@dontcode2/backend 0.2.0 → 0.2.1

package/dist/cli.cjs

@@ -0,0 +1,1062 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/credentials.ts
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+function configDir() {
+  return process.env.DONTCODE_CONFIG_DIR || (0, import_node_path.join)((0, import_node_os.homedir)(), ".dontcode");
+}
+function credentialsPath() {
+  return (0, import_node_path.join)(configDir(), "credentials.json");
+}
+function readStore() {
+  try {
+    return JSON.parse((0, import_node_fs.readFileSync)(credentialsPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeStore(store) {
+  const path = credentialsPath();
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true, mode: 448 });
+  (0, import_node_fs.writeFileSync)(path, JSON.stringify(store, null, 2), { mode: 384 });
+}
+function loadCredential(baseUrl3) {
+  return readStore()[baseUrl3] ?? null;
+}
+function saveCredential(cred) {
+  const store = readStore();
+  store[cred.base_url] = cred;
+  writeStore(store);
+}
+function clearCredential(baseUrl3) {
+  const store = readStore();
+  delete store[baseUrl3];
+  writeStore(store);
+}
+function isExpired(cred, skewMs = 3e4) {
+  return new Date(cred.expires_at).getTime() - skewMs <= Date.now();
+}
+function resolveActiveToken(baseUrl3) {
+  const env = process.env.DONTCODE_API_KEY;
+  if (env) return { token: env, source: "env" };
+  const cred = loadCredential(baseUrl3);
+  if (cred && !isExpired(cred)) {
+    return {
+      token: cred.access_token,
+      source: "device",
+      projectId: cred.project_id,
+      expiresAt: cred.expires_at
+    };
+  }
+  return { source: "none" };
+}
+
+// src/errors.ts
+var DontCodeError = class extends Error {
+  constructor(status, body) {
+    const message = typeof body?.error === "string" && body.error.length > 0 ? body.error : `DontCode request failed with status ${status}`;
+    super(message);
+    this.name = "DontCodeError";
+    this.status = status;
+    this.code = typeof body?.code === "string" ? body.code : void 0;
+    this.body = body ?? {};
+  }
+  /** True when the request was rejected by the per-key rate limiter. */
+  get rateLimited() {
+    return this.status === 429;
+  }
+};
+function isDontCodeError(err) {
+  if (err instanceof DontCodeError) return true;
+  return typeof err === "object" && err !== null && err.name === "DontCodeError";
+}
+
+// src/http.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+var Transport = class {
+  constructor(config) {
+    this.config = config;
+  }
+  headers(opts) {
+    const headers = {};
+    if (this.config.apiKey) headers["Authorization"] = `Bearer ${this.config.apiKey}`;
+    if (opts?.accessToken) headers["X-Access-Token"] = opts.accessToken;
+    return headers;
+  }
+  url(path) {
+    return `${this.config.baseUrl}${path}`;
+  }
+  timeout(opts) {
+    const value = opts?.timeoutMs ?? this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return value > 0 ? value : 0;
+  }
+  /**
+   * One fetch, with a timeout that turns "hung socket" into a fast, typed
+   * failure. A timeout surfaces as `DontCodeError` with status 408 / code
+   * `Timeout`; any other transport failure (DNS, refused, offline) as status
+   * 0 / code `NetworkError`. Both are distinct from a real `401`, so an auth
+   * guard can tell "backend is down" apart from "user is signed out".
