@ekwo-ai/core 0.7.0 → 0.8.0

package/dist/identity.d.ts

@@ -10,7 +10,8 @@
  *
  * This lived in the MCP server. The command line needs the same test and the
  * same sentence, so it moved here and both read it; like `refusal.ts`, this
- * file imports nothing.
+ * file imports nothing — and, since a browser reads it too, it reaches for no
+ * global that only one runtime has.
  */
 /** The variables a surface reads its user from. One spelling, for every surface. */
 export declare const IDENTITY_ENV: {
@@ -26,6 +27,20 @@ export declare const IDENTITY_ENV: {
  * Both shapes Supabase has issued: the signed JWT whose payload carries
  * `"role": "service_role"`, and the newer `sb_secret_…`. Neither is a mistake
  * we should let an operator make by pasting the wrong line of the dashboard.
+ *
+ * **A key shaped like a JWT whose payload cannot be read answers yes.** This
+ * used to decode that payload with `Buffer` inside a `try`, and a browser has
+ * no `Buffer`: the call raised, the `catch` swallowed it, and the function
+ * said *this is not a service_role key* about every JWT it was ever shown —
+ * the one answer that is never safe to guess. The shape is the claim, and a
+ * claim this function cannot read is one it cannot clear.
+ *
+ * **The header is what says the shape**, and not three pieces with dots
+ * between them: `postgresql://user@db.example.test:5432/postgres` has two dots
+ * and so does a password somebody chose, and neither of them is presenting a
+ * token. A JWT opens with a JSON object naming its algorithm; nothing here
+ * verifies the signature that algorithm produced, because the question is what
+ * the key claims and not whether the claim is true.
  */
 export declare function isServiceRoleKey(key: string): boolean;
 /** Where a key was put, which decides what the refusal has to explain. */

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oFAAoF;AACpF,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAYrD;AAED,0EAA0E;AAC1E,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,CAKR"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,oFAAoF;AACpF,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAoDX;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWrD;AAED,0EAA0E;AAC1E,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,CAKR"}

package/dist/identity.js

@@ -10,7 +10,8 @@
  *
  * This lived in the MCP server. The command line needs the same test and the
  * same sentence, so it moved here and both read it; like `refusal.ts`, this
- * file imports nothing.
+ * file imports nothing — and, since a browser reads it too, it reaches for no
+ * global that only one runtime has.
  */
 /** The variables a surface reads its user from. One spelling, for every surface. */
 export const IDENTITY_ENV = {
@@ -20,26 +21,92 @@ export const IDENTITY_ENV = {
     password: 'EKWO_PASSWORD',
     accessToken: 'EKWO_ACCESS_TOKEN',
 };
+/** The base64url alphabet, in value order. `indexOf` is the decoding table. */
+const BASE64URL = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+/**
+ * One segment of a JWT, as text — or nothing when it is not one.
+ *
+ * Written out rather than handed to `Buffer`, which a browser does not have,
+ * or to `atob`, which reads base64 and not base64url and throws on the two
+ * characters that differ. Six bits at a time into a byte buffer, then
+ * `TextDecoder`, which every runtime this code runs in carries. Nothing here
+ * verifies a signature: the question is what the key *claims* to be.
+ */
+function decodeSegment(segment) {
+    const text = segment.replace(/=+$/, '');
+    const bytes = [];
+    let buffer = 0;
+    let bits = 0;
+    for (const character of text) {
+        const value = BASE64URL.indexOf(character);
+        if (value < 0)
+            return undefined;
+        buffer = (buffer << 6) | value;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes.push((buffer >> bits) & 0xff);
+        }
+    }
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(Uint8Array.from(bytes));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A segment that carries a JSON object, as that object. Anything else: nothing. */
+function readSegment(segment) {
+    if (segment === undefined || segment.length === 0)
+        return undefined;
+    const text = decodeSegment(segment);
+    if (text === undefined)
+        return undefined;
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
 /**
  * True when a key is, or claims to be, a `service_role` key.
  *
  * Both shapes Supabase has issued: the signed JWT whose payload carries
  * `"role": "service_role"`, and the newer `sb_secret_…`. Neither is a mistake
  * we should let an operator make by pasting the wrong line of the dashboard.
+ *
+ * **A key shaped like a JWT whose payload cannot be read answers yes.** This
+ * used to decode that payload with `Buffer` inside a `try`, and a browser has
+ * no `Buffer`: the call raised, the `catch` swallowed it, and the function
+ * said *this is not a service_role key* about every JWT it was ever shown —
+ * the one answer that is never safe to guess. The shape is the claim, and a
+ * claim this function cannot read is one it cannot clear.
+ *
+ * **The header is what says the shape**, and not three pieces with dots
+ * between them: `postgresql://user@db.example.test:5432/postgres` has two dots
+ * and so does a password somebody chose, and neither of them is presenting a
+ * token. A JWT opens with a JSON object naming its algorithm; nothing here
+ * verifies the signature that algorithm produced, because the question is what
+ * the key claims and not whether the claim is true.
  */
 export function isServiceRoleKey(key) {
     if (key.startsWith('sb_secret_'))
         return true;
     const parts = key.split('.');
-    if (parts.length !== 3 || parts[1] === undefined)
+    if (parts.length !== 3)
         return false;
-    try {
-        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-        return payload.role === 'service_role';
-    }
-    catch {
+    const header = readSegment(parts[0]);
+    if (header === undefined || typeof header.alg !== 'string')
         return false;
-    }
+    const payload = readSegment(parts[1]);
+    if (payload === undefined)
+        return true;
+    return payload.role === 'service_role';
 }
 /**
  * The refusal, word for word, for whichever surface met the key.

