@coffre/cli 0.1.4 → 0.1.6

package/dist/setup-3OJc_VCA.js

@@ -1,756 +0,0 @@
-import { d as esm_default } from "./esm-Bts-esAl.js";
-import { _ as yes, c as Cancelled, d as paragraph, f as release, g as wrap, h as truncate, i as keyValues, l as hiddenLine, m as style, n as jsonWarning, o as needsTerminal, p as row, r as keyGuide, s as showSecrets, t as generateKeys, u as openTerminal } from "./keys-RhB7ayOY.js";
-import { r as postgresConnection, t as engineOfUrl } from "./connect-BONR52al.js";
-import { parseArgs } from "node:util";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { createHash, createHmac, pbkdf2Sync, randomBytes } from "node:crypto";
-import { readFile } from "node:fs/promises";
-//#region ../db/dist/migrate.js
-/**
-* Bring a database up to date with its engine's migration tree:
-* migrations/postgres or migrations/sqlite. Both trees
-* describe one schema; see schema-parity.test.ts.
-*
-* Applied history must be a prefix of the local journal, byte for byte,
-* before and after. Only one migrator runs at a time: Postgres takes an
-* advisory lock, and SQLite's own write lock covers the
-* whole run. Restricted runtime roles are Postgres-only (baseline/postgres.sql).
-*/
-const MIGRATION_LOCK_KEY = "7165058122361679213";
-/**
-* Beside this module: src/migrations in the workspace, and dist/migrations
-* in the built package, where the build copies them.
-*/
-function migrationsFolder(engine) {
-	return fileURLToPath(new URL(`./migrations/${engine}`, import.meta.url));
-}
-async function expectedMigrations(engine) {
-	const folder = migrationsFolder(engine);
-	const journal = JSON.parse(await readFile(`${folder}/meta/_journal.json`, "utf8"));
-	if (!Array.isArray(journal.entries)) throw new Error("invalid Drizzle migration journal");
-	const expected = await Promise.all(journal.entries.map(async (entry, position) => {
-		if (entry.idx !== position || !Number.isSafeInteger(entry.when) || typeof entry.tag !== "string" || !/^[a-zA-Z0-9_-]+$/.test(entry.tag)) throw new Error(`invalid Drizzle migration journal entry at index ${position}`);
-		const sqlText = await readFile(`${folder}/${entry.tag}.sql`, "utf8");
-		return {
-			createdAt: String(entry.when),
-			hash: createHash("sha256").update(sqlText).digest("hex"),
-			tag: entry.tag
-		};
-	}));
-	for (let index = 1; index < expected.length; index += 1) if (BigInt(expected[index - 1].createdAt) >= BigInt(expected[index].createdAt)) throw new Error("Drizzle migration journal timestamps must be strictly increasing");
-	return expected;
-}
-function verifyHistory(expected, applied, requireComplete) {
-	const rows = applied ?? [];
-	if (rows.length > expected.length) throw new Error("database contains migrations that are absent from this image");
-	if (requireComplete && rows.length !== expected.length) throw new Error(`migration history is incomplete: expected ${expected.length}, found ${rows.length}`);
-	rows.forEach((row, index) => {
-		const local = expected[index];
-		if (row.created_at !== local.createdAt || row.hash !== local.hash) throw new Error(`migration history diverged at ${local.tag}; applied migrations must never be edited`);
-	});
-}
-async function postgresMigrator(url) {
-	const [{ default: pg }, { drizzle }, { migrate }] = await Promise.all([
-		import("./esm-B69mMLcR.js"),
-		import("./node-postgres-BlNvYfq_.js"),
-		import("./migrator-W1a-ooWi.js")
-	]);
