@axtrabase/cli 0.1.0

package/dist/http/authenticated-client.js

@@ -0,0 +1,24 @@
+import { resolveApiUrl, resolveOrganisationId, resolveToken } from "../config/resolve.js";
+import { ControlPlaneClient } from "./client.js";
+import { CliError } from "./errors.js";
+/** For the rare command that works whether or not the caller is logged in (none in v1, but keeps the option open) — never throws for a missing token. */
+export function createControlPlaneClient(overrides = {}) {
+    return new ControlPlaneClient({
+        baseUrl: resolveApiUrl(overrides.apiUrl),
+        token: resolveToken()?.token,
+        organisationId: resolveOrganisationId(overrides.organisationId)
+    });
+}
+/** Every command that needs to act as a signed-in user calls this — throws a clear, exit-code-2 error rather than letting an unauthenticated request 401 confusingly deep inside a command. */
+export function requireControlPlaneClient(overrides = {}) {
+    const resolved = resolveToken();
+    if (!resolved) {
+        throw new CliError("AXTRA_CLI_NOT_LOGGED_IN", "Not logged in. Run `axtrabase login`, or set AXTRABASE_CLI_TOKEN for non-interactive use.", { status: 0 });
+    }
+    return new ControlPlaneClient({
+        baseUrl: resolveApiUrl(overrides.apiUrl),
+        token: resolved.token,
+        organisationId: resolveOrganisationId(overrides.organisationId)
+    });
+}
+//# sourceMappingURL=authenticated-client.js.map

package/dist/http/authenticated-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-client.js","sourceRoot":"","sources":["../../src/http/authenticated-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOvC,yJAAyJ;AACzJ,MAAM,UAAU,wBAAwB,CAAC,YAA6B,EAAE;IACtE,OAAO,IAAI,kBAAkB,CAAC;QAC5B,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;QACxC,KAAK,EAAE,YAAY,EAAE,EAAE,KAAK;QAC5B,cAAc,EAAE,qBAAqB,CAAC,SAAS,CAAC,cAAc,CAAC;KAChE,CAAC,CAAC;AACL,CAAC;AAED,+LAA+L;AAC/L,MAAM,UAAU,yBAAyB,CAAC,YAA6B,EAAE;IACvE,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAChB,yBAAyB,EACzB,2FAA2F,EAC3F,EAAE,MAAM,EAAE,CAAC,EAAE,CACd,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,kBAAkB,CAAC;QAC5B,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC;QACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,cAAc,EAAE,qBAAqB,CAAC,SAAS,CAAC,cAAc,CAAC;KAChE,CAAC,CAAC;AACL,CAAC"}

package/dist/http/client.d.ts

@@ -0,0 +1,42 @@
+export type HttpMethod = "GET" | "POST" | "PUT" | "DELETE";
+export interface RequestEnvelope<T> {
+    data: T;
+    meta: {
+        requestId: string;
+        nextCursor?: string | null;
+    };
+}
+export interface ControlPlaneClientOptions {
+    baseUrl: string;
+    /** Absent for the one command that doesn't need it yet: `login`, before a token exists. */
+    token?: string;
+    /** Sent as X-AxtraBase-Organisation-Id — see apps/api/src/session-auth.ts's requireSessionOrCliToken. */
+    organisationId?: string;
+    /** Mainly for tests — injects a fetch implementation instead of the global one. */
+    fetch?: typeof fetch;
+}
+/**
+ * A thin client for AxtraBase's *control plane* (`/api/v1/me`,
+ * `/api/v1/projects/*`, `/api/v1/organisations`, ...) — authenticated by a
+ * CLI token, never an API key. Deliberately separate from @axtrabase/sdk's
+ * `AxtraBase` class, which wraps only the Public Data API
+ * (`/api/v1/tables/*`) under a different auth scheme; the two are not
+ * interchangeable, so this isn't "the SDK with a different token."
+ * Mirrors the SDK's request/error conventions closely on purpose (build
+ * brief §42 — SDK + CLI cohesion).
+ */
+export declare class ControlPlaneClient {
+    private readonly baseUrl;
+    private readonly token;
+    private readonly organisationId;
+    private readonly fetchImpl;
+    constructor(options: ControlPlaneClientOptions);
+    request<T>(method: HttpMethod, path: string, options?: {
+        query?: Record<string, string | undefined>;
+        body?: unknown;
+    }): Promise<RequestEnvelope<T>>;
+    get<T>(path: string, query?: Record<string, string | undefined>): Promise<RequestEnvelope<T>>;
+    post<T>(path: string, body?: unknown): Promise<RequestEnvelope<T>>;
+    delete<T>(path: string): Promise<RequestEnvelope<T>>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/http/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC;IACR,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACzD;AAMD,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,yBAAyB;IAOxC,OAAO,CAAC,CAAC,EACb,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAO,GAC3E,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAiE9B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAI7F,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAIlE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CAGrD"}

