@devdogsuga/devtools 0.1.26 → 0.1.28

package/dist/gh/settings/diff.d.ts

@@ -1,57 +0,0 @@
-/**
- * Live settings snapshot -> a plan of per-setting checks, against
- * `desired.ts`'s desired shape.
- *
- * Unlike `../rulesets/diff.ts` (one shape, N instances), TASK-342's settings
- * are N unrelated resources on one repository — security-and-analysis,
- * Dependabot, three Actions endpoints, and three environments' branch
- * policies. So the plan here is a flat list of named checks, each its own
- * `ok` / `drift` / `unsupported` verdict, rather than create/update/delete
- * buckets. `fixable` marks which drifted checks `commands.ts`'s `--apply`
- * step is allowed to write — `false` for anything this reconciler must only
- * ever report: a missing environment (nothing here creates one), and a
- * missing required reviewer (nothing here invents one).
- */
-import type { DesiredEnvironmentPolicy, DesiredSettings } from "./desired.js";
-import type { LiveActionsPermissions, LiveAutomatedSecurityFixes, LiveBranchPolicy, LiveEnvironment, LiveRepo, LiveSelectedActions, LiveWorkflowPermissions } from "./types.js";
-import type { ActionUse } from "./workflows.js";
-export type CheckStatus = "ok" | "drift" | "unsupported";
-export interface SettingCheck {
-    key: string;
-    description: string;
-    desired: string;
-    live: string;
-    status: CheckStatus;
-    /** Whether `commands.ts`'s apply step may write this check's fix. */
-    fixable: boolean;
-}
-export interface LiveEnvironmentSnapshot {
-    environment: LiveEnvironment | null;
-    branchPolicies: LiveBranchPolicy[];
-}
-export interface LiveSettingsSnapshot {
-    repo: LiveRepo;
-    vulnerabilityAlerts: boolean;
-    automatedSecurityFixes: LiveAutomatedSecurityFixes;
-    actionsPermissions: LiveActionsPermissions;
-    selectedActions: LiveSelectedActions;
-    workflowPermissions: LiveWorkflowPermissions;
-    environments: Record<DesiredEnvironmentPolicy["name"], LiveEnvironmentSnapshot>;
-}
-export interface SettingsPlan {
-    checks: SettingCheck[];
-    unpinnedActions: readonly ActionUse[];
-    /** Whether `sha_pinning_required` was refused this run because the repo's own workflows carry an unpinned `uses:`. */
-    refuseShaPinning: boolean;
-}
-/**
- * Builds the plan. `unpinnedActions` comes from `workflows.ts` — passed in
- * rather than recomputed here so this stays a pure function over data
- * `commands.ts` already gathered (and so `diff.test.ts` can assert
- * `refuseShaPinning` with a plain fixture array, no filesystem involved).
- */
-export declare function planSettings(desired: DesiredSettings, live: LiveSettingsSnapshot, unpinnedActions: readonly ActionUse[]): SettingsPlan;
-/** Whether a plan has any FIXABLE drift `--apply` would write. */
-export declare function planHasFixableChanges(plan: SettingsPlan): boolean;
-/** Whether a plan reports any drift at all, fixable or not (for exit-code / `--check` style callers). */
-export declare function planHasChanges(plan: SettingsPlan): boolean;