-	const pool = new pg.Pool({
-		...postgresConnection(url),
-		application_name: "coffre-migrations",
-		max: 1
-	});
-	const client = await pool.connect();
-	return {
-		async applied() {
-			if (!(await client.query("SELECT to_regclass('drizzle.__drizzle_migrations')::text AS relation")).rows[0]?.relation) return null;
-			return (await client.query("SELECT hash, created_at::text FROM drizzle.__drizzle_migrations ORDER BY created_at, id")).rows;
-		},
-		async lock() {
-			await client.query("SET lock_timeout = '5min'");
-			await client.query("SELECT pg_advisory_lock($1::bigint)", [MIGRATION_LOCK_KEY]);
-		},
-		async unlock() {
-			await client.query("SELECT pg_advisory_unlock($1::bigint)", [MIGRATION_LOCK_KEY]);
-		},
-		migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
-		async restrict() {
-			await client.query(`DO $$ BEGIN
-        EXECUTE format(
-          'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
-          current_database()
-        );
-      END $$`);
-		},
-		async close() {
-			client.release();
-			await pool.end();
-		}
-	};
-}
-async function sqliteMigrator(url) {
-	const [{ openDatabase }, { migrate }] = await Promise.all([import("./connect-BZdPYNbZ.js"), import("drizzle-orm/libsql/migrator")]);
-	const { db, close } = await openDatabase(url);
-	const sqlite = db;
-	return {
-		async applied() {
-			if ((await sqlite.all("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'")).length === 0) return null;
-			return sqlite.all("SELECT hash, CAST(created_at AS TEXT) AS created_at FROM __drizzle_migrations ORDER BY created_at, id");
-		},
-		async lock() {},
-		async unlock() {},
-		migrate: (migrationsFolder) => migrate(sqlite, { migrationsFolder }),
-		async restrict() {},
-		close
-	};
-}
-/**
-* Apply missing migrations, check their history and reassert database
-* privileges. `onPlan` hears how many there are to apply before they are:
-* all of them go in one call, with no word of each.
-*/
-async function migrateDatabase(url, onPlan) {
-	const engine = engineOfUrl(url);
-	const expected = await expectedMigrations(engine);
-	const migrator = await {
-		postgres: postgresMigrator,
-		sqlite: sqliteMigrator
-	}[engine](url);
-	let locked = false;
-	try {
-		await migrator.lock();
-		locked = true;
-		const applied = await migrator.applied();
-		verifyHistory(expected, applied, false);
-		onPlan?.({
-			applied: applied?.length ?? 0,
-			total: expected.length
-		});
-		await migrator.migrate(migrationsFolder(engine));
-		verifyHistory(expected, await migrator.applied(), true);
-		await migrator.restrict();
-	} finally {
-		try {
-			if (locked) await migrator.unlock();
-		} finally {
-			await migrator.close();
-		}
-	}
-}
-//#endregion
-//#region src/steps.ts
-const SPINNER = [
-	"⠋",
-	"⠙",
-	"⠹",
-	"⠸",
-	"⠼",
-	"⠴",
-	"⠦",
-	"⠧",
-	"⠇",
-	"⠏"
-];
-const FRAME_MS = 80;
-var Steps = class {
-	#out;
-	#s;
-	#steps;
-	#keys;
-	#describe;
-	#frame = 0;
-	#drawn = 0;
-	#timer = null;
-	#restoreCursor = () => this.#out.write("\x1B[?25h");
-	/** Ctrl-C while a step runs, the terminal in its usual mode: the cursor back, then out, with nothing more to show. */
-	#interrupt = () => {
-		this.#stop();
-		this.end();
-		this.#out.write("\n");
-		process.exit(130);
-	};
-	/**
-	* `titles`, what each step does while it runs; `keys`, the keyboard for
-	* questions; `describe`, an error as it may be shown, a secret it quotes
-	* taken out.
