -f head=promote -f base=main \
                -f body="Frozen at $SHA. Gate with 'just gate $SHA' before merging." --jq .number)
    fi
    echo
    echo "Opened https://github.com/$REPO/pull/$NUM"
    echo "Review it, then merge when you are ready:  gh pr merge $NUM --merge"