@devdogsuga/devtools 0.1.26 → 0.1.28

package/dist/menu.js

@@ -1,300 +0,0 @@
-/**
- * The wizard: `pnpm devtools` with no arguments.
- *
- * ## The one property worth protecting
- *
- * **It builds an argv and hands it to the CLI's own dispatcher.** It does not
- * call command functions directly. That is what makes "the menu covers every
- * interactive command" structural instead of aspirational. The menu it replaced held a
- * hand-written list of ten entries beside a CLI that had grown to sixteen
- * top-level commands and thirty-one subcommands, so `env`, `planner` and
- * `docs index` were reachable only by someone who already knew their names.
- * A contributor who does not know a command name is the entire audience for
- * this file.
- *
- * Walking `commands.ts` means an interactive command added there is in the
- * menu the same day, with its options. Commands marked `cli-only` and deploy
- * commands in the separate `devtools-ci` bin do not appear here.
- */
-import { confirm, note, select, text } from "@clack/prompts";
-import { positionals } from "./args.js";
-import { findCommand, GROUPS, SCOPES, } from "./commands.js";
-import { takeMenuEnvHook } from "./env-entry.js";
-import { blockedBecause, describeEnvironment, isOffered, probeEnvironment, } from "./environment.js";
-import { beginInvocation, recordEnteredTier } from "./invocation.js";
-import { unwrap } from "./ui.js";
-/** Chosen when a submenu should return to the screen above it. */
-const BACK = Symbol("back");
-const BACK_OPTION = { value: BACK, label: "← Back" };
-// ── What this machine is offered ─────────────────────────────────────────────
-/**
- * The commands at one level that are worth showing right now.
- *
- * `when` is the only thing that removes an entry, and it removes very few;
- * see `isOffered`. Everything else stays on screen and explains itself
- * through `hintFor` below, because the menu's job is to help someone who does
- * not know a command's name, and it cannot do that for a command it declined
- * to draw.
- */
-function offered(nodes, env) {
-    return nodes.filter((node) => node.surface !== "cli-only" && isOffered(node, env));
-}
-/**
- * The line beside a name, with whatever is standing in this command's way.
- *
- * The reader learns a command needs something standing in its way *before*
- * choosing it, instead of after a spinner and a connection error — `db
- * start`'s `when: "instance-stopped"` is the one still in the tree today. The
- * command stays selectable when it merely `needs` rather than requires the
- * condition to be shown at all: the check is a probe, the probe can be
- * wrong, and the command's own failure message is the authority on whether
- * it can run.
- */
-function hintFor(node, env) {
-    const base = node.hint ?? node.summary;
-    const blocked = blockedBecause(node, env);
-    const said = blocked ? `${base} — ${blocked}` : base;
-    // The scope leads, because in the one group that has scopes it is the thing
-    // the reader is actually choosing between: `restart` and `reset` sit four
-    // lines apart and act on different layers.
-    return node.scope ? `${SCOPES[node.scope].menu} · ${said}` : said;
-}
-// ── Screens ──────────────────────────────────────────────────────────────────
-async function pickGroup(env) {
-    // A group whose every command is hidden has nothing behind its door, so the
-    // door is not drawn. No group in the tree can empty out today; this is here
-    // so that a later `when` cannot leave a dead entry on the first screen.
-    const groups = GROUPS.filter((group) => offered(group.commands, env).length > 0);
-    const choice = unwrap(await select({
-        message: "What would you like to do?",
-        options: [
-            ...groups.map((group) => ({
-                value: group,
-                label: group.title,
-                // The group's own commands, so the first screen says what is behind
-                // each door rather than making the reader open every one to find out.
-                hint: offered(group.commands, env)
-                    .map((command) => command.name)
-                    .join(", "),
-            })),
-            { value: null, label: "Quit" },
-        ],
-    }));
-    return choice;
-}
-async function pickCommand(group, env) {
-    const commands = offered(group.commands, env);
-    // A group with one command has nothing to choose; asking would be a screen
-    // whose only real option is the one already implied by the group's title.
-    if (commands.length === 1)
-        return commands[0];
-    return unwrap(await select({