-	*/
-	constructor(out, titles, keys, describe) {
-		this.#out = out;
-		this.#s = style(out);
-		this.#keys = keys;
-		this.#describe = describe;
-		this.#steps = titles.map((text) => ({
-			text,
-			status: "pending",
-			details: []
-		}));
-		if (this.#s.ansi) {
-			out.write("\x1B[?25l");
-			process.once("exit", this.#restoreCursor);
-			process.on("SIGINT", this.#interrupt);
-			this.#draw();
-		}
-	}
-	/** Run step `i`: its line is the outcome `work` returns, or the error it throws. */
-	async run(i, work) {
-		const state = this.#steps[i];
-		state.status = "running";
-		this.#tick();
-		const step = {
-			note: (text) => {
-				state.text = text;
-				this.#draw();
-			},
-			ask: (question) => this.#ask(state, question)
-		};
-		try {
-			const outcome = await work(step);
-			Object.assign(state, typeof outcome === "string" ? {
-				text: outcome,
-				details: []
-			} : outcome, { status: "done" });
-		} catch (error) {
-			state.status = "failed";
-			state.details = error instanceof Cancelled ? [] : [this.#describe(error)];
-			if (error instanceof Cancelled) state.text = `${state.text}: cancelled`;
-			this.#stop();
-			throw error;
-		}
-		this.#stop();
-		if (!this.#s.ansi) this.#out.write(`✓ ${state.text}\n${state.details.map((line) => `  ${line}\n`).join("")}`);
-		else if (this.#steps.every((each) => each.status === "done")) this.end();
-	}
-	/** Leave the list as it stands, the cursor below it. */
-	end() {
-		this.#stop();
-		if (this.#s.ansi) {
-			this.#restoreCursor();
-			process.off("exit", this.#restoreCursor);
-			process.off("SIGINT", this.#interrupt);
-		}
-	}
-	async #ask(state, question) {
-		const keys = this.#keys();
-		if (keys === null) return false;
-		this.#stop();
-		const before = state.text;
-		state.text = `${question} ${this.#s.dim("y/N")}`;
-		state.status = "asking";
-		this.#draw();
-		try {
-			return await yes(keys);
-		} finally {
-			state.text = before;
-			state.status = "running";
-			this.#tick();
-		}
-	}
-	#tick() {
-		this.#draw();
-		if (this.#s.ansi && this.#timer === null) this.#timer = setInterval(() => {
-			this.#frame = (this.#frame + 1) % SPINNER.length;
-			this.#draw();
-		}, FRAME_MS);
-	}
-	#stop() {
-		if (this.#timer !== null) clearInterval(this.#timer);
-		this.#timer = null;
-		this.#draw();
-		if (!this.#s.ansi) {
-			const failed = this.#steps.find((each) => each.status === "failed");
-			if (failed !== void 0) this.#out.write(`✗ ${failed.text}\n${failed.details.map((line) => `  ${line}\n`).join("")}`);
-		} else if (this.#steps.some((each) => each.status === "failed")) this.end();
-	}
-	#draw() {
-		if (!this.#s.ansi) return;
-		const s = this.#s;
-		const columns = Math.max(20, (this.#out.columns ?? 80) - 1);
-		const lines = this.#steps.flatMap(({ text, status, details }) => {
-			const icon = {
-				pending: s.dim("·"),
-				running: s.accent(SPINNER[this.#frame]),
-				asking: s.accent("?"),
-				done: s.green("✓"),
-				failed: s.red("✗")
-			}[status];
-			const line = status === "pending" ? s.dim(text) : status === "failed" ? s.red(text) : text;
-			const under = status === "failed" ? details.flatMap((detail) => wrap(detail, columns - 4)) : details.map(s.dim);
-			return [`  ${icon} ${line}`, ...under.map((detail) => `    ${detail}`)];
-		});
-		const up = this.#drawn > 0 ? `\x1b[${this.#drawn}F` : "";
-		this.#out.write(`${up}${lines.map((line) => `${truncate(line, columns)}\x1b[K\n`).join("")}\x1b[J`);
-		this.#drawn = lines.length;
-	}
-};
-//#endregion
-//#region src/setup.ts
-/** Where the administrator's connection string comes from, when not from a hidden prompt. */
-const URL_VARIABLE = "COFFRE_SETUP_DATABASE_URL";
-/** The two runtime roles, as the migration names them, and the Hyperdrive config each gets on Workers. */
-const ROLES = {
-	app: "coffre_runtime",
-	vault: "coffre_vault_runtime"
-};
-const HYPERDRIVE = {
-	app: "coffre",
-	vault: "coffre-vault"
-};
-var SetupError = class extends Error {};
-/**
-* The name a role logs in as. On PlanetScale Postgres, a login names its
-* branch: the administrator connects as `postgres.<branch id>`, and every
-* role on that branch as `<role>.<branch id>`. Elsewhere, the role's name.