+   */
+  async send(path, init, opts) {
+    const timeoutMs = this.timeout(opts);
+    const controller = timeoutMs > 0 ? new AbortController() : void 0;
+    const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
+    try {
+      return await fetch(this.url(path), { ...init, signal: controller?.signal });
+    } catch (err) {
+      if (controller?.signal.aborted) {
+        throw new DontCodeError(408, {
+          error: `Request to ${path} timed out after ${timeoutMs}ms`,
+          code: "Timeout"
+        });
+      }
+      throw new DontCodeError(0, {
+        error: err instanceof Error ? err.message : "Network request failed",
+        code: "NetworkError"
+      });
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+  /** GET and parse the JSON response. */
+  async get(path, opts) {
+    const res = await this.send(path, { method: "GET", headers: this.headers(opts) }, opts);
+    return this.parse(res);
+  }
+  /** POST a JSON body and parse the JSON response. */
+  async json(path, body, opts) {
+    const res = await this.send(
+      path,
+      {
+        method: "POST",
+        headers: { ...this.headers(opts), "Content-Type": "application/json" },
+        body: JSON.stringify(body ?? {})
+      },
+      opts
+    );
+    return this.parse(res);
+  }
+  /** PUT a multipart form (file uploads). The runtime sets the boundary. */
+  async multipart(path, form, opts) {
+    const res = await this.send(path, { method: "PUT", headers: this.headers(opts), body: form }, opts);
+    return this.parse(res);
+  }
+  async parse(res) {
+    const raw = await res.text();
+    let data = null;
+    if (raw) {
+      try {
+        data = JSON.parse(raw);
+      } catch {
+        data = { error: raw };
+      }
+    }
+    if (!res.ok) {
+      const body = data && typeof data === "object" ? data : { error: res.statusText || "Request failed" };
+      throw new DontCodeError(res.status, body);
+    }
+    return data;
+  }
+};
+
+// src/auth-device.ts
+var START_PATH = "/api/v1/auth/device/start";
+var TOKEN_PATH = "/api/v1/auth/device/token";
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function startDeviceAuth(baseUrl3, clientName) {
+  const transport = new Transport({ baseUrl: baseUrl3 });
+  return transport.json(START_PATH, { client_name: clientName });
+}
+async function pollDeviceToken(baseUrl3, start, opts = {}) {
+  const transport = new Transport({ baseUrl: baseUrl3 });
+  let intervalMs = Math.max(1, start.interval) * 1e3;
+  const expiry = Date.now() + start.expires_in * 1e3;
+  const deadline = opts.maxWaitMs && opts.maxWaitMs > 0 ? Math.min(expiry, Date.now() + opts.maxWaitMs) : expiry;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    try {
+      return await transport.json(TOKEN_PATH, {
+        device_code: start.device_code
+      });
+    } catch (err) {
+      if (err instanceof DontCodeError) {
+        const message = err.body?.error ?? err.message;
+        if (err.status === 428 || message.includes("authorization_pending")) {
+          opts.onPending?.();
+          continue;
+        }
+        if (message.includes("slow_down")) {
+          intervalMs += 2e3;
+          continue;
+        }
+      }
+      throw err;
+    }
+  }
+  const stillOpen = Date.now() < expiry;
+  throw new DontCodeError(408, {
+    error: stillOpen ? "Still waiting for browser approval." : "Device login timed out before approval. Start again.",
+    code: stillOpen ? "WaitTimeout" : "Timeout"
+  });
+}
+async function openBrowser(url) {
+  try {
+    const { spawn } = await import("child_process");
+    const platform = process.platform;
+    const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+    const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+    spawn(command, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+async function login(options) {
+  const log = options.log ?? (() => {
+  });
+  const start = await startDeviceAuth(options.baseUrl, options.clientName);
+  log(
+    `
+Open this URL to connect:
+  ${start.verification_uri_complete}
+
+Confirm this code matches:
+  ${start.user_code}
+
+Waiting for approval...
+`
+  );
+  if (options.open !== false) await openBrowser(start.verification_uri_complete);
+  const token = await pollDeviceToken(options.baseUrl, start);
+  const cred = {
+    access_token: token.access_token,
+    project_id: token.project_id,
+    expires_at: new Date(Date.now() + token.expires_in * 1e3).toISOString(),
+    base_url: options.baseUrl
+  };
+  saveCredential(cred);
+  return cred;
+}
+
+// src/cookies.ts
+var DEFAULT_SESSION_COOKIE_NAME = "dc_access_token";
+var DEFAULT_MAX_AGE_SECONDS = 60 * 60 * 24 * 7;
+function readSessionToken(cookieHeader, name = DEFAULT_SESSION_COOKIE_NAME) {
+  if (!cookieHeader) return null;
+  for (const pair of cookieHeader.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) continue;
+    if (pair.slice(0, eq).trim() !== name) continue;
+    const raw = pair.slice(eq + 1).trim();
+    if (!raw) return null;
+    try {
+      return decodeURIComponent(raw);
+    } catch {
+      return raw;
+    }
+  }
+  return null;
+}
+
+// src/session.ts
+var DEFAULT_TTL_MS = 6e4;
+var DEFAULT_VERIFY_TIMEOUT_MS = 5e3;
+var InMemorySessionCache = class {
+  constructor() {
+    this.store = /* @__PURE__ */ new Map();
+  }
+  get(token) {