-        message: `${group.title}:`,
-        options: [
-            ...commands.map((command) => ({
-                value: command,
-                label: command.name,
-                hint: hintFor(command, env),
-            })),
-            BACK_OPTION,
-        ],
-    }));
-}
-async function pickSubcommand(node, env) {
-    return unwrap(await select({
-        message: `${node.name}:`,
-        options: [
-            ...offered(node.subcommands ?? [], env).map((child) => ({
-                value: child,
-                label: child.name,
-                hint: hintFor(child, env),
-            })),
-            BACK_OPTION,
-        ],
-    }));
-}
-// ── Options ──────────────────────────────────────────────────────────────────
-/**
- * Asks for one option, returning the argv fragment it contributes.
- *
- * An empty array is a real answer, not a failure: a declined confirm adds no
- * flag, and a blank optional text means "let the command decide", which is
- * how `--db-url` falls back to `.env.production`.
- */
-async function askOption(option) {
-    const prompt = option.prompt;
-    if (!prompt)
-        return [];
-    if (prompt.kind === "confirm") {
-        // Yes adds the flag, always. `commands.ts` phrases every message so that
-        // this needs no per-option inversion.
-        const yes = unwrap(await confirm({ message: prompt.message, initialValue: prompt.initial }));
-        return yes ? [option.flag] : [];
-    }
-    if (prompt.kind === "text") {
-        const answer = unwrap(await text({
-            message: prompt.message,
-            placeholder: prompt.placeholder,
-            defaultValue: "",
-        })).trim();
-        return answer ? [option.flag, answer] : [];
-    }
-    const choice = unwrap(await select({
-        message: prompt.message,
-        options: prompt.choices.map((c) => ({
-            value: c.value,
-            label: c.label ?? c.value,
-            hint: c.hint,
-        })),
-    }));
-    return [option.flag, choice];
-}
-async function askOptions(node) {
-    const argv = [];
-    for (const option of node.options ?? []) {
-        argv.push(...(await askOption(option)));
-    }
-    return argv;
-}
-/**
- * Descends from `start` through its subcommand screens to a leaf, then asks
- * that leaf's options.
- *
- * Shared by both entries into a walk: the top-of-tree loop below, which calls
- * this once a group and its first command are chosen, and a resumed walk
- * (`walk`'s `startPath` branch), which calls it directly on a node the caller
- * already picked by argv. `while` rather than a single step because the tree
- * is two deep today and this does not care. The condition counts the OFFERED
- * children rather than all of them, so a node whose every subcommand is
- * hidden is treated as the leaf it has become instead of opening a screen
- * holding only "Back".
- */
-async function descendFrom(start, pathNames, env) {
-    let node = start;
-    const path = [...pathNames];
-    while (offered(node.subcommands ?? [], env).length > 0) {
-        const child = await pickSubcommand(node, env);
-        if (child === BACK)
-            return BACK;
-        node = child;
-        path.push(node.name);
-    }
-    return { node, argv: [...path, ...(await askOptions(node))] };
-}
-/**
- * Walks the tree to a leaf and its options, either from the top or resumed at
- * a known group.
- *
- * `startPath`, when given, is a path to a group node from `bareGroupStartPath`
- * — `["db"]` for `devtools db` — and lands here instead of at `pickGroup`.
- * There is no group screen above a resumed node (the caller already named it
- * by typing `db`), so BACK on its first subcommand screen has nowhere to
- * return to but out, unlike BACK from the top of the tree, which returns to
- * `pickGroup`.
- */
-async function walk(env, startPath) {
-    if (startPath) {
-        const start = findCommand(startPath);
-        if (!start)
-            return null; // defensive: the caller guarantees a group node
-        const chosen = await descendFrom(start, [...startPath], env);
-        return chosen === BACK ? null : chosen;
-    }
-    for (;;) {
-        const group = await pickGroup(env);
-        if (!group)
-            return null;
-        const first = await pickCommand(group, env);
-        if (first === BACK)
-            continue;
-        const chosen = await descendFrom(first, [first.name], env);
-        if (chosen === BACK)
-            continue;
-        return chosen;
-    }
-}
-// ── Resuming at a node ───────────────────────────────────────────────────────
-/**