package/dist/http/client.js

@@ -0,0 +1,86 @@
+import { CLI_CLIENT_NAME, CLI_VERSION } from "../version.js";
+import { CliError } from "./errors.js";
+/**
+ * A thin client for AxtraBase's *control plane* (`/api/v1/me`,
+ * `/api/v1/projects/*`, `/api/v1/organisations`, ...) — authenticated by a
+ * CLI token, never an API key. Deliberately separate from @axtrabase/sdk's
+ * `AxtraBase` class, which wraps only the Public Data API
+ * (`/api/v1/tables/*`) under a different auth scheme; the two are not
+ * interchangeable, so this isn't "the SDK with a different token."
+ * Mirrors the SDK's request/error conventions closely on purpose (build
+ * brief §42 — SDK + CLI cohesion).
+ */
+export class ControlPlaneClient {
+    baseUrl;
+    token;
+    organisationId;
+    fetchImpl;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/$/, "");
+        this.token = options.token;
+        this.organisationId = options.organisationId;
+        this.fetchImpl = options.fetch ?? fetch;
+    }
+    async request(method, path, options = {}) {
+        const url = new URL(`${this.baseUrl}${path}`);
+        for (const [key, value] of Object.entries(options.query ?? {})) {
+            if (value !== undefined)
+                url.searchParams.set(key, value);
+        }
+        const headers = {
+            "X-AxtraBase-Client": CLI_CLIENT_NAME,
+            "X-AxtraBase-CLI-Version": CLI_VERSION
+        };
+        if (this.token)
+            headers.Authorization = `Bearer ${this.token}`;
+        if (this.organisationId)
+            headers["X-AxtraBase-Organisation-Id"] = this.organisationId;
+        if (options.body !== undefined)
+            headers["Content-Type"] = "application/json";
+        let response;
+        try {
+            response = await this.fetchImpl(url, {
+                method,
+                headers,
+                body: options.body !== undefined ? JSON.stringify(options.body) : undefined
+            });
+        }
+        catch (error) {
+            throw new CliError("AXTRA_CLI_NETWORK_ERROR", error instanceof Error ? error.message : "Network request failed.", { status: 0, cause: error });
+        }
+        const headerRequestId = response.headers.get("x-axtrabase-request-id") ?? undefined;
+        const text = await response.text();
+        let json;
+        try {
+            json = text.length > 0 ? JSON.parse(text) : undefined;
+        }
+        catch (error) {
+            throw new CliError("AXTRA_CLI_INVALID_RESPONSE", "AxtraBase returned a response that could not be parsed as JSON.", { status: response.status, requestId: headerRequestId, cause: error });
+        }
+        if (!response.ok) {
+            const errorBody = json;
+            throw new CliError(errorBody?.error.code ?? "AXTRA_CLI_UNKNOWN_ERROR", errorBody?.error.message ?? `Request failed with status ${response.status}.`, { status: response.status, requestId: errorBody?.error.requestId ?? headerRequestId });
+        }
+        if (json === undefined) {
+            return { data: undefined, meta: { requestId: headerRequestId ?? "" } };
+        }
+        const envelope = json;
+        return {
+            data: envelope.data,
+            meta: {
+                requestId: envelope.meta?.requestId ?? headerRequestId ?? "",
+                nextCursor: envelope.meta?.nextCursor
+            }
+        };
+    }
+    get(path, query) {
+        return this.request("GET", path, { query });
+    }
+    post(path, body) {
+        return this.request("POST", path, { body });
+    }
+    delete(path) {