-*/
-function loginFor(role, administrator) {
-	const dot = administrator.indexOf(".");
-	return dot === -1 ? role : `${role}${administrator.slice(dot)}`;
-}
-/** The administrator's URL, as `login` with `password`: same host, database and TLS settings. */
-function loginUrl(administrator, login, password) {
-	const url = new URL(administrator.href);
-	url.username = encodeURIComponent(login);
-	url.password = password;
-	return url.href;
-}
-/**
-* A wrangler hyperdrive command that reads the URL at a silent prompt, so
-* that no password reaches the shell's history, and drops its parameters:
-* Hyperdrive connects over TLS itself, checking the certificate against
-* public CAs, and takes no `sslrootcert`. `${v%%[?]*}` holds in bash and
-* zsh alike.
-*/
-function hyperdriveCommand(target) {
-	return `read -rs COFFRE_DB_URL && pnpm exec wrangler hyperdrive ${target} --connection-string="\${COFFRE_DB_URL%%[?]*}"; unset COFFRE_DB_URL`;
-}
-/**
-* What Postgres keeps for a password under SCRAM-SHA-256 (RFC 5802 and
-* 7677), made here, so that the password itself never reaches the server,
-* nor its logs.
-*/
-function scramVerifier(password, salt = randomBytes(16), iterations = 4096) {
-	const salted = pbkdf2Sync(password, salt, iterations, 32, "sha256");
-	const stored = createHash("sha256").update(createHmac("sha256", salted).update("Client Key").digest()).digest();
-	const server = createHmac("sha256", salted).update("Server Key").digest();
-	return `SCRAM-SHA-256$${iterations}:${salt.toString("base64")}$${stored.toString("base64")}:${server.toString("base64")}`;
-}
-/** 24 random bytes, URL-safe: nothing to encode in a connection string. */
-function newPassword() {
-	return randomBytes(24).toString("base64url");
-}
-async function setup(args) {
-	const secrets = [];
-	const clean = (error) => redact(error instanceof Error ? error.message : String(error), secrets);
-	let options;
-	try {
-		options = parseOptions(args);
-	} catch (error) {
-		return fail(process.stderr, clean(error));
-	}
-	const terminal = options.json ? null : openTerminal();
-	if (!options.json && terminal === null) return fail(process.stderr, needsTerminal("coffre setup"));
-	const out = terminal?.out ?? process.stderr;
-	const s = style(out);
-	const questions = () => terminal?.keys ?? (process.stdin.isTTY ? process.stdin : null);
-	try {
-		if (s.ansi) out.write(`\n  ${s.bold("coffre setup")}  ${s.dim("a deployment's database logins, migrations and keys")}\n\n`);
-		const text = await readAdministrator(out, s);
-		secrets.push(text);
-		const administrator = administratorUrl(text);
-		if (administrator.password !== "") secrets.push(administrator.password, decodeURIComponent(administrator.password));
-		const result = await run(administrator, out, questions, { resetPasswords: options.resetPasswords }, secrets, clean);
-		if (options.json) {
-			jsonWarning(process.stderr, listed(shownNames(result), "and"));
-			process.stdout.write(`${JSON.stringify(asJson(result))}\n`);
-		} else if (result.keys === null && result.app.url === null && result.vault.url === null) out.write(nothingToSave(out));
-		else {
-			await showSecrets(terminal, setupScreen(result));
-			out.write(summary(result, out));
-		}
-	} catch (error) {
-		if (error instanceof Cancelled) return fail(out, "cancelled; nothing after the last step done was changed", 130);
-		if (!(error instanceof StepFailed)) return fail(out, clean(error));
-		process.exit(1);
-	} finally {
-		if (terminal !== null) release(terminal.keys);
-	}
-}
-function fail(out, message, code = 1) {
-	const s = style(out);
-	out.write(`${s.red("✗")} ${message}\n`);
-	process.exit(code);
-}
-function parseOptions(args) {
-	try {
-		const { values } = parseArgs({
-			args,
-			options: {
-				"reset-passwords": {
-					type: "boolean",
-					default: false
-				},
-				json: {
-					type: "boolean",
-					default: false
-				}
-			},
-			allowPositionals: false,
-			strict: true
-		});
-		return {
-			resetPasswords: values["reset-passwords"],
-			json: values.json
-		};
-	} catch {
-		const leaked = args.some((arg) => /postgres(ql)?:|@/i.test(arg));
-		throw new SetupError(`coffre setup takes only --reset-passwords and --json. It reads the administrator's connection string from a hidden prompt, ${URL_VARIABLE} or stdin, never from the command line, where the shell's history and other users can read it.` + (leaked ? " One of the arguments looks like one: change that password, which is in your shell history now." : ""));
-	}
-}
-/** The connection string: from the environment, from stdin when it is piped, or typed at a hidden prompt. */