- * The command path when argv names a group with subcommands but no subcommand
- * token — what `devtools db` and `devtools db seed` are. Returns null for a
- * leaf command, an unknown token, or a bare invocation (which the no-argument
- * wizard already covers). The caller resumes the wizard at this node when
- * stdin is a TTY; a non-TTY caller keeps the dispatcher's "which of …?" exit.
- */
-export function bareGroupStartPath(argv) {
-    const path = positionals(argv);
-    if (path.length === 0)
-        return null;
-    const node = findCommand(path);
-    if (!node || (node.subcommands ?? []).length === 0)
-        return null;
-    return path;
-}
-// ── Entry ────────────────────────────────────────────────────────────────────
-/**
- * Runs the wizard, returning the `outro()` line its command earned.
- *
- * `dispatch` is the CLI's own argv handler, injected rather than imported so
- * that `cli.ts` keeps a single definition of what each command does and the
- * tests can watch what a walk produces without running it. Its return value
- * passes straight through, the closing line or `null` for a failure already
- * explained, so a command reached from the menu signs off exactly as it does
- * from the command line.
- *
- * `options.startPath`, from `bareGroupStartPath`, skips straight to that
- * node's subcommand screen — see `walk`'s `startPath` branch.
- *
- * The deploy tier is NOT asked here any more. `src/launch.ts` resolves it
- * before `cli.ts` — and therefore this module — is even imported, and
- * exports `DEPLOY_ENV`/`DEV_DB` right away, so by the time the wizard opens
- * `process.env` already names the session exactly as if `--tier` had been
- * typed. Recording it for the "run it directly next time" line only needs to
- * read `process.env.DEPLOY_ENV` back.
- *
- * Entering that tier — loading its `.env.<tier>` file onto `process.env` —
- * is what's deferred: `launch.ts` registers a hook (`env-entry.ts`'s
- * `setMenuEnvHook`) instead of entering up front, so whatever changed while
- * the reader was still walking the menu (the local stack coming up in
- * another terminal, `.env.generated` being rewritten) is picked up rather
- * than missed. `takeMenuEnvHook()` below runs it right before the chosen
- * command dispatches — the ONE place in a menu walk an env value is ever
- * actually read. `undefined` (no hook registered — a typed command entered
- * already, or a test drives `runMenu` directly) just dispatches straight
- * through, unchanged from before this existed.
- */
-export async function runMenu(dispatch, env = probeEnvironment(), options = {}) {
-    // Before the first question, not after a failure. Three lines saying what
-    // this machine currently is explain why the database commands below are
-    // flagged, and cost one glance on a healthy machine. Injected rather than
-    // probed inside `walk` so the tests can drive a machine they describe
-    // instead of the one they happen to run on.
-    note(describeEnvironment(env), "This machine");
-    const chosen = await walk(env, options.startPath);
-    // Quitting is not a failure, but it has nothing to announce either.
-    if (!chosen)
-        return null;
-    // Every step here was a prompt, so the built argv is the reproducible
-    // command — a runner that prompts further (a bare `workflows run`) appends
-    // the rest through `recordResolved`, and the entered tier rides along as the
-    // `--tier` flag `recordEnteredTier` adds.
-    beginInvocation(chosen.argv, true);
-    // A development session that answered the "which development database?"
-    // question records the QUALIFIED selector, so the "run it directly next
-    // time" line reproduces the whole session — a bare `development` would
-    // re-ask (or refuse, non-interactively) on a machine whose `.env` names a
-    // remote DB_URL.
-    const enteredTier = process.env.DEPLOY_ENV ?? "development";
-    const devDb = process.env.DEV_DB;
-    recordEnteredTier(enteredTier === "development" && (devDb === "local" || devDb === "remote")
-        ? `development:${devDb}`
-        : enteredTier);
-    // The deferred entry, if `launch.ts` registered one — see this function's
-    // header. Read-and-cleared in one call so a nested launcher (this same
-    // command re-dispatching through its own `launch()`, e.g. `db start`'s
-    // offline-stack offer) never inherits a hook meant for this walk.
-    const enterEnvironment = takeMenuEnvHook();
-    if (enterEnvironment) {
-        return enterEnvironment(chosen.argv, () => dispatch(chosen.argv));
-    }
-    return dispatch(chosen.argv);
-}