+        return this.request("DELETE", path);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/http/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/http/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAuBvC;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAS;IAChB,KAAK,CAAqB;IAC1B,cAAc,CAAqB;IACnC,SAAS,CAAe;IAEzC,YAAY,OAAkC;QAC5C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAkB,EAClB,IAAY,EACZ,UAA0E,EAAE;QAE5E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAA2B;YACtC,oBAAoB,EAAE,eAAe;YACrC,yBAAyB,EAAE,WAAW;SACvC,CAAC;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,CAAC,6BAA6B,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QACtF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAE7E,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACnC,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aAC5E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,yBAAyB,EACzB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,EAClE,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAC5B,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC;QAEpF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,4BAA4B,EAC5B,iEAAiE,EACjE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,CACtE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,IAAiC,CAAC;YACpD,MAAM,IAAI,QAAQ,CAChB,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,yBAAyB,EAClD,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,8BAA8B,QAAQ,CAAC,MAAM,GAAG,EAC5E,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,eAAe,EAAE,CACtF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,SAAc,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,eAAe,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,QAAQ,GAAG,IAAmC,CAAC;QACrD,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAS;YACxB,IAAI,EAAE;gBACJ,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,IAAI,eAAe,IAAI,EAAE;gBAC5D,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU;aACtC;SACF,CAAC;IACJ,CAAC;IAED,GAAG,CAAI,IAAY,EAAE,KAA0C;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAI,IAAY,EAAE,IAAc;QAClC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAI,IAAY;QACpB,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/http/errors.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Every AxtraBase control-plane error code this CLI can surface. Kept as a
+ * plain `string` rather than importing @axtrabase/shared's `AxtraErrorCode`
+ * — this package is meant to be installable on its own (`npm install -g
+ * @axtrabase/cli`), same reasoning as @axtrabase/sdk's AxtraBaseErrorCode.
+ * `AXTRA_CLI_*` codes are this CLI's own (network/parse failures that never
+ * reached the server); everything else mirrors the server's documented
+ * error taxonomy (see docs/developer/errors.md).
+ */
+export type CliErrorCode = string;
+export interface CliErrorOptions {
+    status: number;
+    requestId?: string;
+    cause?: unknown;
+}
+/**
+ * Thrown for every non-2xx control-plane response and every network-level
+ * failure. Every catch site gets `.code`/`.status`/`.requestId` without
+ * parsing raw JSON — mirrors @axtrabase/sdk's AxtraBaseError so the two
+ * feel like one product to a caller moving between them.
+ */
+export declare class CliError extends Error {
+    readonly code: CliErrorCode;
+    readonly status: number;
+    readonly requestId: string | undefined;
+    readonly cause: unknown;
+    constructor(code: CliErrorCode, message: string, options: CliErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/http/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/http/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,SAAkB,KAAK,EAAE,OAAO,CAAC;gBAErB,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe;CAQ1E"}

