feat: startup credential gate, production-default endpoint, TUI freeze fix

- fix(tui): arrow keys on an empty table hard-locked the tview event loop
  at 100% CPU (Table's selectable scan never terminates with zero selectable
  rows); row selection now follows data-row presence, regression-tested
- feat(aade): credentials read from YOURDATA_USERNAME / YOURDATA_SUBSCRIPTION_KEY;
  the binary refuses to start in every mode without both, naming the missing vars
- feat: endpoint defaults to production; --dev forces the AADE test endpoint,
  YOURDATA_ENDPOINT is an explicit override (--dev wins)
- build: make build emits bin/yourdata; tcell pinned to tview's declared v2.8.1
- docs: SPECIFICATIONS.md, README.md, CLAUDE.md, tui-rules.md updated to match

Author: alex20465

.claude/rules/tui-rules.md

@@ -13,8 +13,12 @@ These rules apply when working in `internal/tui` — the terminal user-interface
 
 - **Package:** `github.com/rivo/tview` — rich, interactive terminal widgets. Built on
   `github.com/gdamore/tcell/v2` (the screen/event backend).
-- **Version:** pin the latest stable `rivo/tview` and `gdamore/tcell/v2` in `go.mod`. tcell **v2**
-  is mandatory — never import the v1 module path.
+- **Version:** pin the latest stable `rivo/tview` in `go.mod`, and pin `gdamore/tcell/v2` to
+  **exactly the version tview's own `go.mod` declares** (v2.8.1 for tview v0.42.0) — never bump
+  tcell independently of tview. A newer tcell than tview was built against has caused silent
+  startup crashes in terminals that answer tcell's capability queries (e.g. VS Code's integrated
+  terminal), while working fine in a bare PTY. tcell **v2** is mandatory — never import the v1
+  module path.
 - **Imports:** no alias; use the canonical names:
   ```go
   import (

CLAUDE.md

@@ -10,8 +10,10 @@ itself. Layer rules live in `.claude/rules/` (`db-rules.md`, `mcp-server.md`, `t
 One Go binary, no external runtime dependencies: no HTTP listener, no database server, no cgo, no
 daemon, no telemetry, no background network activity. Exactly **two** operations touch the network —
 submit an invoice and fetch a book snapshot — both explicit, synchronous and bounded, through
-`github.com/techthos/yourdata-sdk`. bbolt is the source of truth, not a cache. Credentials come from
-the environment (`AADE_USER_ID`, `AADE_SUB_KEY`, `AADE_ENDPOINT`) and are never persisted.
+`github.com/techthos/yourdata-sdk`. bbolt is the source of truth, not a cache. Credentials
+(`YOURDATA_USERNAME`, `YOURDATA_SUBSCRIPTION_KEY`) come from the environment, are **required at
+startup** in every mode, and are never persisted. The endpoint defaults to **production**; `--dev`
+forces the AADE test endpoint, `YOURDATA_ENDPOINT` is an explicit override (`--dev` wins).
 
 ## Layers & the dependency rule
 

README.md

@@ -11,6 +11,7 @@ tview TUI for humans and an MCP stdio server for AI agents, over one embedded bb
 ```sh
 yourdata          # launch the TUI (sections: Drafts, Submitted, Counterparties, Catalog, Books, Settings)
 yourdata mcp      # serve MCP over stdio for AI agents
+yourdata --dev    # use the AADE development (test) endpoint instead of production
 yourdata -db /path/to/file.db   # explicit database file
 ```
 
@@ -48,16 +49,16 @@ go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
 
 AADE credentials are read from the environment and are **never persisted**:
 
-| Variable | Purpose |
-|---|---|
-| `AADE_USER_ID` | myDATA user id |
-| `AADE_SUB_KEY` | myDATA subscription key |
-| `AADE_ENDPOINT` | Target environment (defaults to the AADE test endpoint) |
-| `YOURDATA_MCP_ALLOW_SUBMIT` | Set to `1` to expose the gated `submit_invoice` MCP tool (sandbox only — it always refuses on production) |
-| `YOURDATA_DB` | Database file path override |
+| Variable | Required | Purpose |
+|---|---|---|
+| `YOURDATA_USERNAME` | yes | myDATA user id |
+| `YOURDATA_SUBSCRIPTION_KEY` | yes | myDATA subscription key |
+| `YOURDATA_ENDPOINT` | no | Explicit endpoint override (default: **production**; `--dev` forces the test endpoint and wins over this) |
+| `YOURDATA_MCP_ALLOW_SUBMIT` | no | Set to `1` to expose the gated `submit_invoice` MCP tool (sandbox only — it always refuses on production) |
+| `YOURDATA_DB` | no | Database file path override |
 
