@ekwo-ai/core 0.4.0

package/dist/client.js

@@ -0,0 +1,138 @@
+/**
+ * A thin client over the Ekwo schema.
+ *
+ * It is deliberately small: Supabase already exposes every table as REST with
+ * an OpenAPI description, so there is nothing to wrap there. What is worth
+ * wrapping is the handful of functions that carry the accounting rules, and
+ * the FEC export.
+ *
+ * `@supabase/supabase-js` is an optional peer dependency; only the two
+ * methods used here are required, so any structurally compatible client
+ * works and this package keeps zero runtime dependencies.
+ */
+import { fromQueryRow, generateFec } from '@ekwo-ai/fec';
+export class EkwoError extends Error {
+    name = 'EkwoError';
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+    }
+}
+function unwrap(result, call) {
+    if (result.error !== null) {
+        throw new EkwoError(`${call} failed: ${result.error.message}`, result.error.code);
+    }
+    if (result.data === null) {
+        throw new EkwoError(`${call} returned nothing`);
+    }
+    return result.data;
+}
+export class EkwoClient {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Books a document and returns the entry it produced. */
+    async postDocument(documentId) {
+        const result = await this.db.rpc('post_document', { p_document_id: documentId });
+        return unwrap(result, 'post_document');
+    }
+    /** Numbers and posts an entry that was built by hand. */
+    async postEntry(entryId) {
+        const result = await this.db.rpc('post_entry', { p_entry_id: entryId });
+        return unwrap(result, 'post_entry');
+    }
+    /**
+     * Matches a debit line against a credit line. With no amount, the smaller
+     * of the two open amounts is used.
+     */
+    async reconcile(debitLineId, creditLineId, amount) {
+        const result = await this.db.rpc('reconcile', {
+            p_line_a: debitLineId,
+            p_line_b: creditLineId,
+            p_amount: amount ?? null,
+        });
+        return unwrap(result, 'reconcile');
+    }
+    async trialBalance(range) {
+        const result = await this.db.rpc('trial_balance', {
+            p_company_id: range.companyId,
+            p_from: range.from,
+            p_to: range.to,
+        });
+        return unwrap(result, 'trial_balance');
+    }
+    async vatReturn(range) {
+        const result = await this.db.rpc('vat_return', {
+            p_company_id: range.companyId,
+            p_from: range.from,
+            p_to: range.to,
+        });
+        return unwrap(result, 'vat_return');
+    }
+    async agedBalance(companyId, at, group = 'receivable') {
+        const result = await this.db.rpc('aged_balance', {
+            p_company_id: companyId,
+            p_at: at,
+            p_group: group,
+        });
+        return unwrap(result, 'aged_balance');
+    }
+    /** The French FEC for a period, ready to be written to disk. */
+    async generateFec(range, options) {
+        const result = await this.db.rpc('fec_lines', {
+            p_company_id: range.companyId,
+            p_from: range.from,
+            p_to: range.to,
+        });
+        return generateFec(unwrap(result, 'fec_lines').map(fromQueryRow), options);
+    }
+    /**
+     * Records the installation. Called once, by the installer; raises if this
+     * database has already been set up.
+     */
+    async initInstance(organizationName, country, edition = 'community') {
+        const result = await this.db.rpc('init_instance', {
+            p_organization_name: organizationName,
+            p_country: country,
+            p_edition: edition,
+        });
+        return unwrap(result, 'init_instance');
+    }
+    /**
+     * Makes a user an instance administrator. The first claim is open; after
+     * that only an administrator may appoint another.
+     */
+    async claimInstanceAdmin(userId) {
+        const result = await this.db.rpc('claim_instance_admin', {
+            p_user_id: userId ?? null,
+        });
+        return unwrap(result, 'claim_instance_admin');
+    }
+    /**
+     * Opt-in: records an address so Ekwo can reach the operator. Never
+     * required, and `unregisterInstance()` undoes it.
+     */
+    async registerInstance(contactEmail) {
+        const result = await this.db.rpc('register_instance', {
+            p_contact_email: contactEmail,
+        });
+        return unwrap(result, 'register_instance');
+    }
+    async unregisterInstance() {
+        const result = await this.db.rpc('unregister_instance', {});
+        return unwrap(result, 'unregister_instance');
+    }
+    /** Installs a country chart of accounts, journals and taxes into a company. */
+    async installCountryTemplate(companyId, country) {
+        const result = await this.db.rpc('install_country_template', {
+            p_company_id: companyId,
+            p_country: country,
+        });
+        if (result.error !== null) {
+            throw new EkwoError(`install_country_template failed: ${result.error.message}`);
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAqC,MAAM,cAAc,CAAC;AAuB5F,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,GAAG,WAAW,CAAC;IACnB,IAAI,CAAqB;IAElC,YAAY,OAAe,EAAE,IAAa;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,MAAM,CAAI,MAAoB,EAAE,IAAY;IACnD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,YAAY,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAQD,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,EAAgB;QAAhB,OAAE,GAAF,EAAE,CAAc;IAAG,CAAC;IAEjD,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,UAAgB;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAQ,eAAe,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,SAAS,CAAC,OAAa;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAQ,YAAY,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,WAAiB,EAAE,YAAkB,EAAE,MAAe;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE;YAC5C,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,MAAM,IAAI,IAAI;SACzB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAkB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAoB,eAAe,EAAE;YACnE,YAAY,EAAE,KAAK,CAAC,SAAS;YAC7B,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,IAAI,EAAE,KAAK,CAAC,EAAE;SACf,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAkB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAiB,YAAY,EAAE;YAC7D,YAAY,EAAE,KAAK,CAAC,SAAS;YAC7B,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,IAAI,EAAE,KAAK,CAAC,EAAE;SACf,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CACf,SAAe,EACf,EAAW,EACX,QAAkC,YAAY;QAE9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAmB,cAAc,EAAE;YACjE,YAAY,EAAE,SAAS;YACvB,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,WAAW,CAAC,KAAkB,EAAE,OAAoB;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAgB,WAAW,EAAE;YAC3D,YAAY,EAAE,KAAK,CAAC,SAAS;YAC7B,MAAM,EAAE,KAAK,CAAC,IAAI;YAClB,IAAI,EAAE,KAAK,CAAC,EAAE;SACf,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,gBAAwB,EACxB,OAAe,EACf,UAA2B,WAAW;QAEtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAW,eAAe,EAAE;YAC1D,mBAAmB,EAAE,gBAAgB;YACrC,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAa;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAgB,sBAAsB,EAAE;YACtE,SAAS,EAAE,MAAM,IAAI,IAAI;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAW,mBAAmB,EAAE;YAC9D,eAAe,EAAE,YAAY;SAC9B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAW,qBAAqB,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC/C,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,sBAAsB,CAAC,SAAe,EAAE,OAAe;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,EAAE;YAC3D,YAAY,EAAE,SAAS;YACvB,SAAS,EAAE,OAAO;SACnB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF"}