package/dist/gh/settings/diff.js

@@ -1,161 +0,0 @@
-function sameSet(a, b) {
-    if (a.length !== b.length)
-        return false;
-    const sa = [...a].sort();
-    const sb = [...b].sort();
-    return sa.every((v, i) => v === sb[i]);
-}
-function secretScanningCheck(key, apiField, description, desiredEnabled, sa) {
-    const field = sa?.[apiField];
-    if (sa === null || field === undefined) {
-        return {
-            key,
-            description,
-            desired: desiredEnabled ? "enabled" : "disabled",
-            live: "unsupported on this repo",
-            status: "unsupported",
-            fixable: false,
-        };
-    }
-    const enabled = field.status === "enabled";
-    return {
-        key,
-        description,
-        desired: desiredEnabled ? "enabled" : "disabled",
-        live: enabled ? "enabled" : "disabled",
-        status: enabled === desiredEnabled ? "ok" : "drift",
-        fixable: true,
-    };
-}
-/**
- * Builds the plan. `unpinnedActions` comes from `workflows.ts` — passed in
- * rather than recomputed here so this stays a pure function over data
- * `commands.ts` already gathered (and so `diff.test.ts` can assert
- * `refuseShaPinning` with a plain fixture array, no filesystem involved).
- */
-export function planSettings(desired, live, unpinnedActions) {
-    const checks = [];
-    const sa = live.repo.security_and_analysis;
-    checks.push(secretScanningCheck("security_and_analysis.secret_scanning", "secret_scanning", "Secret scanning", desired.securityAndAnalysis.secretScanning, sa), secretScanningCheck("security_and_analysis.secret_scanning_push_protection", "secret_scanning_push_protection", "Secret scanning push protection", desired.securityAndAnalysis.secretScanningPushProtection, sa), secretScanningCheck("security_and_analysis.secret_scanning_non_provider_patterns", "secret_scanning_non_provider_patterns", "Secret scanning non-provider patterns", desired.securityAndAnalysis.secretScanningNonProviderPatterns, sa), secretScanningCheck("security_and_analysis.secret_scanning_validity_checks", "secret_scanning_validity_checks", "Secret scanning validity checks", desired.securityAndAnalysis.secretScanningValidityChecks, sa));
-    checks.push({
-        key: "vulnerability_alerts",
-        description: "Dependabot alerts",
-        desired: desired.vulnerabilityAlerts ? "enabled" : "disabled",
-        live: live.vulnerabilityAlerts ? "enabled" : "disabled",
-        status: live.vulnerabilityAlerts === desired.vulnerabilityAlerts ? "ok" : "drift",
-        fixable: true,
-    });
-    checks.push({
-        key: "dependabot_security_updates",
-        description: "Dependabot security updates",
-        desired: desired.dependabotSecurityUpdates ? "enabled" : "disabled",
-        live: live.automatedSecurityFixes.enabled ? "enabled" : "disabled",
-        status: live.automatedSecurityFixes.enabled === desired.dependabotSecurityUpdates
-            ? "ok"
-            : "drift",
-        fixable: true,
-    });
-    const refuseShaPinning = unpinnedActions.length > 0;
-    const curShaPinning = live.actionsPermissions.sha_pinning_required === true;
-    checks.push({
-        key: "actions.sha_pinning_required",
-        description: "Require actions to be pinned to a full-length SHA",
-        desired: refuseShaPinning
-            ? `true (REFUSED — ${unpinnedActions.length} unpinned uses: found)`
-            : "true",
-        live: curShaPinning ? "true" : "false",
-        status: refuseShaPinning
-            ? "unsupported"
-            : curShaPinning === desired.actions.shaPinningRequired
-                ? "ok"
-                : "drift",
-        fixable: !refuseShaPinning,
-    });
-    checks.push({
-        key: "actions.allowed_actions",
-        description: "Allowed actions",
-        desired: desired.actions.allowedActions,
-        live: live.actionsPermissions.allowed_actions ?? "(unset)",
-        status: live.actionsPermissions.allowed_actions === desired.actions.allowedActions
-            ? "ok"
-            : "drift",
-        fixable: true,
-    });
-    const patternsMatch = live.selectedActions.github_owned_allowed ===
-        desired.actions.githubOwnedAllowed &&
-        live.selectedActions.verified_allowed === desired.actions.verifiedAllowed &&