+    const hit = this.store.get(token);
+    if (!hit) return void 0;
+    if (Date.now() >= hit.expiresAtMs) {
+      this.store.delete(token);
+      return void 0;
+    }
+    return hit.value;
+  }
+  set(token, value, ttlMs) {
+    this.store.set(token, { value, expiresAtMs: Date.now() + ttlMs });
+  }
+  delete(token) {
+    this.store.delete(token);
+  }
+};
+function base64UrlDecode(segment) {
+  const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.length % 4 === 0 ? base64 : base64 + "=".repeat(4 - base64.length % 4);
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+  }
+  return Buffer.from(padded, "base64").toString("utf8");
+}
+function decodeAccessToken(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    if (!payload || typeof payload.sub !== "string") return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function isSessionExpired(input, opts = {}) {
+  const decoded = typeof input === "string" ? decodeAccessToken(input) : input;
+  if (!decoded || typeof decoded.exp !== "number") return false;
+  const nowSeconds = Date.now() / 1e3;
+  return nowSeconds >= decoded.exp - (opts.skewSeconds ?? 0);
+}
+function userFromClaims(decoded) {
+  return {
+    id: decoded.sub,
+    email: typeof decoded.email === "string" ? decoded.email : "",
+    role: decoded.role,
+    claims: decoded.claims
+  };
+}
+var SessionVerifier = class {
+  constructor(auth, options = {}) {
+    this.auth = auth;
+    this.cache = options.cache ?? new InMemorySessionCache();
+    this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    this.verifyTimeoutMs = options.verifyTimeoutMs ?? DEFAULT_VERIFY_TIMEOUT_MS;
+  }
+  async getSession({ accessToken, mode = "optimistic" }) {
+    const decoded = decodeAccessToken(accessToken);
+    if (!decoded) return { status: "anonymous", user: null, verified: false };
+    if (isSessionExpired(decoded)) {
+      return { status: "expired", user: null, verified: false, expiresAt: decoded.exp };
+    }
+    const optimistic = {
+      status: "active",
+      user: userFromClaims(decoded),
+      verified: false,
+      expiresAt: decoded.exp
+    };
+    if (mode === "optimistic") return optimistic;
+    const cached = this.cache.get(accessToken);
+    if (cached) return cached;
+    try {
+      const { user } = await this.auth.me({
+        accessToken,
+        timeoutMs: this.verifyTimeoutMs
+      });
+      const result = user ? { status: "active", user, verified: true, expiresAt: decoded.exp } : { status: "anonymous", user: null, verified: true };
+      this.cache.set(accessToken, result, this.ttlMs);
+      return result;
+    } catch (err) {
+      if (isDontCodeError(err) && err.status === 401) {
+        return { status: "anonymous", user: null, verified: true };
+      }
+      return { ...optimistic, status: "unavailable" };
+    }
+  }
+};
+
+// src/auth.ts
+var AUTH_BASE = "/api/v1/auth";
+var MfaApi = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  /** Complete an MFA login. Pass the `challenge_token` from `login`, plus
+   *  either the authenticator `code` or a `recoveryCode`. */
+  challenge(input) {
+    return this.transport.json(`${AUTH_BASE}/mfa/challenge`, {
+      challenge_token: input.challengeToken,
+      code: input.code,
+      recovery_code: input.recoveryCode
+    });
+  }
+  /** Begin enrollment. Render the returned `otpauth_url` as a QR code.
+   *  Enrollment stays pending until `enrollConfirm`. */
+  enroll(input) {
+    return this.transport.json(
+      `${AUTH_BASE}/mfa/enroll`,
+      {},
+      { accessToken: input.accessToken }
+    );
+  }
+  /** Confirm enrollment with the first authenticator code. The returned
+   *  `recovery_codes` are shown once and never again. */
+  enrollConfirm(input) {
+    return this.transport.json(
+      `${AUTH_BASE}/mfa/enroll/confirm`,
+      { code: input.code },
+      { accessToken: input.accessToken }
+    );
+  }
+  /** Turn MFA off. Proves possession of the second factor via `code` or
+   *  `recoveryCode`. */
+  disable(input) {
+    return this.transport.json(
+      `${AUTH_BASE}/mfa/disable`,
+      { code: input.code, recovery_code: input.recoveryCode },
+      { accessToken: input.accessToken }
+    );
+  }
+};
+var AuthApi = class {
+  constructor(transport, sessionOptions) {
+    this.transport = transport;
+    this.mfa = new MfaApi(transport);
+    this.sessions = new SessionVerifier(this, sessionOptions);
+  }
+  /** Create an account. If the project requires email verification the
+   *  response has `verification_required: true` and NO tokens; collect a
+   *  code and call `verifyEmail`, then `login`. */
+  signup(input) {
+    return this.transport.json(`${AUTH_BASE}/signup`, {
+      email: input.email,
+      password: input.password,
+      name: input.name,
+      role: input.role
+    });
+  }
+  /** Authenticate. Branch on `mfa_required`: when true you hold only a
+   *  challenge (finish via `mfa.challenge`); otherwise `tokens` is your
+   *  session. A 403 `EmailNotVerified` means the email step isn't done. */
+  login(input) {
+    return this.transport.json(`${AUTH_BASE}/login`, {
+      email: input.email,
+      password: input.password
+    });
+  }
+  /** Validate the current credential (API key or device token) and report the
+   *  project, the caller's role, and which capabilities that role grants.