package/dist/moderation.d.ts

@@ -1,70 +0,0 @@
-/**
- * Does my app's moderation integration actually work?
- *
- * `conformance()` asks the database what it derived from your schema: is the
- * table addressable, can an author be attributed, does quarantine have a column
- * to write to, can a client still write that column. All of it is answerable
- * from the catalog, and `platform.conformance_check()` does the answering.
- *
- * The end-to-end round trip that used to live here (`quarantineRoundTrip`,
- * `moderation roundtrip`) is gone: the app repo's own CI covers that path —
- * file, quarantine, and check the freeze — more thoroughly than a devtools
- * command driven by hand ever did, and keeping two implementations of the
- * same assertion around was a drift risk with no offsetting benefit.
- *
- * Both `conformance()` and `catalog.ts`'s `readCatalog()` need to run as a
- * moderator, subject to the same RLS and `canModerate` checks a real one
- * would hit, rather than as `postgres` bypassing them. `withTemporaryModerator`
- * below is what supplies that account: a throwaway user, created through the
- * admin API and deleted again in a `finally`, rather than the seeded
- * `moderator@devdogs.test` persona this package used to sign in as — that
- * persona came from `supabase/seed/development/02_moderation.sql`, which only
- * ever ran on a local reset and is going away along with the rest of
- * `seed/development/` (see `persona.ts`'s header for the replacement).
- */
-import { type DevtoolsClient, type Instance } from "./instance.js";
-import type { CheckResult } from "./ui.js";
-interface ConformanceType {
-    contentType: string;
-    /** Schema-qualified, e.g. `platform.profile`. */
-    tableName: string;
-    checks: CheckResult[];
-}
-/** Runs `platform.conformance_check()` as the given moderator client. */
-export declare function conformance(client: DevtoolsClient, appSlug: string): Promise<ConformanceType[]>;
-/**
- * The role every devtools-granted moderator holds — `moderation check`'s
- * throwaway account and `persona moderator`'s longer-lived one alike, so
- * both resolve to the SAME role row rather than each accumulating their own.
- *
- * Reuses the id `supabase/seed/development/02_moderation.sql` used to seed
- * this same role under, on the theory that an existing local database that
- * still has that seeded row should be upserted into agreement rather than
- * given a second, redundant "Moderator" role.
- */
-export declare const MODERATOR_ROLE_ID = "00000000-0000-4000-9000-000000000001";
-/**
- * Creates (or updates) the Moderator role definition, and returns its id.
- *
- * `canModerate: true` and nothing else — not Root, not any of the other
- * `roles` permission columns — mirroring exactly what the seed persona held.
- * Idempotent (`upsert`) so repeated calls, from either caller above, never
- * race each other into two rows or fail on the second one.
- */
-export declare function ensureModeratorRole(admin: DevtoolsClient): Promise<string>;
-/** Grants the Moderator role to `userId`, creating the role definition first
- * if this is the first account to need it. */
-export declare function grantModerator(admin: DevtoolsClient, userId: string): Promise<void>;
-/**
- * Runs `fn` with a client signed in as a throwaway moderator, created for
- * this call and deleted again in a `finally` whether or not `fn` throws.
- *
- * The admin API's `createUser` bypasses the app's `before_user_created`
- * uga.edu hook (that hook only runs on the sign-up/OTP paths a real user
- * takes, not the service-role admin API), which is why a `@persona.test`
- * address works here at all — see `persona.ts`'s header for the same note
- * in more detail, since that is the command a contributor is more likely to
- * read first.
- */
-export declare function withTemporaryModerator<T>(instance: Instance, fn: (client: DevtoolsClient) => Promise<T>): Promise<T>;
-export {};