-        sameSet(live.selectedActions.patterns_allowed, desired.actions.patterns);
-    checks.push({
-        key: "actions.selected_actions",
-        description: "Selected-actions allowlist (github-owned, verified, patterns)",
-        desired: `github_owned=${desired.actions.githubOwnedAllowed}, verified=${desired.actions.verifiedAllowed}, patterns=[${[...desired.actions.patterns].sort().join(", ")}]`,
-        live: `github_owned=${live.selectedActions.github_owned_allowed}, verified=${live.selectedActions.verified_allowed}, patterns=[${[...live.selectedActions.patterns_allowed].sort().join(", ")}]`,
-        status: patternsMatch ? "ok" : "drift",
-        fixable: true,
-    });
-    const workflowPermissionsMatch = live.workflowPermissions.default_workflow_permissions ===
-        desired.workflowPermissions.defaultWorkflowPermissions &&
-        live.workflowPermissions.can_approve_pull_request_reviews ===
-            desired.workflowPermissions.canApprovePullRequestReviews;
-    checks.push({
-        key: "actions.workflow_permissions",
-        description: "Default workflow permissions",
-        desired: `${desired.workflowPermissions.defaultWorkflowPermissions}, can_approve_pull_request_reviews=${desired.workflowPermissions.canApprovePullRequestReviews}`,
-        live: `${live.workflowPermissions.default_workflow_permissions}, can_approve_pull_request_reviews=${live.workflowPermissions.can_approve_pull_request_reviews}`,
-        status: workflowPermissionsMatch ? "ok" : "drift",
-        fixable: true,
-    });
-    for (const env of desired.environments) {
-        const snapshot = live.environments[env.name];
-        if (!snapshot.environment) {
-            checks.push({
-                key: `environments.${env.name}`,
-                description: `Environment "${env.name}"`,
-                desired: `branches=[${env.allowedBranches.join(", ")}], reviewers=${env.requireReviewers}`,
-                live: "environment does not exist",
-                status: "unsupported",
-                fixable: false,
-            });
-            continue;
-        }
-        const liveBranches = snapshot.branchPolicies.map((p) => p.name);
-        const branchesMatch = snapshot.environment.deployment_branch_policy?.custom_branch_policies ===
-            true &&
-            snapshot.environment.deployment_branch_policy?.protected_branches ===
-                false &&
-            sameSet(liveBranches, env.allowedBranches);
-        checks.push({
-            key: `environments.${env.name}.branch_policy`,
-            description: `Environment "${env.name}" deployment branch policy`,
-            desired: [...env.allowedBranches].sort().join(", "),
-            live: snapshot.environment.deployment_branch_policy
-                ? [...liveBranches].sort().join(", ") ||
-                    "(no branch restriction — all branches allowed)"
-                : "(no deployment branch policy configured)",
-            status: branchesMatch ? "ok" : "drift",
-            fixable: true,
-        });
-        if (env.requireReviewers) {
-            const hasReviewers = (snapshot.environment.protection_rules ?? []).some((rule) => rule.type === "required_reviewers" &&
-                (rule.reviewers?.length ?? 0) > 0);
-            checks.push({
-                key: `environments.${env.name}.required_reviewers`,
-                description: `Environment "${env.name}" required reviewers`,
-                desired: "at least one reviewer configured",
-                live: hasReviewers ? "configured" : "none configured",
-                status: hasReviewers ? "ok" : "drift",
-                // Never auto-fixable — this reconciler does not invent reviewers.
-                fixable: false,
-            });
-        }
-    }
-    return { checks, unpinnedActions, refuseShaPinning };
-}
-/** Whether a plan has any FIXABLE drift `--apply` would write. */
-export function planHasFixableChanges(plan) {
-    return plan.checks.some((c) => c.status === "drift" && c.fixable);
-}
-/** Whether a plan reports any drift at all, fixable or not (for exit-code / `--check` style callers). */
-export function planHasChanges(plan) {
-    return plan.checks.some((c) => c.status === "drift");
-}