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,eAAe;IACzB,WAAW,EAAE,mBAAmB;CACxB,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE7E,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAKD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAa,EACb,OAAe,EACf,MAAc;IAEd,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,yBAAyB,KAAK,oFAAoF,OAAO,kHAAkH,CAAC;IACrP,CAAC;IACD,OAAO,yBAAyB,KAAK,2KAA2K,OAAO,oGAAoG,MAAM,GAAG,CAAC;AACvU,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,KAAK,EAAE,YAAY;IACnB,QAAQ,EAAE,eAAe;IACzB,WAAW,EAAE,mBAAmB;CACxB,CAAC;AAEX,+EAA+E;AAC/E,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAErF;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,OAA2B;IAC9C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEzE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC;AACzC,CAAC;AAKD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAa,EACb,OAAe,EACf,MAAc;IAEd,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,yBAAyB,KAAK,oFAAoF,OAAO,kHAAkH,CAAC;IACrP,CAAC;IACD,OAAO,yBAAyB,KAAK,2KAA2K,OAAO,oGAAoG,MAAM,GAAG,CAAC;AACvU,CAAC"}

package/dist/schema.d.ts

@@ -15,7 +15,7 @@
  * is not a script, it is a restore.
  */
 /** The oldest schema `@ekwo-ai/core` reads. */
-export declare const SCHEMA_MIN = "0.7.0";
+export declare const SCHEMA_MIN = "0.8.0";
 /** `-1`, `0` or `1`, comparing two `major.minor.patch` versions numerically. */
 export declare function compareSchemaVersions(left: string, right: string): number;
 /** Whether a database at `installed` is new enough for a package needing `minimum`. */

package/dist/schema.js

@@ -15,7 +15,7 @@
  * is not a script, it is a restore.
  */
 /** The oldest schema `@ekwo-ai/core` reads. */
-export const SCHEMA_MIN = '0.7.0';
+export const SCHEMA_MIN = '0.8.0';
 /** `-1`, `0` or `1`, comparing two `major.minor.patch` versions numerically. */
 export function compareSchemaVersions(left, right) {
     const parse = (version) => version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ekwo-ai/core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "TypeScript row types and a typed Supabase client for the Ekwo OS accounting schema.",
   "keywords": ["accounting", "supabase", "postgres", "pcmn", "pcg", "bookkeeping", "ekwo"],
   "license": "AGPL-3.0-only",
@@ -11,7 +11,7 @@
   "type": "module",
   "sideEffects": false,
   "engines": { "node": ">=20" },
-  "ekwo": { "schemaMin": "0.7.0" },
+  "ekwo": { "schemaMin": "0.8.0" },
   "files": ["dist", "README.md", "CHANGELOG.md"],
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -23,13 +23,13 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@ekwo-ai/camt053": "^0.7.0",
-    "@ekwo-ai/cfonb120": "^0.7.0",
-    "@ekwo-ai/coda": "^0.7.0",
-    "@ekwo-ai/fec": "^0.7.0",
-    "@ekwo-ai/journal-items": "^0.7.0",
-    "@ekwo-ai/journal-report": "^0.7.0",
-    "@ekwo-ai/trial-balance": "^0.7.0"
+    "@ekwo-ai/camt053": "^0.8.0",
+    "@ekwo-ai/cfonb120": "^0.8.0",
+    "@ekwo-ai/coda": "^0.8.0",
+    "@ekwo-ai/fec": "^0.8.0",
+    "@ekwo-ai/journal-items": "^0.8.0",
+    "@ekwo-ai/journal-report": "^0.8.0",
+    "@ekwo-ai/trial-balance": "^0.8.0"
   },
   "peerDependencies": {
     "@supabase/supabase-js": "^2.0.0"