package/dist/moderation.js

@@ -1,128 +0,0 @@
-/**
- * Does my app's moderation integration actually work?
- *
- * `conformance()` asks the database what it derived from your schema: is the
- * table addressable, can an author be attributed, does quarantine have a column
- * to write to, can a client still write that column. All of it is answerable
- * from the catalog, and `platform.conformance_check()` does the answering.
- *
- * The end-to-end round trip that used to live here (`quarantineRoundTrip`,
- * `moderation roundtrip`) is gone: the app repo's own CI covers that path —
- * file, quarantine, and check the freeze — more thoroughly than a devtools
- * command driven by hand ever did, and keeping two implementations of the
- * same assertion around was a drift risk with no offsetting benefit.
- *
- * Both `conformance()` and `catalog.ts`'s `readCatalog()` need to run as a
- * moderator, subject to the same RLS and `canModerate` checks a real one
- * would hit, rather than as `postgres` bypassing them. `withTemporaryModerator`
- * below is what supplies that account: a throwaway user, created through the
- * admin API and deleted again in a `finally`, rather than the seeded
- * `moderator@devdogs.test` persona this package used to sign in as — that
- * persona came from `supabase/seed/development/02_moderation.sql`, which only
- * ever ran on a local reset and is going away along with the rest of
- * `seed/development/` (see `persona.ts`'s header for the replacement).
- */
-import { adminClient, signedInClient, } from "./instance.js";
-/** Runs `platform.conformance_check()` as the given moderator client. */
-export async function conformance(client, appSlug) {
-    const response = await client.rpc("conformance_check", {
-        app_slug: appSlug,
-    });
-    if (response.error)
-        throw new Error(response.error.message);
-    // The generated types do not describe this function's return shape.
-    const data = response.data;
-    return (data ?? []);
-}
-/**
- * The role every devtools-granted moderator holds — `moderation check`'s
- * throwaway account and `persona moderator`'s longer-lived one alike, so
- * both resolve to the SAME role row rather than each accumulating their own.
- *
- * Reuses the id `supabase/seed/development/02_moderation.sql` used to seed
- * this same role under, on the theory that an existing local database that
- * still has that seeded row should be upserted into agreement rather than
- * given a second, redundant "Moderator" role.
- */
-export const MODERATOR_ROLE_ID = "00000000-0000-4000-9000-000000000001";
-/**
- * Creates (or updates) the Moderator role definition, and returns its id.
- *
- * `canModerate: true` and nothing else — not Root, not any of the other
- * `roles` permission columns — mirroring exactly what the seed persona held.
- * Idempotent (`upsert`) so repeated calls, from either caller above, never
- * race each other into two rows or fail on the second one.
- */
-export async function ensureModeratorRole(admin) {
-    const { error } = await admin.from("roles").upsert({
-        id: MODERATOR_ROLE_ID,
-        title: "Moderator",
-        description: "Created by `pnpm devtools`: works the report queue, and nothing else.",
-        roleType: "custom",
-        rank: 5000,
-        canModerate: true,
-    });
-    if (error) {
-        throw new Error(`Could not create the Moderator role: ${error.message}`);
-    }
-    return MODERATOR_ROLE_ID;
-}
-/** Grants the Moderator role to `userId`, creating the role definition first
- * if this is the first account to need it. */
-export async function grantModerator(admin, userId) {
-    const roleId = await ensureModeratorRole(admin);
-    const { error } = await admin.from("userRoles").insert({ userId, roleId });
-    if (error) {
-        throw new Error(`Could not grant the Moderator role: ${error.message}`);
-    }
-}
-/** An email that unambiguously belongs to devtools, not a real account —
- * see `persona.ts`'s header for the `@persona.test` convention this shares. */
-function temporaryModeratorEmail() {
-    return `devtools-moderator-${crypto.randomUUID().slice(0, 8)}@persona.test`;
-}
-/** A password nobody needs to remember — this account lives for the
- * duration of one command. */
-function randomPassword() {
-    return crypto.randomUUID() + crypto.randomUUID();
-}
-/**
- * Runs `fn` with a client signed in as a throwaway moderator, created for
- * this call and deleted again in a `finally` whether or not `fn` throws.
- *
- * The admin API's `createUser` bypasses the app's `before_user_created`
- * uga.edu hook (that hook only runs on the sign-up/OTP paths a real user
- * takes, not the service-role admin API), which is why a `@persona.test`
- * address works here at all — see `persona.ts`'s header for the same note
- * in more detail, since that is the command a contributor is more likely to
- * read first.
- */
-export async function withTemporaryModerator(instance, fn) {
-    const admin = adminClient(instance);
-    const email = temporaryModeratorEmail();
-    const password = randomPassword();
-    let userId = null;
-    try {
-        const { data, error } = await admin.auth.admin.createUser({
-            email,
-            password,
-            email_confirm: true,
-            user_metadata: { createdBy: "devtools moderation check" },
-        });
-        if (error || !data.user) {
-            throw new Error(`Could not create a temporary moderator: ${error?.message}`);
-        }
-        userId = data.user.id;
-        await grantModerator(admin, userId);
-        const client = await signedInClient(instance, email, password);
-        return await fn(client);
-    }
-    finally {
-        // `userRoles.userId` cascades on delete (see the migration that defines
-        // it), so deleting the auth user is the whole teardown — no separate
-        // `userRoles` row to clean up, and the Moderator role DEFINITION is left
-        // in place for the next caller, same as `ensureModeratorRole` intends.
-        if (userId)
-            await admin.auth.admin.deleteUser(userId);
-    }
-}