package/dist/fec.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @deprecated The FEC left this package. It is a file format, and a file
+ * format is MIT: install [`@ekwo-ai/fec`](https://www.npmjs.com/package/@ekwo-ai/fec)
+ * and import from there.
+ *
+ * This module re-exports it unchanged so that `@ekwo-ai/core` and
+ * `@ekwo-ai/core/fec` keep working for one version. It goes away in the next.
+ *
+ * `IsoDate` and `Decimal` are deliberately *not* re-exported here: they are
+ * types of the schema and this package already exports its own.
+ */
+export { checkFec, FEC_COLUMNS, FecError, fecFileName, formatFecAmount, formatFecDate, fromQueryRow, generateFec, } from '@ekwo-ai/fec';
+export type { FecColumn, FecLine, FecOptions, FecQueryRow, FecViolation, } from '@ekwo-ai/fec';
+//# sourceMappingURL=fec.d.ts.map

package/dist/fec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fec.d.ts","sourceRoot":"","sources":["../src/fec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,eAAe,EACf,aAAa,EACb,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,SAAS,EACT,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,GACb,MAAM,cAAc,CAAC"}

package/dist/fec.js

@@ -0,0 +1,13 @@
+/**
+ * @deprecated The FEC left this package. It is a file format, and a file
+ * format is MIT: install [`@ekwo-ai/fec`](https://www.npmjs.com/package/@ekwo-ai/fec)
+ * and import from there.
+ *
+ * This module re-exports it unchanged so that `@ekwo-ai/core` and
+ * `@ekwo-ai/core/fec` keep working for one version. It goes away in the next.
+ *
+ * `IsoDate` and `Decimal` are deliberately *not* re-exported here: they are
+ * types of the schema and this package already exports its own.
+ */
+export { checkFec, FEC_COLUMNS, FecError, fecFileName, formatFecAmount, formatFecDate, fromQueryRow, generateFec, } from '@ekwo-ai/fec';
+//# sourceMappingURL=fec.js.map