package/dist/gh/settings/types.d.ts

@@ -1,92 +0,0 @@
-/**
- * The shapes this reconciler reads and writes — TASK-342's `devtools github
- * settings`, sibling of `../rulesets/types.ts`.
- *
- * Same reasoning as that file's header: a narrower slice of GitHub's REST
- * responses than Octokit's generated types, because devtools has no Octokit
- * dependency (every GitHub call goes through the `gh` CLI — see
- * `../client.ts`'s header). Only the fields this reconciler actually reads
- * or writes are represented.
- */
-export type SecretScanningStatus = "enabled" | "disabled";
-export interface LiveSecurityAndAnalysisField {
-    status: SecretScanningStatus;
-}
-/**
- * `GET /repos/{owner}/{repo}`'s `security_and_analysis` object.
- *
- * Every field is optional because GitHub omits a sub-feature entirely when
- * it is not available on the repository's plan — `secret_scanning_
- * non_provider_patterns` and `secret_scanning_validity_checks` in particular
- * are Advanced-Security features GitHub grants free on PUBLIC repos, but an
- * absent key (not a `"disabled"` status) is how a private repo or a plan
- * without them reports "not offered here". `diff.ts` reads that absence as
- * `"unsupported"`, never as drift.
- */
-export interface LiveSecurityAndAnalysis {
-    secret_scanning?: LiveSecurityAndAnalysisField;
-    secret_scanning_push_protection?: LiveSecurityAndAnalysisField;
-    secret_scanning_non_provider_patterns?: LiveSecurityAndAnalysisField;
-    secret_scanning_validity_checks?: LiveSecurityAndAnalysisField;
-}
-/** The slice of `GET /repos/{owner}/{repo}` this reconciler reads. */
-export interface LiveRepo {
-    private: boolean;
-    /** `null` on a repo where security-and-analysis has never been touched. */
-    security_and_analysis: LiveSecurityAndAnalysis | null;
-}
-/** `GET`/`PUT /repos/{owner}/{repo}/automated-security-fixes` — Dependabot security updates. */
-export interface LiveAutomatedSecurityFixes {
-    enabled: boolean;
-    paused?: boolean;
-}
-/** `GET`/`PUT /repos/{owner}/{repo}/actions/permissions`. */
-export interface LiveActionsPermissions {
-    enabled: boolean;
-    allowed_actions?: "all" | "local_only" | "selected";
-    selected_actions_url?: string;
-    /**
-     * "Require actions to be pinned to a full-length commit SHA" — the field
-     * this reconciler exists to set, gated on every `uses:` in the repo's own
-     * workflows already being pinned (see `workflows.ts`).
-     */
-    sha_pinning_required?: boolean;
-}
-/** `GET`/`PUT /repos/{owner}/{repo}/actions/permissions/selected-actions`. */
-export interface LiveSelectedActions {
-    github_owned_allowed: boolean;
-    verified_allowed: boolean;
-    patterns_allowed: string[];
-}
-/** `GET`/`PUT /repos/{owner}/{repo}/actions/permissions/workflow`. */
-export interface LiveWorkflowPermissions {
-    default_workflow_permissions: "read" | "write";
-    can_approve_pull_request_reviews: boolean;
-}
-/** One entry of an environment's `deployment_branch_policy`. */
-export interface LiveDeploymentBranchPolicy {
-    protected_branches: boolean;
-    custom_branch_policies: boolean;
-}
-export interface LiveEnvironmentReviewer {
-    type: string;
-    reviewer?: {
-        id: number;
-        type?: string;
-    };
-}
-export interface LiveProtectionRule {
-    type: string;
-    reviewers?: LiveEnvironmentReviewer[];
-}
-/** `GET /repos/{owner}/{repo}/environments/{name}`. */
-export interface LiveEnvironment {
-    name: string;
-    protection_rules?: LiveProtectionRule[];
-    deployment_branch_policy: LiveDeploymentBranchPolicy | null;
-}
-/** One entry of `GET /repos/{owner}/{repo}/environments/{name}/deployment-branch-policies`. */
-export interface LiveBranchPolicy {
-    id: number;
-    name: string;
-}

package/dist/gh/settings/types.js

@@ -1,11 +0,0 @@
-/**
- * The shapes this reconciler reads and writes — TASK-342's `devtools github
- * settings`, sibling of `../rulesets/types.ts`.
- *
- * Same reasoning as that file's header: a narrower slice of GitHub's REST
- * responses than Octokit's generated types, because devtools has no Octokit
- * dependency (every GitHub call goes through the `gh` CLI — see
- * `../client.ts`'s header). Only the fields this reconciler actually reads
- * or writes are represented.
- */
-export {};

package/dist/gh/settings/workflows.d.ts

@@ -1,41 +0,0 @@
-/** An `owner/repo@ref`-shaped `uses:`; `null` for a local path this reconciler does not govern. */
-export interface ActionRef {
-    owner: string;
-    repo: string;
-    version: string;
-}
-export interface ActionUse {
-    /** The `uses:` value verbatim, trailing comment and quoting stripped. */
-    raw: string;
-    ref: ActionRef | null;
-    file: string;
-    line: number;
-}
-/** The directory `uses:` lines are scanned from — `.github/workflows` at the repo root. */
-export declare function workflowsDir(repoRoot?: string): string;
-/** Every `*.yml`/`*.yaml` file directly inside `.github/workflows`, sorted for stable output. Empty, not throwing, when the directory does not exist. */
-export declare function listWorkflowFiles(repoRoot?: string): string[];
-/**
- * Parses every `uses:` line out of one workflow file's text.
- *
- * A plain line scan, not a YAML parser: workflow files are trusted repo
- * content, `uses:` is always a scalar on its own line in every workflow
- * DevDogsUGA has ever written (job-level and step-level alike), and pulling
- * in a YAML dependency to read one field would be a worse trade than a
- * regex that `workflows.test.ts` pins against the repo's real files.
- */
-export declare function parseUsesLines(file: string, contents: string): ActionUse[];
-/** Every `uses:` across every workflow file in the repo. */
-export declare function collectActionUses(repoRoot?: string): ActionUse[];
-/** `owner/repo@ref` uses only — local paths carry no ref to check or allow-list. */
-export declare function externalActionUses(uses: readonly ActionUse[]): ActionUse[];
-export declare function isShaPinned(use: ActionUse): boolean;
-/** Every external `uses:` NOT pinned to a 40-hex SHA — the refusal list for `sha_pinning_required`. */
-export declare function unpinnedActionUses(uses: readonly ActionUse[]): ActionUse[];
-/**
- * `owner/repo@*` for every distinct external action the workflows use,
- * sorted and deduplicated — the `patterns_allowed` list for `allowed_actions:
- * selected`, computed from what the workflows actually reference rather than
- * hand-maintained.
- */
-export declare function computeActionPatterns(uses: readonly ActionUse[]): string[];