package/dist/oauth/browser.d.ts

@@ -1 +0,0 @@
-export declare function openBrowser(url: string): void;

package/dist/oauth/browser.js

@@ -1,13 +0,0 @@
-/** Opens `url` in the user's default browser, cross-platform. */
-import { execFile } from "node:child_process";
-export function openBrowser(url) {
-    if (process.platform === "win32") {
-        execFile("cmd", ["/c", "start", "", url]);
-    }
-    else if (process.platform === "darwin") {
-        execFile("open", [url]);
-    }
-    else {
-        execFile("xdg-open", [url]);
-    }
-}

package/dist/oauth/config.d.ts

@@ -1,24 +0,0 @@
-/** Default Supabase project that hosts the "Sign in with DevDogs" OAuth server. */
-export declare const DEFAULT_API_URL = "https://api.devdogsuga.org";
-/**
- * DevDogs website — human-facing links, and (since TASK-351) the origin
- * that serves the one-click connect flow's `/tools/oauth/connect` and
- * `/tools/oauth/connect/exchange` endpoints. Overridable via `--platform-url`
- * / `DEVDOGS_PLATFORM_URL` for local testing against a platform dev server —
- * see `commands.ts`'s `oauth` node and `wizard.ts`.
- */
-export declare const WEBSITE_URL = "https://devdogsuga.org";
-/**
- * Custom OAuth/OIDC provider identifier. Supabase requires custom provider
- * identifiers to be prefixed with "custom:".
- */
-export declare const PROVIDER_IDENTIFIER = "custom:devdogsuga";
-export declare const PROVIDER_NAME = "DevDogs";
-export declare const PROVIDER_SCOPES: string[];
-export declare const ENV_KEYS: {
-    readonly baseUrl: "OAUTH_BASE_URL";
-    readonly providerName: "OAUTH_PROVIDER_NAME";
-    readonly clientId: "OAUTH_CLIENT_ID";
-    readonly clientSecret: "OAUTH_CLIENT_SECRET";
-    readonly platformUrl: "DEVDOGS_PLATFORM_URL";
-};

package/dist/oauth/config.js

@@ -1,24 +0,0 @@
-/** Default Supabase project that hosts the "Sign in with DevDogs" OAuth server. */
-export const DEFAULT_API_URL = "https://api.devdogsuga.org";
-/**
- * DevDogs website — human-facing links, and (since TASK-351) the origin
- * that serves the one-click connect flow's `/tools/oauth/connect` and
- * `/tools/oauth/connect/exchange` endpoints. Overridable via `--platform-url`
- * / `DEVDOGS_PLATFORM_URL` for local testing against a platform dev server —
- * see `commands.ts`'s `oauth` node and `wizard.ts`.
- */
-export const WEBSITE_URL = "https://devdogsuga.org";
-/**
- * Custom OAuth/OIDC provider identifier. Supabase requires custom provider
- * identifiers to be prefixed with "custom:".
- */
-export const PROVIDER_IDENTIFIER = "custom:devdogsuga";
-export const PROVIDER_NAME = "DevDogs";
-export const PROVIDER_SCOPES = ["openid", "email", "profile"];
-export const ENV_KEYS = {
-    baseUrl: "OAUTH_BASE_URL",
-    providerName: "OAUTH_PROVIDER_NAME",
-    clientId: "OAUTH_CLIENT_ID",
-    clientSecret: "OAUTH_CLIENT_SECRET",
-    platformUrl: "DEVDOGS_PLATFORM_URL",
-};