package/dist/fec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fec.js","sourceRoot":"","sources":["../src/fec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,QAAQ,EACR,WAAW,EACX,eAAe,EACf,aAAa,EACb,YAAY,EACZ,WAAW,GACZ,MAAM,cAAc,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Who a surface acts as — and the one key none of them accepts.
+ *
+ * The MCP server and the command line both sign in as a person and let row
+ * level security decide from there. Both are handed keys by somebody pasting
+ * from a dashboard, and both have to refuse the same paste: a `service_role`
+ * key. It would work — that is the problem. Every policy in the schema would
+ * be bypassed, and a tool that can read every company of an installation is
+ * not the thing anybody asked for.
+ *
+ * This lived in the MCP server. The command line needs the same test and the
+ * same sentence, so it moved here and both read it; like `refusal.ts`, this
+ * file imports nothing.
+ */
+/** The variables a surface reads its user from. One spelling, for every surface. */
+export declare const IDENTITY_ENV: {
+    readonly supabaseUrl: "SUPABASE_URL";
+    readonly anonKey: "SUPABASE_ANON_KEY";
+    readonly email: "EKWO_EMAIL";
+    readonly password: "EKWO_PASSWORD";
+    readonly accessToken: "EKWO_ACCESS_TOKEN";
+};
+/**
+ * True when a key is, or claims to be, a `service_role` key.
+ *
+ * Both shapes Supabase has issued: the signed JWT whose payload carries
+ * `"role": "service_role"`, and the newer `sb_secret_…`. Neither is a mistake
+ * we should let an operator make by pasting the wrong line of the dashboard.
+ */
+export declare function isServiceRoleKey(key: string): boolean;
+/** Where a key was put, which decides what the refusal has to explain. */
+export type KeySlot = 'apikey' | 'authorization';
+/**
+ * The refusal, word for word, for whichever surface met the key.
+ *
+ * There are two doors and not one. The `apikey` slot is the obvious paste. The
+ * `Authorization` header is the quiet one: PostgREST takes the role from that
+ * header and not from `apikey`, so a service_role token put there overrides a
+ * perfectly good anon key sitting next to it.
+ *
+ * `where` is what the operator typed — a variable, a flag — and `surface` is
+ * who is speaking: `this server`, `this command line`. `signIn` is how that
+ * surface gets a real session instead.
+ */
+export declare function serviceRoleRefusal(where: string, slot: KeySlot, surface: string, signIn: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oFAAoF;AACpF,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAYrD;AAED,0EAA0E;AAC1E,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,CAKR"}