-async function readAdministrator(out, s) {
-	const given = process.env[URL_VARIABLE];
-	delete process.env[URL_VARIABLE];
-	if (given !== void 0 && given.trim() !== "") return given.trim();
-	if (!process.stdin.isTTY) {
-		const line = readFileSync(0, "utf8").split("\n").find((candidate) => candidate.trim() !== "");
-		if (line === void 0) throw new SetupError(`no connection string: pipe it to stdin, or set ${URL_VARIABLE}`);
-		return line.trim();
-	}
-	const text = await hiddenLine(process.stdin, out, s, "The database administrator's connection string", "Hidden as you type. Your host's admin URL, such as PlanetScale's Connect page gives.");
-	if (text === "") throw new SetupError("no connection string given");
-	return text;
-}
-function administratorUrl(text) {
-	let url;
-	try {
-		url = new URL(text);
-	} catch {
-		throw new SetupError("that is not a connection string, such as postgresql://user:password@host:5432/database");
-	}
-	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") throw new SetupError("coffre setup needs a Postgres connection string, postgresql://…");
-	if (url.username === "" || url.hostname === "" || url.pathname.length <= 1) throw new SetupError("the connection string must name a user, a host and a database");
-	return url;
-}
-/** A step failed, and said so on its own line. */
-var StepFailed = class extends Error {};
-async function run(administrator, out, questions, options, secrets, clean) {
-	const user = decodeURIComponent(administrator.username);
-	const where = `${administrator.hostname}${decodeURIComponent(administrator.pathname)}`;
-	const { version } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
-	const steps = new Steps(out, [
-		`Connect to ${where}`,
-		`Check ${user} can create roles`,
-		"Make the two logins",
-		"Migrate the database",
-		"Check each login's rights"
-	], questions, clean);
-	const step = async (i, work) => {
-		try {
-			await steps.run(i, work);
-		} catch (error) {
-			if (error instanceof Cancelled) throw error;
-			throw new StepFailed(clean(error));
-		}
-	};
-	const client = new esm_default.Client({
-		...postgresConnection(administrator.href),
-		application_name: "coffre-setup"
-	});
-	try {
-		await step(0, async () => {
-			await client.connect();
-			return `Connected to ${where} as ${user}`;
-		});
-		await step(1, async () => {
-			const [self] = (await client.query("SELECT rolsuper, rolcreaterole FROM pg_roles WHERE rolname = current_user")).rows;
-			if (!self?.rolsuper && !self?.rolcreaterole) throw new SetupError(`${user} cannot create roles: connect as the database's administrator, which has CREATEROLE`);
-			return `${user} can create roles`;
-		});
-		let logins;
-		await step(2, async (progress) => {
-			logins = await provision(client, administrator, user, options.resetPasswords, progress.ask, secrets);
-			return described(logins);
-		});
-		await step(3, async (progress) => {
-			let plan = {
-				applied: 0,
-				total: 0
-			};
-			await migrateDatabase(administrator.href, (planned) => {
-				plan = planned;
-				const pending = planned.total - planned.applied;
-				progress.note(pending === 0 ? "Checking the database is up to date" : `Migrating the database: ${count(pending, "migration")} to apply`);
-			});
-			const pending = plan.total - plan.applied;
-			return pending === 0 ? `The database is up to date, at coffre ${version}'s schema` : `Migrated the database to coffre ${version}'s schema: ${count(pending, "migration")} applied`;
-		});
-		let used = false;
-		await step(4, async () => {
-			const details = [];
-			for (const component of ["app", "vault"]) {
-				const login = logins[component];
-				const allowed = login.url === null ? await granted(client, login.role) : await probed(login.url);
-				details.push(checked(component, login, allowed));
-			}
-			const kept = [logins.app, logins.vault].filter((login) => login.url === null);
-			if (kept.length > 0) details.push(`${listed(kept.map(({ role }) => role), "and")}: from the catalog, with no new password to log in with`);
-			used = (await client.query("SELECT EXISTS (SELECT 1 FROM audit_log) AS used")).rows[0].used;
-			return {
-				text: "Each login holds only its rights",
-				details
-			};
-		});
-		return {
-			keys: !used && (logins.app.url !== null || logins.vault.url !== null) ? generateKeys() : null,
-			...logins,
-			version
-		};
-	} finally {
-		steps.end();
-		await client.end().catch(() => {});
-	}
-}
-/**
-* Each runtime login, created with a fresh password, or, if it exists, its
-* password set again when asked to; otherwise left as it is.