+   *  Backs the MCP "is my session still good" check. */
+  info() {
+    return this.transport.get("/api/v1/info");
+  }
+  /** Resolve the signed-in user from their access token, or `{ user: null }`.
+   *  This is a network round-trip; for a per-navigation guard prefer
+   *  `getSession`, which can answer offline and caches verified results. */
+  me(input) {
+    return this.transport.json(
+      `${AUTH_BASE}/me`,
+      {},
+      { accessToken: input.accessToken, timeoutMs: input.timeoutMs }
+    );
+  }
+  /**
+   * Resolve an access token into a session for a route guard, the one call
+   * that replaces "hit `me` on every navigation". Two modes:
+   *
+   *   - `'optimistic'` (default): decode the token locally and trust its
+   *     claims. Zero network, zero stall. The right default for gating page
+   *     loads. It does NOT verify the signature and will not notice a
+   *     server-side revocation until the token's own `exp`.
+   *   - `'verified'`: confirm against the gateway's `me`, cached for a short
+   *     TTL with a hard timeout. Use it before sensitive actions. On a
+   *     timeout/outage it returns `status: 'unavailable'` with the optimistic
+   *     user, so you choose whether to fail open rather than the SDK guessing.
+   *
+   * See the BYOC docs ("Sessions") for the full reasoning and best practices.
+   */
+  getSession(input) {
+    return this.sessions.getSession(input);
+  }
+  /** Read the access token from a `Cookie` request header and resolve it, in
+   *  one call. `name` defaults to `dc_access_token`. Returns the anonymous
+   *  session when no cookie is present. */
+  sessionFromCookies(cookieHeader, options = {}) {
+    const token = readSessionToken(cookieHeader, options.cookieName);
+    if (!token) return Promise.resolve({ status: "anonymous", user: null, verified: false });
+    return this.sessions.getSession({ accessToken: token, mode: options.mode });
+  }
+  /** Decode an access token's claims locally without a network call or any
+   *  signature check. Convenience re-export of `decodeAccessToken`. */
+  decodeToken(token) {
+    return decodeAccessToken(token);
+  }
+  /** Confirm the 6-digit code emailed at signup. */
+  verifyEmail(input) {
+    return this.transport.json(`${AUTH_BASE}/verify-email`, {
+      code: input.code,
+      email: input.email
+    });
+  }
+  forgotPassword(input) {
+    return this.transport.json(`${AUTH_BASE}/forgot-password`, {
+      email: input.email
+    });
+  }
+  resetPassword(input) {
+    return this.transport.json(`${AUTH_BASE}/reset-password`, {
+      code: input.code,
+      password: input.password,
+      email: input.email
+    });
+  }
+};
+
+// src/db.ts
+var DB_PATH = "/api/v1/db";
+var MIGRATE_PATH = "/api/v1/db/migrate";
+var TableQuery = class {
+  constructor(transport, tableName) {
+    this.transport = transport;
+    this.tableName = tableName;
+  }
+  async run(operation, options) {
+    const res = await this.transport.json(DB_PATH, {
+      operation,
+      tableName: this.tableName,
+      options
+    });
+    return res.data;
+  }
+  /** Rows matching the query (max 1000 per call). */
+  find(options = {}) {
+    return this.run("find", options);
+  }
+  /** Alias of `find`. */
+  findMany(options = {}) {
+    return this.run("findMany", options);
+  }
+  /** The first matching row, or `null`. */
+  findFirst(options = {}) {
+    return this.run("findFirst", options);
+  }
+  /** Alias of `findFirst`. */
+  findOne(options = {}) {
+    return this.run("findOne", options);
+  }
+  /** Insert one row. Returns `{ id }`. Unique/FK conflicts throw a 409
+   *  DontCodeError, the supported idempotency signal. */
+  insert(data) {
+    return this.run("insert", { data });
+  }
+  /** Update rows matching `where`. Returns `{ count }`. */
+  update(input) {
+    return this.run("update", { where: input.where, data: input.data });
+  }
+  /** Delete rows matching `where`. Returns `{ count }`. */
+  delete(input) {
+    return this.run("delete", { where: input.where });
+  }
+  /** Count matching rows. */
+  count(options = {}) {
+    return this.run("count", options);
+  }
+};
+function createDb(transport) {
+  const table = (tableName) => new TableQuery(transport, tableName);
+  const migrate = (input) => transport.json(MIGRATE_PATH, { sql: input.sql });
+  return new Proxy(table, {
+    get(target, prop, receiver) {
+      if (prop === "migrate") return migrate;
+      if (typeof prop !== "string" || prop === "then" || prop in target) {
+        return Reflect.get(target, prop, receiver);
+      }
+      return new TableQuery(transport, prop);
+    },
+    apply(_target, _thisArg, args) {