package/dist/identity.js

@@ -0,0 +1,62 @@
+/**
+ * Who a surface acts as — and the one key none of them accepts.
+ *
+ * The MCP server and the command line both sign in as a person and let row
+ * level security decide from there. Both are handed keys by somebody pasting
+ * from a dashboard, and both have to refuse the same paste: a `service_role`
+ * key. It would work — that is the problem. Every policy in the schema would
+ * be bypassed, and a tool that can read every company of an installation is
+ * not the thing anybody asked for.
+ *
+ * This lived in the MCP server. The command line needs the same test and the
+ * same sentence, so it moved here and both read it; like `refusal.ts`, this
+ * file imports nothing.
+ */
+/** The variables a surface reads its user from. One spelling, for every surface. */
+export const IDENTITY_ENV = {
+    supabaseUrl: 'SUPABASE_URL',
+    anonKey: 'SUPABASE_ANON_KEY',
+    email: 'EKWO_EMAIL',
+    password: 'EKWO_PASSWORD',
+    accessToken: 'EKWO_ACCESS_TOKEN',
+};
+/**
+ * True when a key is, or claims to be, a `service_role` key.
+ *
+ * Both shapes Supabase has issued: the signed JWT whose payload carries
+ * `"role": "service_role"`, and the newer `sb_secret_…`. Neither is a mistake
+ * we should let an operator make by pasting the wrong line of the dashboard.
+ */
+export function isServiceRoleKey(key) {
+    if (key.startsWith('sb_secret_'))
+        return true;
+    const parts = key.split('.');
+    if (parts.length !== 3 || parts[1] === undefined)
+        return false;
+    try {
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        return payload.role === 'service_role';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The refusal, word for word, for whichever surface met the key.
+ *
+ * There are two doors and not one. The `apikey` slot is the obvious paste. The
+ * `Authorization` header is the quiet one: PostgREST takes the role from that
+ * header and not from `apikey`, so a service_role token put there overrides a
+ * perfectly good anon key sitting next to it.
+ *
+ * `where` is what the operator typed — a variable, a flag — and `surface` is
+ * who is speaking: `this server`, `this command line`. `signIn` is how that
+ * surface gets a real session instead.
+ */
+export function serviceRoleRefusal(where, slot, surface, signIn) {
+    if (slot === 'apikey') {
+        return `service_role_refused: ${where} holds a service_role key. That key bypasses every row level security policy, so ${surface} would answer for companies its user was never invited to. Use the anon (publishable) key and sign in as a user.`;
+    }
+    return `service_role_refused: ${where} holds a service_role key. It travels in the Authorization header, which is where PostgREST reads the role from, so it would bypass every row level security policy and ${surface} would answer for companies its user was never invited to. Use a session token for a real user — ${signIn}.`;
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,eAAe;IACzB,WAAW,EAAE,mBAAmB;CACxB,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE7E,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAKD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAa,EACb,OAAe,EACf,MAAc;IAEd,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,yBAAyB,KAAK,oFAAoF,OAAO,kHAAkH,CAAC;IACrP,CAAC;IACD,OAAO,yBAAyB,KAAK,2KAA2K,OAAO,oGAAoG,MAAM,GAAG,CAAC;AACvU,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Ekwo OS — TypeScript core.
+ *
+ * @see https://github.com/Ekwo-ai/ekwo-os
+ */
+export * from './types.js';
+export * from './client.js';
+export { SCHEMA_MIN, compareSchemaVersions, schemaIsAtLeast } from './schema.js';
+export { isRefusalState, socleCode } from './refusal.js';
+export { IDENTITY_ENV, isServiceRoleKey, serviceRoleRefusal, type KeySlot } from './identity.js';
+export * from './books/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AACjG,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+/**
+ * Ekwo OS — TypeScript core.
+ *
+ * @see https://github.com/Ekwo-ai/ekwo-os
+ */
+export * from './types.js';
+export * from './client.js';
+export { SCHEMA_MIN, compareSchemaVersions, schemaIsAtLeast } from './schema.js';
+export { isRefusalState, socleCode } from './refusal.js';
+export { IDENTITY_ENV, isServiceRoleKey, serviceRoleRefusal } from './identity.js';
+export * from './books/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAgB,MAAM,eAAe,CAAC;AACjG,cAAc,kBAAkB,CAAC"}

package/dist/refusal.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Reading a refusal of the database — once, for every surface.
+ *
+ * The accounting rules live in the schema and they raise with a prefixed
+ * name: `period_locked: 2026-03-31 is …`, `tax_territory_mismatch: …`. The
+ * MCP server hands that name to a model and the command line turns it into an
+ * exit code, so both have to agree on what a name is and on what counts as
+ * the books saying no. That agreement is this file. It imports nothing, on
+ * purpose: the CLI is handed a database password, and what it loads from here
+ * has to be readable in one sitting.
+ */
+/** The identifier of a raise like `period_locked: 2026-03-31 is …`, or undefined. */
+export declare function socleCode(message: string): string | undefined;
+/**
+ * Whether an SQLSTATE is the database declining, as opposed to failing.
+ *
+ * The schema refuses in a small number of ways and every one of them is a
+ * decision: a `raise exception` of its own (`P0001`, and `P0002` where a
+ * function names something that is not there or not visible), a capability
+ * the caller does not hold or a row level security policy (`42501`), a lock
+ * on a period or a closed year (`55006`), and a constraint (class `23`).
+ * Everything else — a connection that dropped (`08…`), a relation that does
+ * not exist (`42P01`), a syntax error — is the software failing, and a caller
+ * that retries or reports a bug is right to.
+ */
+export declare function isRefusalState(sqlstate: string | undefined): boolean;
+//# sourceMappingURL=refusal.d.ts.map

package/dist/refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.d.ts","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,qFAAqF;AACrF,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKpE"}