-*/
-async function provision(client, administrator, user, resetPasswords, ask, secrets) {
-	const existing = new Set((await client.query("SELECT rolname FROM pg_roles WHERE rolname = ANY($1)", [Object.values(ROLES)])).rows.map((row) => row.rolname));
-	const reset = resetPasswords || existing.size > 0 && await ask(existing.size === 1 ? `${[...existing][0]} exists already. Set new passwords?` : "Both logins exist already. Set new passwords?");
-	const logins = {};
-	for (const component of ["app", "vault"]) {
-		const role = ROLES[component];
-		const login = loginFor(role, user);
-		const create = !existing.has(role);
-		if (!create && !reset) {
-			logins[component] = {
-				role,
-				login,
-				password: "kept",
-				url: null
-			};
-			continue;
-		}
-		const password = newPassword();
-		secrets.push(password);
-		const verifier = client.escapeLiteral(scramVerifier(password));
-		await client.query(create ? `CREATE ROLE ${client.escapeIdentifier(role)} LOGIN INHERIT NOCREATEDB NOCREATEROLE PASSWORD ${verifier}` : `ALTER ROLE ${client.escapeIdentifier(role)} LOGIN PASSWORD ${verifier}`);
-		logins[component] = {
-			role,
-			login,
-			password: create ? "created" : "reset",
-			url: loginUrl(administrator, login, password)
-		};
-	}
-	return logins;
-}
-/** The logins step's line: what happened to each, and what they log in as on PlanetScale. */
-function described(logins) {
-	const verbs = {
-		created: "Created",
-		reset: "Set new passwords for",
-		kept: "Kept"
-	};
-	return {
-		text: logins.app.password === logins.vault.password ? `${verbs[logins.app.password]} ${logins.app.role} and ${logins.vault.role}${logins.app.password === "kept" ? ", with their passwords" : ""}` : `${verbs[logins.app.password]} ${logins.app.role}; ${verbs[logins.vault.password].toLowerCase()} ${logins.vault.role}`,
-		details: logins.app.login !== logins.app.role ? [`They log in as ${logins.app.login} and ${logins.vault.login}`] : []
-	};
-}
-/** What each login may do that matters, and what it must answer. */
-const BOUNDARY = [
-	{
-		what: "write members",
-		expected: {
-			app: false,
-			vault: true
-		},
-		sql: `INSERT INTO vault_members (principal, status, owner, generation, created_at, created_by, status_changed_at, status_changed_by, access_seq, mac)
-          VALUES ('user:coffre-setup@probe.invalid', 'active', false, 0, 0, 'system:coffre-setup', 0, 'system:coffre-setup', 0, decode(repeat('00', 32), 'hex'))`,
-		privilege: "has_table_privilege($1, 'public.vault_members', 'INSERT')"
-	},
-	{
-		what: "delete log entries",
-		expected: {
-			app: false,
-			vault: false
-		},
-		sql: "DELETE FROM audit_log",
-		privilege: "has_table_privilege($1, 'public.audit_log', 'DELETE')"
-	},
-	{
-		what: "create tables",
-		expected: {
-			app: false,
-			vault: false
-		},
-		sql: "CREATE TABLE coffre_setup_probe (probe integer)",
-		privilege: "has_schema_privilege($1, 'public', 'CREATE') OR has_database_privilege($1, current_database(), 'CREATE')"
-	}
-];
-/** Each probe, tried as the login in a transaction rolled back: allowed, or refused for want of a privilege. */
-async function probed(url) {
-	const client = new esm_default.Client({
-		...postgresConnection(url),
-		application_name: "coffre-setup"
-	});
-	await client.connect();
-	try {
-		const allowed = [];
-		for (const { sql } of BOUNDARY) {
-			await client.query("BEGIN");
-			try {
-				await client.query(sql);
-				allowed.push(true);
-			} catch (error) {
-				if (error.code !== "42501") throw error;