+      return table(args[0]);
+    }
+  });
+}
+
+// src/storage.ts
+var STORAGE_PATH = "/api/v1/storage";
+var DEFAULT_CONTENT_TYPE = "application/octet-stream";
+function toBlob(body, contentType) {
+  if (body instanceof Blob) return body;
+  if (typeof body === "string") return new Blob([body], { type: contentType });
+  if (body instanceof ArrayBuffer) return new Blob([body], { type: contentType });
+  if (ArrayBuffer.isView(body)) {
+    return new Blob([body], { type: contentType });
+  }
+  throw new TypeError("upload expects a Blob, ArrayBuffer, typed array, or string");
+}
+function fileName(path) {
+  return path.split("/").filter(Boolean).pop() ?? path;
+}
+var BucketClient = class {
+  constructor(transport, bucket) {
+    this.transport = transport;
+    this.bucket = bucket;
+  }
+  op(operation, params = {}) {
+    return this.transport.json(STORAGE_PATH, { operation, bucket: this.bucket, ...params });
+  }
+  /** List objects under `prefix`. */
+  list(prefix) {
+    return this.op("list", { prefix });
+  }
+  /** Delete one or more objects. Returns `{ deleted }`. */
+  remove(paths) {
+    return this.op("remove", { paths });
+  }
+  /** Move/rename an object within the bucket. */
+  move(from, to) {
+    return this.op("move", { from, to });
+  }
+  createFolder(path) {
+    return this.op("createFolder", { path });
+  }
+  /** Download an object inline (≤ 8 MB). Use `getTemporaryUrl` for larger files. */
+  download(path) {
+    return this.op("download", { path });
+  }
+  /** A short-lived signed URL (default 300s, max 7 days). */
+  getTemporaryUrl(path, expiresIn) {
+    return this.op("getTemporaryUrl", { path, expiresIn });
+  }
+  /** A presigned PUT URL for direct, large uploads (≤ no inline limit). */
+  presignUpload(path, contentType) {
+    return this.op("presignUpload", { path, contentType });
+  }
+  /** Upload bytes directly (≤ 100 MB). For larger files, `presignUpload`
+   *  then PUT to the returned URL yourself. */
+  upload(path, body, contentType = DEFAULT_CONTENT_TYPE) {
+    const form = new FormData();
+    form.append("file", toBlob(body, contentType), fileName(path));
+    form.append("bucket", this.bucket);
+    form.append("path", path);
+    form.append("contentType", contentType);
+    return this.transport.multipart(STORAGE_PATH, form);
+  }
+};
+var PublicBucketClient = class extends BucketClient {
+  constructor(transport) {
+    super(transport, "public");
+  }
+  /** The permanent public URL for an object. */
+  getUrl(path) {
+    return this.op("getUrl", { path });
+  }
+};
+function createStorage(transport) {
+  return {
+    public: new PublicBucketClient(transport),
+    private: new BucketClient(transport, "private")
+  };
+}
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://backend.dontcode.co";
+function fromEnv(name) {
+  if (typeof process === "undefined" || !process.env) return void 0;
+  return process.env[name];
+}
+function dontcode(options = {}) {
+  const apiKey = options.apiKey ?? fromEnv("DONTCODE_API_KEY");
+  const baseUrl3 = (options.baseUrl ?? fromEnv("DONTCODE_API_URL") ?? DEFAULT_BASE_URL).replace(
+    /\/+$/,
+    ""
+  );
+  const transport = new Transport({ apiKey, baseUrl: baseUrl3, timeoutMs: options.timeoutMs });
+  return {
+    auth: new AuthApi(transport, options.session),
+    db: createDb(transport),
+    storage: createStorage(transport)
+  };
+}
+
+// src/mcp/server.ts
+var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
+var import_zod = require("zod");
+var SERVER_NAME = "dontcode-backend";
+var SERVER_VERSION = "0.3.0";
+function baseUrl() {
+  return (process.env.DONTCODE_API_URL || "https://backend.dontcode.co").replace(/\/+$/, "");
+}
+var pendingFlow = null;
+function text(value) {
+  const body = typeof value === "string" ? value : JSON.stringify(value, null, 2);
+  return { content: [{ type: "text", text: body }] };
+}
+function failure(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+function describeError(err) {
+  if (isDontCodeError(err)) {
+    if (err.status === 401) {
+      return "Not signed in or the session expired. Use the `auth_login` tool, approve in the browser, then `auth_wait`.";
+    }
+    if (err.status === 403) {
+      return `Your project role does not allow that. (${err.message})`;
+    }
+    if (err.rateLimited) {
+      return `Rate limited. ${err.message}`;
+    }
+    return err.message;
+  }
+  return err instanceof Error ? err.message : "Unknown error";
+}
+function requireClient() {
+  const active = resolveActiveToken(baseUrl());
+  if (!active.token) {
+    throw new Error(
+      "Not signed in. Use the `auth_login` tool first (or set DONTCODE_API_KEY for non-interactive use)."