package/dist/refusal.js

@@ -0,0 +1,38 @@
+/**
+ * Reading a refusal of the database — once, for every surface.
+ *
+ * The accounting rules live in the schema and they raise with a prefixed
+ * name: `period_locked: 2026-03-31 is …`, `tax_territory_mismatch: …`. The
+ * MCP server hands that name to a model and the command line turns it into an
+ * exit code, so both have to agree on what a name is and on what counts as
+ * the books saying no. That agreement is this file. It imports nothing, on
+ * purpose: the CLI is handed a database password, and what it loads from here
+ * has to be readable in one sitting.
+ */
+/** The identifier of a raise like `period_locked: 2026-03-31 is …`, or undefined. */
+export function socleCode(message) {
+    const match = /^([a-z][a-z0-9_]{3,}):/.exec(message.trim());
+    return match?.[1];
+}
+/**
+ * Whether an SQLSTATE is the database declining, as opposed to failing.
+ *
+ * The schema refuses in a small number of ways and every one of them is a
+ * decision: a `raise exception` of its own (`P0001`, and `P0002` where a
+ * function names something that is not there or not visible), a capability
+ * the caller does not hold or a row level security policy (`42501`), a lock
+ * on a period or a closed year (`55006`), and a constraint (class `23`).
+ * Everything else — a connection that dropped (`08…`), a relation that does
+ * not exist (`42P01`), a syntax error — is the software failing, and a caller
+ * that retries or reports a bug is right to.
+ */
+export function isRefusalState(sqlstate) {
+    if (sqlstate === undefined)
+        return false;
+    if (sqlstate === 'P0001' || sqlstate === 'P0002')
+        return true;
+    if (sqlstate === '42501' || sqlstate === '55006')
+        return true;
+    return sqlstate.startsWith('23');
+}
+//# sourceMappingURL=refusal.js.map

package/dist/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,qFAAqF;AACrF,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,QAA4B;IACzD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The schema version this package is written against.
+ *
+ * A country pack declares `schema_min` in its manifest, and for the same
+ * reason a published npm package has to: the rows it reads and the functions
+ * it calls are a contract with a version of the database, and installing a
+ * newer client against an older database is the one upgrade order nobody
+ * plans for. The number is declared in `package.json` under `ekwo.schemaMin`
+ * and repeated here as a constant, so a bundler that never reads a manifest
+ * still carries it; a test keeps the two equal.
+ *
+ * Forward only. A release of Ekwo is a tag carrying migrations, packs and
+ * packages together; there is no "down" migration and there never will be,
+ * because undoing a schema change on a database with a year of entries in it
+ * is not a script, it is a restore.
+ */
+/** The oldest schema `@ekwo-ai/core` reads. */
+export declare const SCHEMA_MIN = "0.4.0";
+/** `-1`, `0` or `1`, comparing two `major.minor.patch` versions numerically. */
+export declare function compareSchemaVersions(left: string, right: string): number;
+/** Whether a database at `installed` is new enough for a package needing `minimum`. */
+export declare function schemaIsAtLeast(installed: string, minimum: string): boolean;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,+CAA+C;AAC/C,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBzE;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3E"}

package/dist/schema.js

@@ -0,0 +1,42 @@
+/**
+ * The schema version this package is written against.
+ *
+ * A country pack declares `schema_min` in its manifest, and for the same
+ * reason a published npm package has to: the rows it reads and the functions
+ * it calls are a contract with a version of the database, and installing a
+ * newer client against an older database is the one upgrade order nobody
+ * plans for. The number is declared in `package.json` under `ekwo.schemaMin`
+ * and repeated here as a constant, so a bundler that never reads a manifest
+ * still carries it; a test keeps the two equal.
+ *
+ * Forward only. A release of Ekwo is a tag carrying migrations, packs and
+ * packages together; there is no "down" migration and there never will be,
+ * because undoing a schema change on a database with a year of entries in it
+ * is not a script, it is a restore.
+ */
+/** The oldest schema `@ekwo-ai/core` reads. */
+export const SCHEMA_MIN = '0.4.0';
+/** `-1`, `0` or `1`, comparing two `major.minor.patch` versions numerically. */
+export function compareSchemaVersions(left, right) {
+    const parse = (version) => version
+        .trim()
+        .split('.')
+        .map((part) => Number.parseInt(part, 10));
+    const a = parse(left);
+    const b = parse(right);
+    for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+        const one = a[index] ?? 0;
+        const other = b[index] ?? 0;
+        if (Number.isNaN(one) || Number.isNaN(other)) {
+            throw new Error(`bad_schema_version: ${left} and ${right} are not both major.minor.patch`);
+        }
+        if (one !== other)
+            return one < other ? -1 : 1;
+    }
+    return 0;
+}
+/** Whether a database at `installed` is new enough for a package needing `minimum`. */
+export function schemaIsAtLeast(installed, minimum) {
+    return compareSchemaVersions(installed, minimum) >= 0;
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAElC,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,CAAC,OAAe,EAAY,EAAE,CAC1C,OAAO;SACJ,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,QAAQ,KAAK,iCAAiC,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,OAAe;IAChE,OAAO,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC"}