-				allowed.push(false);
-			} finally {
-				await client.query("ROLLBACK");
-			}
-		}
-		return allowed;
-	} finally {
-		await client.end();
-	}
-}
-/** The same, from the catalog, for a login whose password this run did not set: the administrator asks for it. */
-async function granted(client, role) {
-	const allowed = [];
-	for (const { privilege } of BOUNDARY) allowed.push((await client.query(`SELECT ${privilege} AS allowed`, [role])).rows[0].allowed);
-	return allowed;
-}
-/** A login's line under the check, or the error that stops setup when its rights are wrong. */
-function checked(component, login, allowed) {
-	const wrong = BOUNDARY.flatMap(({ what, expected }, i) => allowed[i] === expected[component] ? [] : [`${allowed[i] ? "can" : "cannot"} ${what}`]);
-	if (wrong.length > 0) throw new SetupError(`${login.role} ${wrong.join(", and ")}: the database's privileges are not what coffre needs. Nothing is shown: fix them, then run coffre setup again with --reset-passwords.`);
-	const can = BOUNDARY.filter(({ expected }) => expected[component]).map(({ what }) => what);
-	const cannot = BOUNDARY.filter(({ expected }) => !expected[component]).map(({ what }) => what);
-	return `${login.role.padEnd(20)} ${can.length > 0 ? `can ${listed(can, "and")}; ` : ""}cannot ${listed(cannot, "or")}`;
-}
-/** The values to save, by component: the app's key and URL, the vault's ID, key and URL, as this run made them. */
-function setupValues({ keys, app, vault }) {
-	const made = keys === null ? {
-		app: [],
-		vault: []
-	} : keyValues(keys);
-	const database = (login, component) => login.url === null ? [] : [{
-		label: `${component === "app" ? "App" : "Vault"} database URL`,
-		value: login.url,
-		mask: "password",
-		about: `The ${component}'s own database login. Goes in the ${component}: its Hyperdrive config, or DATABASE_URL.`
-	}];
-	return {
-		app: [...made.app, ...database(app, "app")],
-		vault: [...made.vault, ...database(vault, "vault")]
-	};
-}
-/** The screen: the values, and where each goes, with the Hyperdrive commands to copy. */
-function setupScreen(result) {
-	const { app, vault } = setupValues(result);
-	const set = ["app", "vault"].filter((component) => result[component].url !== null);
-	const created = set.some((component) => result[component].password === "created");
-	const keys = keyGuide();
-	const hyperdrive = set.map((component) => {
-		return { command: hyperdriveCommand(result[component].password === "created" ? `create ${HYPERDRIVE[component]} --caching-disabled` : `update <the ${component}'s config id>`) };
-	});
-	const workers = [...set.length === 0 ? [] : [
-		`${created ? "A Hyperdrive config for each database URL, with caching off" : "Each Hyperdrive config, pointed at its new database URL"}. Run each command, then paste its URL at the silent prompt: it stays out of your shell's history, and the command drops the URL's parameters, since Hyperdrive connects over TLS itself.`,
-		...hyperdrive.flatMap((command, i) => [`The ${set[i]} database URL:`, command]),
-		"Or make them in the Cloudflare dashboard, under Hyperdrive.",
-		...created ? ["Their ids go under hyperdrive, in app/wrangler.jsonc and vault/wrangler.jsonc."] : []
-	], ...result.keys === null ? [] : keys.workers];
-	const node = [
-		...result.keys === null ? [] : keys.node,
-		...set.map((component) => `${component === "app" ? "server.env" : "vault.env"} takes the ${component} database URL, as DATABASE_URL.`),
-		"Keep each file readable only by its process (chmod 600)."