+    );
+  }
+  return dontcode({ apiKey: active.token, baseUrl: baseUrl() });
+}
+async function run(fn) {
+  try {
+    return text(await fn());
+  } catch (err) {
+    return failure(describeError(err));
+  }
+}
+function createMcpServer() {
+  const server = new import_mcp.McpServer({ name: SERVER_NAME, version: SERVER_VERSION });
+  const tool = (name, config, handler) => server.registerTool(name, config, handler);
+  tool(
+    "auth_login",
+    {
+      title: "Sign in to DontCode",
+      description: "Start a browser sign-in. Returns a URL and a short code; tell the user to open the URL, confirm the code matches, pick a project, and approve. Then call `auth_wait`. Not needed if DONTCODE_API_KEY is set.",
+      inputSchema: {
+        client_name: import_zod.z.string().optional().describe('Label shown to the user on the approval screen, e.g. "Claude Code".')
+      },
+      annotations: { readOnlyHint: false, openWorldHint: true }
+    },
+    async ({ client_name }) => run(async () => {
+      const start = await startDeviceAuth(baseUrl(), client_name ?? "Claude Code (MCP)");
+      pendingFlow = start;
+      await openBrowser(start.verification_uri_complete);
+      return {
+        message: "Ask the user to open this URL, confirm the code, choose a project, and approve. Then call auth_wait.",
+        verification_uri: start.verification_uri_complete,
+        user_code: start.user_code,
+        expires_in_seconds: start.expires_in
+      };
+    })
+  );
+  tool(
+    "auth_wait",
+    {
+      title: "Wait for sign-in approval",
+      description: "Poll for the result of `auth_login`. Returns connected once the user approves in the browser, or asks you to call it again if still pending. Safe to call repeatedly.",
+      inputSchema: {},
+      annotations: { readOnlyHint: false, openWorldHint: true }
+    },
+    async () => run(async () => {
+      if (!pendingFlow) {
+        return { status: "no_login_in_progress", hint: "Call auth_login first." };
+      }
+      try {
+        const token = await pollDeviceToken(baseUrl(), pendingFlow, {
+          maxWaitMs: 5e4
+        });
+        saveCredential({
+          access_token: token.access_token,
+          project_id: token.project_id,
+          expires_at: new Date(Date.now() + token.expires_in * 1e3).toISOString(),
+          base_url: baseUrl()
+        });
+        pendingFlow = null;
+        return { status: "connected", project_id: token.project_id };
+      } catch (err) {
+        if (isDontCodeError(err) && err.code === "WaitTimeout") {
+          return {
+            status: "pending",
+            hint: "Still waiting for approval. Ask the user to approve, then call auth_wait again."