-Missing credentials are not a startup failure — the app runs normally and refuses only the two
-operations that touch the network (submit invoice, fetch book), with an explanation. The active
+The binary refuses to start — in every mode — when `YOURDATA_USERNAME` or
+`YOURDATA_SUBSCRIPTION_KEY` is unset, exiting with an error naming the missing variables. The active
 environment is rendered permanently in the TUI status bar as `[TEST]` or `[PROD]`.
 
 ## MCP

bin/yourdata

@@ -32,6 +32,16 @@ only protocol frames). The database file resolves as `-db` flag > `$YOURDATA_DB`
 `$XDG_DATA_HOME/yourdata/yourdata.db` (defaulting to `~/.local/share/yourdata/yourdata.db`); the
 directory is created on first run. Both surfaces may run **simultaneously** against the same file.
 
+**Startup requirement.** The binary refuses to start — in **every** mode — unless both
+`YOURDATA_USERNAME` and `YOURDATA_SUBSCRIPTION_KEY` are set, exiting immediately with an error that
+names each missing variable. Credentials are read from the environment only and are never persisted.
+
+**Endpoint selection.** The AADE endpoint defaults to **production**. It resolves as: `--dev` flag
+(forces the AADE development/test endpoint, overriding everything) > `YOURDATA_ENDPOINT` (explicit
+endpoint override) > production. Both surfaces honour the same resolution, and the PROD safeguards
+remain regardless of how production was selected: the TUI's typed-`SUBMIT` confirmation and the MCP
+`submit_invoice` refusal on production.
+
 ---
 
 ## Goals & Non-Goals
@@ -72,8 +82,9 @@ Greek tax authority's REST API. That dependency is contained as follows, and no
   pricing, previewing XML and reading history all work with the network down.
 - A network failure surfaces as a `[red]` message in the status bar (TUI) or a tool-level error
   result (MCP). It never crashes the app and never corrupts local state.
-- Missing credentials are **not** a startup failure. The app runs normally and refuses only those
-  two actions, with an explanation.
+- Missing credentials **are a startup failure**: the binary exits with an error naming the missing
+  variables (see the startup requirement above). As defence-in-depth, the two network actions also
+  refuse with an explanation if they are ever reached without credentials.
 
 Also out of scope for v1: multiple issuer entities, multi-branch series scoping, invoice PDF
 rendering, e-mailing invoices, payment tracking, and any AADE endpoint the SDK does not implement
@@ -93,7 +104,7 @@ product and are not defects to be worked around:
 | There is **no cancel/void endpoint**. | Submission is irreversible. Correction is only possible via a credit note (`5.1`/`5.2`) carrying `correlatedInvoices`. This drives the immutability rule and the submit confirmation. |
 | `InvoiceSummaryBuilder.Build()` hardcodes `TotalWithheldAmount`, `TotalStampDutyAmount` and `TotalDeductionsAmount` to `0`, and never populates `ExpensesClassifications` (deliberate TS parity — `summary.go:16-21`). | **We do not call `CalculateSummary()`.** `internal/models` computes all eight totals and both classification groupings itself. |
 | `RequestArgs` exposes `NextPartitionKey`/`NextRowKey` but the SDK does not loop — and its response envelope surfaces a continuation only via `BookInfo.ContinuationToken` (a doc-level token element is discarded). | The fetch use-case follows continuation tokens itself, bounded. A token it cannot split into partition/row keys ends the loop with the snapshot stored and flagged `Partial=true` — never silently truncated. |
-| `LoadConfig()` reads `AADE_USER_ID`, `AADE_SUB_KEY`, `AADE_ENDPOINT` from the environment. | Credentials are environment-only and never persisted. |
+| The SDK's own `LoadConfig()` reads `AADE_*` variables — this app does **not** use it. It builds `sdk.Config` itself from `YOURDATA_USERNAME`, `YOURDATA_SUBSCRIPTION_KEY`, `YOURDATA_ENDPOINT`. | Credentials are environment-only, app-prefixed, and never persisted. |
 | `sdk.ResponseDoc.InvoiceMark` is `*int64` (~15 digits). | Stored as `int64`; **serialised as a decimal string** in all MCP output, so JS-based MCP clients cannot lose precision. |
 
 The SDK is used for what it is good at: AADE enum constants, XML marshalling (`MarshalInvoicesDoc`),