package/dist/http/errors.js

@@ -0,0 +1,21 @@
+/**
+ * Thrown for every non-2xx control-plane response and every network-level
+ * failure. Every catch site gets `.code`/`.status`/`.requestId` without
+ * parsing raw JSON — mirrors @axtrabase/sdk's AxtraBaseError so the two
+ * feel like one product to a caller moving between them.
+ */
+export class CliError extends Error {
+    code;
+    status;
+    requestId;
+    cause;
+    constructor(code, message, options) {
+        super(message);
+        this.name = "CliError";
+        this.code = code;
+        this.status = options.status;
+        this.requestId = options.requestId;
+        this.cause = options.cause;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/http/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/http/errors.ts"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAe;IACnB,MAAM,CAAS;IACf,SAAS,CAAqB;IACrB,KAAK,CAAU;IAEjC,YAAY,IAAkB,EAAE,OAAe,EAAE,OAAwB;QACvE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+import { Command, CommanderError } from "commander";
+import { registerConfigCommand } from "./commands/config.js";
+import { registerConnectionCommand } from "./commands/connection.js";
+import { registerContextCommand } from "./commands/context.js";
+import { registerDocsCommand } from "./commands/docs.js";
+import { registerKeysCommand } from "./commands/keys.js";
+import { registerLoginCommand } from "./commands/login.js";
+import { registerLogoutCommand } from "./commands/logout.js";
+import { registerOpenApiCommand } from "./commands/openapi.js";
+import { registerOrganisationsCommand } from "./commands/organisations.js";
+import { registerPermissionsCommand } from "./commands/permissions.js";
+import { registerProjectsCommand } from "./commands/projects.js";
+import { registerRequestsCommand } from "./commands/requests.js";
+import { registerSchemaCommand } from "./commands/schema.js";
+import { registerStatusCommand } from "./commands/status.js";
+import { registerTablesCommand } from "./commands/tables.js";
+import { registerWhoamiCommand } from "./commands/whoami.js";
+import { EXIT_CODES } from "./exit-codes.js";
+import { CLI_VERSION } from "./version.js";
+const program = new Command();
+program
+    .name("axtrabase")
+    .description("Inspect an AxtraBase project's schema, permissions, and environment, then build against it " +
+    "through @axtrabase/sdk or the REST API — without touching Dataverse or Microsoft OAuth directly.")
+    .version(CLI_VERSION, "--version", "print the CLI version")
+    .option("--json", "machine-readable JSON output (stable field names, no ANSI)")
+    .option("--api-url <url>", "override the AxtraBase API origin for this call")
+    .option("--debug", "print additional diagnostics on error (never secrets)")
+    .exitOverride();
+registerLoginCommand(program);
+registerLogoutCommand(program);
+registerWhoamiCommand(program);
+registerOrganisationsCommand(program);
+registerProjectsCommand(program);
+registerConnectionCommand(program);
+registerTablesCommand(program);
+registerStatusCommand(program);
+registerContextCommand(program);
+registerSchemaCommand(program);
+registerPermissionsCommand(program);
+registerKeysCommand(program);
+registerRequestsCommand(program);
+registerConfigCommand(program);
+registerDocsCommand(program);
+registerOpenApiCommand(program);
+try {
+    await program.parseAsync(process.argv);
+}
+catch (error) {
+    if (error instanceof CommanderError) {
+        // exitCode 0 means commander already printed help/version successfully
+        // — not a real failure. Anything else is malformed CLI usage (unknown
+        // command/option, missing required argument), which maps to this
+        // program's own INVALID_ARGUMENTS exit code rather than commander's
+        // default of 1, so scripts/agents get one consistent contract (see
+        // exit-codes.ts, build brief §23).
+        process.exit(error.exitCode === 0 ? 0 : EXIT_CODES.INVALID_ARGUMENTS);
+    }
+    throw error;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,WAAW,CAAC;KACjB,WAAW,CACV,6FAA6F;IAC3F,kGAAkG,CACrG;KACA,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,uBAAuB,CAAC;KAC1D,MAAM,CAAC,QAAQ,EAAE,4DAA4D,CAAC;KAC9E,MAAM,CAAC,iBAAiB,EAAE,iDAAiD,CAAC;KAC5E,MAAM,CAAC,SAAS,EAAE,uDAAuD,CAAC;KAC1E,YAAY,EAAE,CAAC;AAElB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACtC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAEhC,IAAI,CAAC;IACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,uEAAuE;QACvE,sEAAsE;QACtE,iEAAiE;QACjE,oEAAoE;QACpE,mEAAmE;QACnE,mCAAmC;QACnC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,KAAK,CAAC;AACd,CAAC"}

package/dist/open-browser.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Cross-platform "open a URL in the default browser," without adding an
+ * `open`/`opener` dependency for one call site (build brief §2: "zero
+ * unnecessary framework weight"). Best-effort — `login.ts` always prints the
+ * URL too, so a failure here never blocks the login flow, it just means the
+ * user copies the URL themselves.
+ */
+export declare function openBrowser(url: string): boolean;
+//# sourceMappingURL=open-browser.d.ts.map

package/dist/open-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../src/open-browser.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAYhD"}