+          };
+        }
+        pendingFlow = null;
+        throw err;
+      }
+    })
+  );
+  tool(
+    "auth_status",
+    {
+      title: "Check the current session",
+      description: "Validate the current credential and report the project, your role, and what you are allowed to do.",
+      inputSchema: {},
+      annotations: { readOnlyHint: true, openWorldHint: true }
+    },
+    async () => run(async () => {
+      const active = resolveActiveToken(baseUrl());
+      if (!active.token) {
+        return { signed_in: false, hint: "Use auth_login to sign in." };
+      }
+      const client = dontcode({ apiKey: active.token, baseUrl: baseUrl() });
+      const info = await client.auth.info();
+      return { signed_in: true, source: active.source, ...info };
+    })
+  );
+  tool(
+    "auth_logout",
+    {
+      title: "Forget the cached session",
+      description: "Remove the locally cached device token for this gateway.",
+      inputSchema: {},
+      annotations: { readOnlyHint: false, destructiveHint: true }
+    },
+    async () => run(async () => {
+      clearCredential(baseUrl());
+      pendingFlow = null;
+      return { ok: true };
+    })
+  );
+  tool(
+    "db_query",
+    {
+      title: "Query the database",
+      description: "Read rows from a table with a structured query (no raw SQL). Supports where/select/orderBy/limit/offset and count.",
+      inputSchema: {
+        table: import_zod.z.string(),
+        operation: import_zod.z.enum(["find", "findMany", "findFirst", "findOne", "count"]).default("find"),
+        where: import_zod.z.record(import_zod.z.string(), import_zod.z.any()).optional(),
+        select: import_zod.z.array(import_zod.z.string()).optional(),
+        orderBy: import_zod.z.record(import_zod.z.string(), import_zod.z.enum(["asc", "desc"])).optional(),
+        limit: import_zod.z.number().int().positive().max(1e3).optional(),
+        offset: import_zod.z.number().int().nonnegative().optional()
+      },
+      annotations: { readOnlyHint: true, openWorldHint: true }
+    },
+    async ({ table, operation, where, select, orderBy, limit, offset }) => run(async () => {
+      const t = requireClient().db(table);
+      if (operation === "count") return { count: await t.count({ where }) };
+      const options = { where, select, orderBy, limit, offset };
+      if (operation === "findFirst" || operation === "findOne") {
+        return { row: await t.findFirst(options) };
+      }
+      return { rows: await t.find(options) };
+    })
+  );
+  tool(
+    "db_insert",
+    {
+      title: "Insert a row",
+      description: "Insert one row into a table. Returns the new row id.",
+      inputSchema: { table: import_zod.z.string(), data: import_zod.z.record(import_zod.z.string(), import_zod.z.any()) },
+      annotations: { readOnlyHint: false, openWorldHint: true }
+    },
+    async ({ table, data }) => run(async () => requireClient().db(table).insert(data))
+  );
+  tool(
+    "db_update",
+    {
+      title: "Update rows",
+      description: "Update rows matching a where clause. Returns the number of rows changed.",
+      inputSchema: {
+        table: import_zod.z.string(),
+        where: import_zod.z.record(import_zod.z.string(), import_zod.z.any()),
+        data: import_zod.z.record(import_zod.z.string(), import_zod.z.any())
+      },
+      annotations: { readOnlyHint: false, openWorldHint: true }
+    },
+    async ({ table, where, data }) => run(async () => requireClient().db(table).update({ where, data }))
+  );
+  tool(
+    "db_delete",
+    {
+      title: "Delete rows",
+      description: "Delete rows matching a where clause. Destructive: confirm with the user before calling. Returns the number of rows deleted.",
+      inputSchema: { table: import_zod.z.string(), where: import_zod.z.record(import_zod.z.string(), import_zod.z.any()) },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true }
+    },
+    async ({ table, where }) => run(async () => requireClient().db(table).delete({ where }))
+  );
+  tool(
+    "db_migrate",
+    {
+      title: "Run a schema migration",
+      description: "Apply DDL (CREATE/ALTER/DROP TABLE, indexes, etc.) to the project database. Destructive and schema-shaping: confirm with the user, and note it needs an admin/owner role on device-token sessions.",
+      inputSchema: { sql: import_zod.z.string() },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true }
+    },
+    async ({ sql }) => run(async () => requireClient().db.migrate({ sql }))
+  );
+  const bucketArg = import_zod.z.enum(["public", "private"]).default("private");
+  const bucketOf = (client, bucket) => bucket === "public" ? client.storage.public : client.storage.private;
+  tool(
+    "storage_list",
+    {
+      title: "List files",
+      description: "List objects in a storage bucket, optionally under a prefix.",
+      inputSchema: { bucket: bucketArg, prefix: import_zod.z.string().optional() },
+      annotations: { readOnlyHint: true, openWorldHint: true }
+    },
+    async ({ bucket, prefix }) => run(async () => bucketOf(requireClient(), bucket).list(prefix))
+  );
+  tool(
+    "storage_get_url",