-	];
-	return {
-		title: "coffre setup",
-		sections: [...app.length > 0 ? [{
-			title: "App",
-			values: app
-		}] : [], ...vault.length > 0 ? [{
-			title: "Vault",
-			values: vault
-		}] : []],
-		guide: [{
-			title: "On Cloudflare Workers",
-			lines: workers
-		}, {
-			title: "On Node",
-			lines: node
-		}]
-	};
-}
-/** What the values were, by name, for the --json warning. */
-function shownNames(result) {
-	const { app, vault } = setupValues(result);
-	return [...app, ...vault].filter(({ mask }) => mask !== "none").map(({ label }) => `the ${label.replace(/^[A-Z]/, (c) => c.toLowerCase())}`);
-}
-/** The same values, for a script: each component's, under the examples' names, and what happened to each login. */
-function asJson({ keys, app, vault }) {
-	const database = (login) => login.url === null ? {} : { DATABASE_URL: login.url };
-	return {
-		app: {
-			...keys === null ? {} : { APP_KEY: keys.APP_KEY },
-			...database(app)
-		},
-		vault: {
-			...keys === null ? {} : {
-				VAULT_KEY_ID: keys.VAULT_KEY_ID,
-				VAULT_KEY: keys.VAULT_KEY
-			},
-			...database(vault)
-		},
-		logins: Object.fromEntries([app, vault].map(({ role, login, password }) => [role, {
-			login,
-			password
-		}]))
-	};
-}
-/** After the screen: what happened, and what comes next, with no secret in it. */
-function summary(result, out) {
-	const s = style(out);
-	const { app, vault } = setupValues(result);
-	const names = [...app, ...vault].filter(({ mask }) => mask !== "none").map(({ label }) => label.replace(/^[A-Z]/, (c) => c.toLowerCase()));
-	const created = result.app.password === "created" || result.vault.password === "created";
-	const reset = result.app.password === "reset" || result.vault.password === "reset";
-	const workers = [...created ? ["a Hyperdrive config for each database URL, with caching off"] : reset ? ["each Hyperdrive config updated with its new database URL"] : [], ...result.keys === null ? [] : ["VAULT_KEY_ID under vars", "APP_KEY and VAULT_KEY as secrets"]];
-	const fresh = created || result.keys !== null;
-	return [
-		"",
-		`  ${s.green("✓")} ${s.bold(`The ${listed(names, "and")} were shown once.`)}`,
-		s.dim(paragraph(out, "They aren't stored anywhere. A lost database URL comes back with coffre setup --reset-passwords; a lost key can't be recovered.", 4)),
-		"",
-		...result.keys === null ? [] : [row(out, s, "Vault ID", `${result.keys.VAULT_KEY_ID}, not a secret`), ""],
-		`    ${s.bold("Next")}`,
-		row(out, s, "Workers", `${workers.join("; ")}${fresh ? "; then pnpm run deploy" : ", which needs no redeploy"}.`),
-		row(out, s, "Node", fresh ? "server.env and vault.env, then pnpm vault and pnpm start." : "each DATABASE_URL updated, then both processes restarted."),
-		s.dim(paragraph(out, "After every upgrade of coffre, pnpm migrate. docs/deploy.md has each step.", 4)),
-		"",
-		""
-	].join("\n");
-}
-function nothingToSave(out) {
-	const s = style(out);
-	return [
-		"",
-		`  ${s.green("✓")} ${s.bold("Nothing new to save.")}`,
-		s.dim(paragraph(out, "The logins kept their passwords, and setup makes keys only with new ones, for a database that holds no data yet. coffre setup --reset-passwords sets new passwords.", 4)),
-		"",
-		""
-	].join("\n");
-}
-/** An error's text without any secret in it: a driver may quote what it was given. */
-function redact(text, secrets) {
-	return secrets.filter((secret) => secret.length >= 4).reduce((out, secret) => out.split(secret).join("…"), text);
-}
-function count(n, noun) {
-	return `${n} ${noun}${n === 1 ? "" : "s"}`;
-}
-/** "a, b or c". */
-function listed(items, last) {
-	return items.length < 2 ? items.join("") : `${items.slice(0, -1).join(", ")} ${last} ${items.at(-1)}`;
-}
-//#endregion
-export { setup };