package/dist/open-browser.js

@@ -0,0 +1,32 @@
+import { spawn } from "node:child_process";
+/**
+ * Cross-platform "open a URL in the default browser," without adding an
+ * `open`/`opener` dependency for one call site (build brief §2: "zero
+ * unnecessary framework weight"). Best-effort — `login.ts` always prints the
+ * URL too, so a failure here never blocks the login flow, it just means the
+ * user copies the URL themselves.
+ */
+export function openBrowser(url) {
+    try {
+        const { command, args } = commandForPlatform(url);
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        child.on("error", () => {
+            // Swallowed deliberately — the caller already has a fallback path (print the URL).
+        });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function commandForPlatform(url) {
+    if (process.platform === "darwin")
+        return { command: "open", args: [url] };
+    if (process.platform === "win32") {
+        // cmd's `start` needs an empty title argument before the URL when the URL might contain characters cmd would otherwise misparse.
+        return { command: "cmd", args: ["/c", "start", "", url] };
+    }
+    return { command: "xdg-open", args: [url] };
+}
+//# sourceMappingURL=open-browser.js.map

package/dist/open-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../src/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,mFAAmF;QACrF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,iIAAiI;QACjI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC"}

package/dist/output/file-writer.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Never silently overwrites an existing file without --force (build brief
+ * §36), and writes atomically (write to a temp file, then rename) so a
+ * process interrupted mid-write never leaves a half-written schema/types
+ * file in place of a good one.
+ */
+export declare function writeFileSafely(path: string, content: string, force: boolean): void;
+//# sourceMappingURL=file-writer.d.ts.map

package/dist/output/file-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-writer.d.ts","sourceRoot":"","sources":["../../src/output/file-writer.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAqBnF"}

package/dist/output/file-writer.js

@@ -0,0 +1,28 @@
+import { existsSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { CliError } from "../http/errors.js";
+/**
+ * Never silently overwrites an existing file without --force (build brief
+ * §36), and writes atomically (write to a temp file, then rename) so a
+ * process interrupted mid-write never leaves a half-written schema/types
+ * file in place of a good one.
+ */
+export function writeFileSafely(path, content, force) {
+    if (existsSync(path) && !force) {
+        throw new CliError("AXTRA_CLI_FILE_EXISTS", `${path} already exists. Pass --force to overwrite it.`, { status: 0 });
+    }
+    const tmpPath = `${path}.axtrabase-tmp-${process.pid}`;
+    try {
+        writeFileSync(tmpPath, content, "utf8");
+        renameSync(tmpPath, path);
+    }
+    catch (error) {
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch {
+            // Best-effort cleanup — the original error is what matters.
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=file-writer.js.map

package/dist/output/file-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-writer.js","sourceRoot":"","sources":["../../src/output/file-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe,EAAE,KAAc;IAC3E,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAChB,uBAAuB,EACvB,GAAG,IAAI,gDAAgD,EACvD,EAAE,MAAM,EAAE,CAAC,EAAE,CACd,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,IAAI,kBAAkB,OAAO,CAAC,GAAG,EAAE,CAAC;IACvD,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/output/print.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The JSON-output contract every command with `--json` follows (build brief
+ * §22): stdout carries only the machine-readable result, stable field
+ * ordering (the `data` shape is fixed per-command; JSON.stringify preserves
+ * insertion order for string keys), no ANSI, and a trailing newline so
+ * shells don't glue the next prompt onto the output.
+ */
+export declare function printJson(data: unknown): void;
+/** Progress/warnings never belong on stdout when --json is active — see build brief §22 ("stdout = machine-readable result only"). */
+export declare function printProgress(message: string): void;
+/** A sanitized single line of human-facing stdout output. */
+export declare function printLine(line?: string): void;
+/** A simple "Label: value" block for whoami/status-style output — deliberately not a table library, matching the build brief's "no unnecessary framework weight." */
+export declare function printKeyValueBlock(rows: Array<[string, string]>): void;
+//# sourceMappingURL=print.d.ts.map

package/dist/output/print.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"print.d.ts","sourceRoot":"","sources":["../../src/output/print.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE7C;AAED,sIAAsI;AACtI,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEnD;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAW,GAAG,IAAI,CAEjD;AAED,qKAAqK;AACrK,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CAKtE"}