+    {
+      title: "Get a public URL",
+      description: "Get the permanent public URL for an object in the public bucket.",
+      inputSchema: { path: import_zod.z.string() },
+      annotations: { readOnlyHint: true, openWorldHint: true }
+    },
+    async ({ path }) => run(async () => requireClient().storage.public.getUrl(path))
+  );
+  tool(
+    "storage_temporary_url",
+    {
+      title: "Get a temporary URL",
+      description: "Get a short-lived signed URL for an object (default 300s, max 7 days).",
+      inputSchema: {
+        bucket: bucketArg,
+        path: import_zod.z.string(),
+        expires_in: import_zod.z.number().int().positive().optional()
+      },
+      annotations: { readOnlyHint: true, openWorldHint: true }
+    },
+    async ({ bucket, path, expires_in }) => run(async () => bucketOf(requireClient(), bucket).getTemporaryUrl(path, expires_in))
+  );
+  tool(
+    "storage_upload",
+    {
+      title: "Upload a text file",
+      description: "Upload UTF-8 text content to a path. For binary or large files, use storage_temporary_url + a direct PUT instead.",
+      inputSchema: {
+        bucket: bucketArg,
+        path: import_zod.z.string(),
+        content: import_zod.z.string(),
+        content_type: import_zod.z.string().optional()
+      },
+      annotations: { readOnlyHint: false, openWorldHint: true }
+    },
+    async ({ bucket, path, content, content_type }) => run(
+      async () => bucketOf(requireClient(), bucket).upload(
+        path,
+        content,
+        content_type ?? "text/plain"
+      )
+    )
+  );
+  tool(
+    "storage_remove",
+    {
+      title: "Delete files",
+      description: "Delete one or more objects. Destructive: confirm with the user.",
+      inputSchema: { bucket: bucketArg, paths: import_zod.z.array(import_zod.z.string()).min(1) },
+      annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: true }
+    },
+    async ({ bucket, paths }) => run(async () => bucketOf(requireClient(), bucket).remove(paths))
+  );
+  tool(
+    "storage_move",
+    {
+      title: "Move or rename a file",
+      description: "Move/rename an object within a bucket.",
+      inputSchema: { bucket: bucketArg, from: import_zod.z.string(), to: import_zod.z.string() },
+      annotations: { readOnlyHint: false, openWorldHint: true }
+    },
+    async ({ bucket, from, to }) => run(async () => bucketOf(requireClient(), bucket).move(from, to))
+  );
+  return server;
+}
+async function startMcpServer() {
+  const server = createMcpServer();
+  const transport = new import_stdio.StdioServerTransport();
+  await server.connect(transport);
+  console.error(`[${SERVER_NAME}] MCP server ready on stdio (gateway: ${baseUrl()})`);
+}
+
+// src/cli.ts
+function baseUrl2() {
+  return (process.env.DONTCODE_API_URL || "https://backend.dontcode.co").replace(/\/+$/, "");
+}
+var HELP = `dontcode \u2014 developer CLI for DontCode Backend
+
+Usage: dontcode <command>
+
+Commands:
+  mcp        Run the MCP server on stdio (configure this in your AI tool)
+  login      Sign in through the browser and cache a short-lived token
+  logout     Remove the cached token for the current gateway
+  status     Show the current session (project, role, capabilities)
+  help       Show this help
+
+Environment:
+  DONTCODE_API_URL   Gateway origin (default https://backend.dontcode.co)
+  DONTCODE_API_KEY   A dc_ project key for non-interactive use (skips login)
+  DONTCODE_CONFIG_DIR  Where the cached token lives (default ~/.dontcode)
+`;
+async function cmdLogin() {
+  const cred = await login({
+    baseUrl: baseUrl2(),
+    clientName: "dontcode CLI",
+    log: (m) => process.stderr.write(m)
+  });
+  process.stderr.write(
+    `
+Signed in. Project ${cred.project_id}, token valid until ${cred.expires_at}.
+`
+  );
+}
+async function cmdStatus() {
+  const active = resolveActiveToken(baseUrl2());
+  if (!active.token) {
+    process.stdout.write("Not signed in. Run `dontcode login`.\n");
+    return;
+  }
+  try {
+    const info = await dontcode({ apiKey: active.token, baseUrl: baseUrl2() }).auth.info();
+    process.stdout.write(
+      JSON.stringify({ source: active.source, ...info }, null, 2) + "\n"
+    );
+  } catch (err) {
+    const message = isDontCodeError(err) ? err.message : String(err);
+    process.stdout.write(`Session invalid: ${message}
+`);
+  }
+}
+async function main() {
+  const command = process.argv[2];
+  switch (command) {
+    case "mcp":
+      await startMcpServer();
+      break;
+    case "login":
+      await cmdLogin();
+      break;
+    case "logout":
+      clearCredential(baseUrl2());
+      process.stdout.write("Signed out.\n");
+      break;
+    case "status":
+      await cmdStatus();
+      break;
+    case void 0:
+    case "help":
+    case "-h":
+    case "--help":
+      process.stdout.write(HELP);
+      break;
+    default:
+      process.stderr.write(`Unknown command: ${command}
+
+${HELP}`);
+      process.exit(1);
+  }
+}
+main().catch((err) => {
+  process.stderr.write((err instanceof Error ? err.message : String(err)) + "\n");
+  process.exit(1);
+});
+//# sourceMappingURL=cli.cjs.map