@@ -260,7 +271,7 @@ grouped too**.
 | Field | Type | Notes |
 |---|---|---|
 | `SubmittedAt` | `time.Time` | |
-| `Endpoint` | `string` | The `AADE_ENDPOINT` in force — records test vs. prod. |
+| `Endpoint` | `string` | The resolved endpoint in force — records test vs. prod. |
 | `StatusCode` | `string` | From `sdk.ResponseDoc`. |
 | `Mark` | `int64` | AADE MARK. **Serialised as a decimal string in MCP output.** |
 | `UID` | `string` | `invoiceUid`. |
@@ -390,7 +401,7 @@ counterparty names are resolved within the transaction so an invoice stays finda
 1. **Validate locally.** Reject if: no lines; `Series` or `AA` blank; no `InvoiceType`; no
    counterparty; a line has `VATCategory == "7"` without a `VATExemptionCategory`; `Currency != EUR`
    without an `ExchangeRate`; or the status is already `submitted`.
-2. **Check credentials.** Missing `AADE_USER_ID`/`AADE_SUB_KEY` → refuse with an explanatory
+2. **Check credentials.** Missing `YOURDATA_USERNAME`/`YOURDATA_SUBSCRIPTION_KEY` → refuse with an explanatory
    message. No network call attempted.
 3. **Freeze and marshal.** Resolve the counterparty into a `Party` copy, recompute the summary, map
    to `sdk.Invoice`, `sdk.MarshalInvoicesDoc`.
@@ -473,7 +484,7 @@ including `create_invoice_draft` and every other draft-building, reference-data
 Exactly one tool is gated:
 
 - **`submit_invoice`** is registered **only** when `YOURDATA_MCP_ALLOW_SUBMIT=1`, and even then it
-  **refuses at call time** when `AADE_ENDPOINT` resolves to production (`sdk.EnvProd`). An agent may
+  **refuses at call time** when the resolved endpoint is production (`sdk.EnvProd`). An agent may
   rehearse a full submission against the AADE dev sandbox; filing a real tax document remains a
   human act at the TUI.
 
@@ -644,7 +655,7 @@ check runs on field change and renders a **non-blocking `[yellow]` warning** —
 
 **Submit confirmation.** A centered `Modal` over the body, **focus defaulting to `No`**, naming the
 series/AA, the counterparty, the gross total and the target environment, and stating that
-**submission cannot be undone**. When `AADE_ENDPOINT` is production, the modal additionally requires
+**submission cannot be undone**. When the resolved endpoint is production, the modal additionally requires
 typing `SUBMIT` before `Yes` is enabled — `tui-rules.md` reserves this for high-blast-radius actions,
 and filing a real tax document qualifies. During the call the status bar shows a spinner; the outcome
 lands there as `[green]✓ MARK 400001234567890` or `[red]✗ <error code> <message>`.
@@ -732,7 +743,7 @@ non-matching pair shows nothing.
 **UC-16 Snapshots.** A prefix seek on `income\x00` returns only income snapshots, in chronological
 order, without scanning expense records.
 
-**UC-17 Environment.** The status bar always shows `[TEST]` or `[PROD]` matching `AADE_ENDPOINT`.
+**UC-17 Environment.** The status bar always shows `[TEST]` or `[PROD]` matching the resolved endpoint.
 Settings reports credential presence without ever displaying the subscription key.
 
 **Envelope.** The binary opens no listening socket. With the network fully unavailable, the app
@@ -741,7 +752,7 @@ against the same file: a write in one is visible to the other on refresh, and ne
 lock while idle. The MCP server writes nothing to **stdout** except protocol frames.
 
 **MCP gating.** Without `YOURDATA_MCP_ALLOW_SUBMIT=1`, `submit_invoice` does not appear in
-`tools/list`. With it set **and** `AADE_ENDPOINT` at production, the tool appears but every call
+`tools/list`. With it set **and** the resolved endpoint at production, the tool appears but every call
 returns a tool-level error and transmits nothing. **`create_invoice_draft` and every other
 non-submit tool appear in `tools/list` unconditionally.** MARK values are strings in all tool output.
 

docs/SPECIFICATIONS.md

@@ -3,7 +3,7 @@ module github.com/techthos/yourdata
 go 1.26.4
 
 require (
-	github.com/gdamore/tcell/v2 v2.13.10
+	github.com/gdamore/tcell/v2 v2.8.1
 	github.com/mark3labs/mcp-go v0.56.0
 	github.com/rivo/tview v0.42.0
 	github.com/techthos/yourdata-sdk v0.0.0-20260501220034-d8ac9a523e8a
@@ -15,6 +15,7 @@ require (
 	github.com/google/jsonschema-go v0.4.2 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/spf13/cast v1.7.1 // indirect