package/dist/output/print.js

@@ -0,0 +1,27 @@
+import { sanitizeForTerminal } from "./sanitize.js";
+/**
+ * The JSON-output contract every command with `--json` follows (build brief
+ * §22): stdout carries only the machine-readable result, stable field
+ * ordering (the `data` shape is fixed per-command; JSON.stringify preserves
+ * insertion order for string keys), no ANSI, and a trailing newline so
+ * shells don't glue the next prompt onto the output.
+ */
+export function printJson(data) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}\n`);
+}
+/** Progress/warnings never belong on stdout when --json is active — see build brief §22 ("stdout = machine-readable result only"). */
+export function printProgress(message) {
+    process.stderr.write(`${message}\n`);
+}
+/** A sanitized single line of human-facing stdout output. */
+export function printLine(line = "") {
+    process.stdout.write(`${sanitizeForTerminal(line)}\n`);
+}
+/** A simple "Label: value" block for whoami/status-style output — deliberately not a table library, matching the build brief's "no unnecessary framework weight." */
+export function printKeyValueBlock(rows) {
+    const labelWidth = Math.max(...rows.map(([label]) => label.length));
+    for (const [label, value] of rows) {
+        printLine(`${label.padEnd(labelWidth)}  ${value}`);
+    }
+}
+//# sourceMappingURL=print.js.map

package/dist/output/print.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"print.js","sourceRoot":"","sources":["../../src/output/print.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,sIAAsI;AACtI,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE;IACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,qKAAqK;AACrK,MAAM,UAAU,kBAAkB,CAAC,IAA6B;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/output/sanitize.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Strips terminal-dangerous control characters from a string before it is
+ * ever written directly to a human terminal — display names, table names,
+ * server-provided error messages, and the like are not trusted input (a
+ * maliciously named Dataverse table is a real, if unlikely, scenario) and
+ * must never be able to move the cursor, clear the screen, or otherwise
+ * spoof terminal output (build brief §35).
+ *
+ * Newline and tab are deliberately exempted: they're ordinary layout
+ * characters, not an escape mechanism, and this CLI's own multi-line
+ * guidance messages (e.g. "No active project.\n\nRun: ...") rely on real
+ * newlines surviving this function. ESC (which enables the entire ANSI/CSI
+ * escape family — cursor movement, screen clear, OSC title/hyperlink
+ * tricks) and bare carriage return (which can overwrite already-printed
+ * output in place) are exactly what this function exists to block, along
+ * with every other C0 control character and DEL.
+ *
+ * `--json` output is unaffected by this function and needs no separate
+ * sanitization: `JSON.stringify` already escapes every C0 control character
+ * in a string, so a raw escape byte can never reach a terminal through
+ * piped JSON either.
+ *
+ * Iterates by code point (not index) and compares numeric ranges rather
+ * than using a regex literal with raw control bytes embedded in it — a
+ * regex character class spelled out with actual control-character bytes in
+ * the source file is unreadable in editors/diffs and risks being treated as
+ * binary by tooling.
+ */
+export declare function sanitizeForTerminal(value: string): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/output/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/output/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUzD"}