package/dist/oauth/connect-url.d.ts

@@ -1,17 +0,0 @@
-/**
- * Builds the platform's `/tools/oauth/connect` URL — the page a browser
- * opens to approve a `devtools oauth` connection. See this repo's launch
- * instructions for the fixed wire contract: `redirect_uri`, `code_challenge`
- * (base64url SHA-256 of the PKCE verifier, no padding — `pkce.ts`),
- * `code_challenge_method=S256`, `state`, `label` (1–100 characters), and
- * `callback_uri` (the TARGET Supabase project's own `/auth/v1/callback` —
- * NOT this loopback listener's URL; that is `redirect_uri`).
- */
-export declare function buildConnectUrl({ platformUrl, redirectUri, codeChallenge, state, label, callbackUri, }: {
-    platformUrl: string;
-    redirectUri: string;
-    codeChallenge: string;
-    state: string;
-    label: string;
-    callbackUri: string;
-}): string;

package/dist/oauth/connect-url.js

@@ -1,23 +0,0 @@
-/**
- * Builds the platform's `/tools/oauth/connect` URL — the page a browser
- * opens to approve a `devtools oauth` connection. See this repo's launch
- * instructions for the fixed wire contract: `redirect_uri`, `code_challenge`
- * (base64url SHA-256 of the PKCE verifier, no padding — `pkce.ts`),
- * `code_challenge_method=S256`, `state`, `label` (1–100 characters), and
- * `callback_uri` (the TARGET Supabase project's own `/auth/v1/callback` —
- * NOT this loopback listener's URL; that is `redirect_uri`).
- */
-export function buildConnectUrl({ platformUrl, redirectUri, codeChallenge, state, label, callbackUri, }) {
-    const url = new URL(`${platformUrl.replace(/\/+$/, "")}/tools/oauth/connect`);
-    url.searchParams.set("redirect_uri", redirectUri);
-    url.searchParams.set("code_challenge", codeChallenge);
-    url.searchParams.set("code_challenge_method", "S256");
-    url.searchParams.set("state", state);
-    // The wire contract caps this at 100 characters; truncated here rather
-    // than left for the platform to reject, since the label is a cosmetic
-    // default (project name / directory name — see `label.ts`), not something
-    // worth failing the whole connect flow over.
-    url.searchParams.set("label", label.slice(0, 100));
-    url.searchParams.set("callback_uri", callbackUri);
-    return url.toString();
-}

package/dist/oauth/db.d.ts

@@ -1,37 +0,0 @@
-export type LocalSupabaseConfig = {
-    apiUrl: string;
-    serviceRoleKey: string;
-};
-/**
- * Runs `supabase status -o env` in `cwd` and extracts the local API URL and
- * service role key. Throws a descriptive error if Supabase isn't running or
- * the CLI isn't installed.
- *
- * Two invocations are tried, because this wizard runs in two different worlds:
- * a sibling project, where the Supabase CLI is normally installed globally, and
- * this monorepo, where it is a workspace devDependency and not on PATH at all.
- * A global install wins, since `pnpm exec` in a non-pnpm project would fail for
- * reasons that have nothing to do with Supabase.
- */
-export declare function detectLocalSupabase(cwd: string): LocalSupabaseConfig;
-/**
- * Looks up a custom auth provider on a local Supabase instance through the
- * Admin SDK, and reports whether it exists along with its name and issuer.
- *
- * A 404 means it does not exist yet. Any other error is real and rethrown.
- */
-export declare function checkProvider({ apiUrl, serviceRoleKey }: LocalSupabaseConfig, identifier: string): Promise<{
-    exists: boolean;
-    name?: string;
-    issuer?: string;
-}>;
-export declare function upsertDevDogsProvider({ apiUrl, serviceRoleKey }: LocalSupabaseConfig, { identifier, name, clientId, clientSecret, issuer, }: {
-    identifier: string;
-    name: string;
-    clientId: string;
-    clientSecret: string;
-    issuer: string;
-}): Promise<{
-    identifier: string;
-    issuer: string;
-}>;