package/dist/gh/settings/workflows.js

@@ -1,128 +0,0 @@
-/**
- * Every `uses:` a repository's own `.github/workflows/*.y*ml` files name,
- * and whether each one is pinned to a 40-hex commit SHA.
- *
- * TASK-342's `sha_pinning_required` plan item must never propose turning
- * that Actions setting on while the repository's OWN workflows would
- * immediately fail under it — GitHub refuses an unpinned `uses:` the moment
- * the setting is live. This module is the check that runs BEFORE `desired.ts`
- * builds a plan, using the same repo-root discovery contract every other
- * devtools module reads a target repo through (`findRepoRoot()`, see
- * `../../repo/root.ts`'s header).
- *
- * A local action (`uses: ./.github/actions/…`) or a same-repo reusable
- * workflow (`uses: ./.github/workflows/…`) has no marketplace ref to pin —
- * there is no `@<sha>` for a path — so both are treated as pinned by
- * definition and excluded from `computeActionPatterns()`'s allow-list: they
- * are not "an action" in the sense `allowed_actions: selected` or SHA
- * pinning ever governs.
- */
-import { readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { findRepoRoot } from "../../repo/root.js";
-const FULL_SHA = /^[0-9a-f]{40}$/;
-/** The directory `uses:` lines are scanned from — `.github/workflows` at the repo root. */
-export function workflowsDir(repoRoot = findRepoRoot()) {
-    return join(repoRoot, ".github", "workflows");
-}
-/** Every `*.yml`/`*.yaml` file directly inside `.github/workflows`, sorted for stable output. Empty, not throwing, when the directory does not exist. */
-export function listWorkflowFiles(repoRoot = findRepoRoot()) {
-    const dir = workflowsDir(repoRoot);
-    let entries;
-    try {
-        entries = readdirSync(dir);
-    }
-    catch {
-        return [];
-    }
-    return entries
-        .filter((name) => /\.ya?ml$/i.test(name))
-        .map((name) => join(dir, name))
-        .sort();
-}
-const USES_LINE = /^\s*(?:-\s*)?uses:\s*(.+?)\s*$/;
-/**
- * Parses every `uses:` line out of one workflow file's text.
- *
- * A plain line scan, not a YAML parser: workflow files are trusted repo
- * content, `uses:` is always a scalar on its own line in every workflow
- * DevDogsUGA has ever written (job-level and step-level alike), and pulling
- * in a YAML dependency to read one field would be a worse trade than a
- * regex that `workflows.test.ts` pins against the repo's real files.
- */
-export function parseUsesLines(file, contents) {
-    const out = [];
-    const lines = contents.split("\n");
-    for (let i = 0; i < lines.length; i++) {
-        const match = USES_LINE.exec(lines[i]);
-        if (!match)
-            continue;
-        let value = match[1];
-        const hash = value.indexOf("#");
-        if (hash !== -1)
-            value = value.slice(0, hash).trim();
-        value = value.replace(/^["']|["']$/g, "");
-        if (value === "")
-            continue;
-        if (value.startsWith(".") || value.startsWith("docker://")) {
-            out.push({ raw: value, ref: null, file, line: i + 1 });
-            continue;
-        }
-        const at = value.lastIndexOf("@");
-        const spec = at === -1 ? value : value.slice(0, at);
-        const version = at === -1 ? "" : value.slice(at + 1);
-        const slash = spec.indexOf("/");
-        if (at === -1 || slash === -1) {
-            // No `@ref`, or no `owner/repo` shape — not a marketplace action this
-            // reconciler can classify; recorded with `ref: null` so it is neither
-            // flagged as unpinned nor added to the allow-list, and is still
-            // visible in a raw dump if one is ever needed.
-            out.push({ raw: value, ref: null, file, line: i + 1 });
-            continue;
-        }
-        out.push({
-            raw: value,
-            ref: {
-                owner: spec.slice(0, slash),
-                repo: spec.slice(slash + 1),
-                version,
-            },
-            file,
-            line: i + 1,
-        });
-    }
-    return out;
-}
-/** Every `uses:` across every workflow file in the repo. */
-export function collectActionUses(repoRoot = findRepoRoot()) {
-    const uses = [];
-    for (const file of listWorkflowFiles(repoRoot)) {
-        const contents = readFileSync(file, "utf8");
-        uses.push(...parseUsesLines(file, contents));
-    }
-    return uses;
-}
-/** `owner/repo@ref` uses only — local paths carry no ref to check or allow-list. */
-export function externalActionUses(uses) {
-    return uses.filter((u) => u.ref !== null);
-}
-export function isShaPinned(use) {
-    return use.ref === null || FULL_SHA.test(use.ref.version);
-}
-/** Every external `uses:` NOT pinned to a 40-hex SHA — the refusal list for `sha_pinning_required`. */
-export function unpinnedActionUses(uses) {
-    return externalActionUses(uses).filter((u) => !isShaPinned(u));
-}
-/**
- * `owner/repo@*` for every distinct external action the workflows use,
- * sorted and deduplicated — the `patterns_allowed` list for `allowed_actions:
- * selected`, computed from what the workflows actually reference rather than
- * hand-maintained.
- */
-export function computeActionPatterns(uses) {
-    const patterns = new Set();
-    for (const use of externalActionUses(uses)) {
-        patterns.add(`${use.ref.owner}/${use.ref.repo}@*`);
-    }
-    return [...patterns].sort();
-}