package/dist/output/sanitize.js

@@ -0,0 +1,40 @@
+/**
+ * Strips terminal-dangerous control characters from a string before it is
+ * ever written directly to a human terminal — display names, table names,
+ * server-provided error messages, and the like are not trusted input (a
+ * maliciously named Dataverse table is a real, if unlikely, scenario) and
+ * must never be able to move the cursor, clear the screen, or otherwise
+ * spoof terminal output (build brief §35).
+ *
+ * Newline and tab are deliberately exempted: they're ordinary layout
+ * characters, not an escape mechanism, and this CLI's own multi-line
+ * guidance messages (e.g. "No active project.\n\nRun: ...") rely on real
+ * newlines surviving this function. ESC (which enables the entire ANSI/CSI
+ * escape family — cursor movement, screen clear, OSC title/hyperlink
+ * tricks) and bare carriage return (which can overwrite already-printed
+ * output in place) are exactly what this function exists to block, along
+ * with every other C0 control character and DEL.
+ *
+ * `--json` output is unaffected by this function and needs no separate
+ * sanitization: `JSON.stringify` already escapes every C0 control character
+ * in a string, so a raw escape byte can never reach a terminal through
+ * piped JSON either.
+ *
+ * Iterates by code point (not index) and compares numeric ranges rather
+ * than using a regex literal with raw control bytes embedded in it — a
+ * regex character class spelled out with actual control-character bytes in
+ * the source file is unreadable in editors/diffs and risks being treated as
+ * binary by tooling.
+ */
+export function sanitizeForTerminal(value) {
+    const ALLOWED_CONTROL_CODE_POINTS = new Set([9, 10]); // tab, line feed
+    let result = "";
+    for (const char of value) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        const isDangerousControlCharacter = (codePoint <= 0x1f && !ALLOWED_CONTROL_CODE_POINTS.has(codePoint)) || codePoint === 0x7f;
+        if (!isDangerousControlCharacter)
+            result += char;
+    }
+    return result;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/output/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/output/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;IACvE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,2BAA2B,GAC/B,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC;QAC3F,IAAI,CAAC,2BAA2B;YAAE,MAAM,IAAI,IAAI,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/output/table.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A minimal fixed-width table renderer — deliberately not a table library
+ * (build brief §2: "zero unnecessary framework weight"). Every cell is
+ * sanitized before being measured/printed, so a malicious display name
+ * can't widen a column with a wide-looking escape sequence or otherwise
+ * corrupt the layout.
+ */
+export declare function renderTable(headers: string[], rows: string[][]): string;
+//# sourceMappingURL=table.d.ts.map

package/dist/output/table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../src/output/table.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAevE"}

package/dist/output/table.js

@@ -0,0 +1,19 @@
+import { sanitizeForTerminal } from "./sanitize.js";
+/**
+ * A minimal fixed-width table renderer — deliberately not a table library
+ * (build brief §2: "zero unnecessary framework weight"). Every cell is
+ * sanitized before being measured/printed, so a malicious display name
+ * can't widen a column with a wide-looking escape sequence or otherwise
+ * corrupt the layout.
+ */
+export function renderTable(headers, rows) {
+    const sanitizedHeaders = headers.map(sanitizeForTerminal);
+    const sanitizedRows = rows.map((row) => row.map(sanitizeForTerminal));
+    const widths = sanitizedHeaders.map((header, columnIndex) => Math.max(header.length, ...sanitizedRows.map((row) => (row[columnIndex] ?? "").length)));
+    const renderRow = (cells) => cells
+        .map((cell, index) => cell.padEnd(widths[index] ?? 0))
+        .join("  ")
+        .trimEnd();
+    return [renderRow(sanitizedHeaders), ...sanitizedRows.map(renderRow)].join("\n");
+}
+//# sourceMappingURL=table.js.map

package/dist/output/table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.js","sourceRoot":"","sources":["../../src/output/table.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,OAAiB,EAAE,IAAgB;IAC7D,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CACxF,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,KAAe,EAAU,EAAE,CAC5C,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;SACrD,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,EAAE,CAAC;IAEf,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC"}

package/dist/prompt-masked.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Prompts for a secret on stdin, echoing `*` instead of the typed/pasted
+ * characters — used by `axtrabase login` for the pasted CLI token (build
+ * brief §5 treats the token as sensitive from the moment it's entered).
+ * Falls back to an unmasked `readline` prompt when stdin isn't a TTY (piped
+ * input, most test environments) since there's no terminal to mask against
+ * and raw mode isn't available there anyway.
+ *
+ * Control characters (Enter, Backspace, Ctrl-C, Ctrl-D) are matched via
+ * `String.fromCharCode` rather than escape-sequence literals in this file's
+ * source text — keeps the file plain, diffable ASCII instead of risking
+ * literal control bytes ending up embedded in the source.
+ */
+export declare function promptMasked(promptText: string): Promise<string>;
+//# sourceMappingURL=prompt-masked.d.ts.map

package/dist/prompt-masked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-masked.d.ts","sourceRoot":"","sources":["../src/prompt-masked.ts"],"names":[],"mappings":"AAOA;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDhE"}