package/dist/grantRoot.d.ts

@@ -1,42 +0,0 @@
-/**
- * Granting yourself Root on your own instance.
- *
- * Every console page resolves through `getCallerContext()`, which reads
- * `resolvedUserPermissions`. A user with no roles resolves to
- * all-permissions-false, so on a freshly reset database the console is simply
- * invisible: no error, nothing to click. Somebody has to hold the first role,
- * and on a throwaway instance that somebody is you.
- *
- * THIS REPLACES `platform.claim_root()`, an RPC any authenticated caller could
- * invoke as long as nobody already held Root, gated on the instance not
- * reporting itself as production. Both halves were wrong. The gate was a column
- * in a table: data that had to be set correctly on every instance, could not be
- * checked by CI, and was writable by anything holding the service key. And the
- * capability behind it is a privilege escalation by construction. On a freshly
- * reset production database with sign-up open to the university, Root would
- * have gone to whoever authenticated first.
- *
- * What makes this safe is a credential, not a check. It writes the row with the
- * service key, read from `supabase status`, so the authorization is "you
- * already control this database". That is the only true statement available.
- * By hand the equivalent is one INSERT in the Supabase dashboard.
- */
-import { type Instance } from "./instance.js";
-export interface RootHolder {
-    userId: string;
-    email: string;
-}
-/** Who holds Root right now, if anyone. */
-export declare function currentRootHolder(instance: Instance): Promise<RootHolder | null>;
-/** Everyone who could be granted it, sorted by email. */
-export declare function listCandidates(instance: Instance): Promise<RootHolder[]>;
-/**
- * Writes the Root grant.
- *
- * `userRoles_root_singleton` is a unique index, so a second grant fails at the
- * database rather than here. This check exists to fail with a sentence a
- * contributor can act on, the same reasoning the RPC's version had.
- */
-export declare function grantRoot(instance: Instance, userId: string): Promise<void>;
-/** Hands Root to somebody else, which takes removing it first. */
-export declare function transferRoot(instance: Instance, fromUserId: string, toUserId: string): Promise<void>;

package/dist/grantRoot.js

@@ -1,89 +0,0 @@
-/**
- * Granting yourself Root on your own instance.
- *
- * Every console page resolves through `getCallerContext()`, which reads
- * `resolvedUserPermissions`. A user with no roles resolves to
- * all-permissions-false, so on a freshly reset database the console is simply
- * invisible: no error, nothing to click. Somebody has to hold the first role,
- * and on a throwaway instance that somebody is you.
- *
- * THIS REPLACES `platform.claim_root()`, an RPC any authenticated caller could
- * invoke as long as nobody already held Root, gated on the instance not
- * reporting itself as production. Both halves were wrong. The gate was a column
- * in a table: data that had to be set correctly on every instance, could not be
- * checked by CI, and was writable by anything holding the service key. And the
- * capability behind it is a privilege escalation by construction. On a freshly
- * reset production database with sign-up open to the university, Root would
- * have gone to whoever authenticated first.
- *
- * What makes this safe is a credential, not a check. It writes the row with the
- * service key, read from `supabase status`, so the authorization is "you
- * already control this database". That is the only true statement available.
- * By hand the equivalent is one INSERT in the Supabase dashboard.
- */
-import { adminClient, ROOT_ROLE_ID } from "./instance.js";
-/** Who holds Root right now, if anyone. */
-export async function currentRootHolder(instance) {
-    const admin = adminClient(instance);
-    const { data, error } = await admin
-        .from("userRoles")
-        .select("userId")
-        .eq("roleId", ROOT_ROLE_ID)
-        .limit(1);
-    if (error)
-        throw new Error(`Could not read platform."userRoles": ${error.message}`);
-    const userId = data?.[0]?.userId;
-    if (!userId)
-        return null;
-    const { data: user } = await admin.auth.admin.getUserById(userId);
-    return { userId, email: user.user?.email ?? "(no email)" };
-}
-/** Everyone who could be granted it, sorted by email. */
-export async function listCandidates(instance) {
-    const admin = adminClient(instance);
-    const { data, error } = await admin.auth.admin.listUsers();
-    if (error)
-        throw new Error(`Could not list accounts: ${error.message}`);
-    return data.users
-        .map((u) => ({ userId: u.id, email: u.email ?? "(no email)" }))
-        .sort((a, b) => a.email.localeCompare(b.email));
-}
-/**
- * Writes the Root grant.
- *
- * `userRoles_root_singleton` is a unique index, so a second grant fails at the
- * database rather than here. This check exists to fail with a sentence a
- * contributor can act on, the same reasoning the RPC's version had.
- */
-export async function grantRoot(instance, userId) {
-    const admin = adminClient(instance);
-    const { data: role, error: roleErr } = await admin
-        .from("roles")
-        .select("id")
-        .eq("id", ROOT_ROLE_ID)
-        .maybeSingle();
-    if (roleErr)
-        throw new Error(`Could not read platform."roles": ${roleErr.message}`);
-    if (!role) {
-        throw new Error("The Root role definition is missing. It comes from supabase/seed/production/01_roles.sql, " +
-            "which runs on `pnpm devtools db reset` — seeds do not run on `db migrate`.");
-    }
-    const { error } = await admin
-        .from("userRoles")
-        .insert({ userId, roleId: ROOT_ROLE_ID });
-    if (error)
-        throw new Error(`Could not grant Root: ${error.message}`);
-}
-/** Hands Root to somebody else, which takes removing it first. */
-export async function transferRoot(instance, fromUserId, toUserId) {
-    const admin = adminClient(instance);
-    const { error: removeErr } = await admin
-        .from("userRoles")
-        .delete()
-        .eq("roleId", ROOT_ROLE_ID)
-        .eq("userId", fromUserId);
-    if (removeErr) {
-        throw new Error(`Could not release Root: ${removeErr.message}`);
-    }
-    await grantRoot(instance, toUserId);
-}

package/dist/help.d.ts

@@ -1,18 +0,0 @@
-/**
- * Renders help for a path, falling back to the root.
- *
- * An unknown path renders the root rather than an error: this is only reached
- * when `--help` was asked for, and answering a mistyped command with the list
- * it was mistyped from is more use than a refusal.
- */
-export declare function renderHelp(path?: readonly string[]): string;
-/**
- * The command names in `argv` that precede any flag.
- *
- * `env pull --help` asks about `["env", "pull"]`; `--help env` asks about
- * nothing, because a flag's value is not a command path. Kept separate from
- * `positionals()`: that one strips a known set of value-taking flags to find a
- * subcommand, and here anything after the first flag is not part of the path at
- * all.
- */
-export declare function helpPath(argv: readonly string[]): string[];