@heychunky/core 0.1.0

package/dist/admin/services/github.js

@@ -0,0 +1,164 @@
+/**
+ * GitHub — repos, branches, issues, project boards.
+ *
+ * The factory's token is account-wide and spans several organisations, which is
+ * deliberate: a fine-grained PAT has exactly one resource owner and cannot cover
+ * heychunkydev, carmelcity, calinnov and the user account at once. Breadth is a
+ * requirement of that, so containment lives here — destructive calls refuse
+ * without an explicit confirmation.
+ */
+import { request, requestWithHeaders } from "../../http/request.js";
+import { NotFoundError } from "../../http/errors.js";
+import { matchByName } from "../../config/names.js";
+import { probe, probeAccess } from "../../services/types.js";
+const GH = "https://api.github.com";
+const VERSION = { "x-github-api-version": "2022-11-28" };
+/** Scopes worth spelling out, dangerous first. Classic PATs only. */
+const SCOPE_MEANING = [
+    ["admin:enterprise", "administer the enterprise account"],
+    ["admin:org", "administer the organisation, its members and settings"],
+    ["delete_repo", "delete any repository"],
+    ["repo", "read and write every repository, private included"],
+    ["workflow", "create and update Actions workflows"],
+    ["project", "read and write project boards"],
+    ["write:packages", "publish and overwrite packages"],
+];
+export function github(token) {
+    const creds = { token };
+    const opts = { credentials: creds, headers: VERSION };
+    async function listRepos(affiliation = "owner,organization_member") {
+        const out = [];
+        for (let page = 1;; page++) {
+            const batch = await request(`${GH}/user/repos?affiliation=${affiliation}&per_page=100&page=${page}`, opts);
+            out.push(...batch);
+            if (batch.length < 100)
+                break;
+        }
+        return out;
+    }
+    /** Public repos on the authenticated user. The policy expects none. */
+    async function listPublicRepos() {
+        return request(`${GH}/user/repos?visibility=public&affiliation=owner&per_page=100`, opts);
+    }
+    /** Who this token authenticates as. The default owner for a new repo. */
+    const login = async () => (await request(`${GH}/user`, opts)).login;
+    /**
+     * One repository, or undefined.
+     *
+     * Provisioning asks this before creating anything, which is what makes a
+     * half-finished run safe to repeat. A 404 is an answer here, not a failure.
+     */
+    async function findRepo(fullName) {
+        try {
+            return await request(`${GH}/repos/${fullName}`, opts);
+        }
+        catch (err) {
+            if (err instanceof NotFoundError)
+                return undefined;
+            throw err;
+        }
+    }
+    /**
+     * A repository for an app, trying the forms one might have been named in.
+     *
+     * Exact first, because that is right for anything the factory created and
+     * costs one request. Only when that misses does it list the owner's repos and
+     * match on name variants — which is what finds `carmel.city` when the app is
+     * called `carmel-city`, or the reverse.
+     *
+     * Worth the extra call: a false "missing" in a provisioning tool is the
+     * dangerous direction, because the next step is to create what is already
+     * there under another name.
+     */
+    async function findRepoFor(app, org) {
+        const owner = org ?? (await login());
+        const exact = await findRepo(`${owner}/${app}`);
+        if (exact)
+            return exact;
+        const mine = (await listRepos()).filter((r) => r.full_name.startsWith(`${owner}/`));
+        return matchByName(app, mine, (r) => r.name);
+    }
+    /**
+     * Create a private repo, in an organisation or on the user.
+     * Private is not a parameter — the factory has no use for a public repo, and
+     * making it an option is how one gets created by accident.
+     */
+    async function createRepo(name, o = {}) {
+        const url = o.org ? `${GH}/orgs/${o.org}/repos` : `${GH}/user/repos`;
+        return request(url, {
+            ...opts, method: "POST",
+            body: { name, private: true, auto_init: true, description: o.description },
+        });
+    }
+    /**
+     * Delete a repository. Takes issues, pull requests, releases and history
+     * with it; GitHub's restore window closes the moment the name is reused.
+     *
+     * The `confirmed` flag is required by the type, so this cannot be reached by
+     * a caller that has not thought about it — the guarantee holds whatever a
+     * skill file or a prompt says.
+     */
+    async function deleteRepo(fullName, o) {
+        if (!o?.confirmed)
+            throw new Error(`Refusing to delete ${fullName} without confirmation`);
+        await request(`${GH}/repos/${fullName}`, { ...opts, method: "DELETE" });
+    }
+    async function createBranch(fullName, branch, from) {
+        const ref = await request(`${GH}/repos/${fullName}/git/ref/heads/${from}`, opts);
+        await request(`${GH}/repos/${fullName}/git/refs`, {
+            ...opts, method: "POST",
+            body: { ref: `refs/heads/${branch}`, sha: ref.object.sha },
+        });
+    }
+    return {
+        login,
+        listRepos,
+        listPublicRepos,
+        findRepo,
+        findRepoFor,
+        createRepo,
+        deleteRepo,
+        createBranch,
+        async status() {
+            return probe("github", async () => {
+                const me = await request(`${GH}/user`, opts);
+                const pub = await listPublicRepos();
+                return `${me.login} · ${pub.length} public repo${pub.length === 1 ? "" : "s"}` +
+                    (pub.length ? " ⚠️ policy is zero" : "");
+            });
+        },
+        async access() {
+            return probeAccess("github", async () => {
+                const { data: me, headers } = await requestWithHeaders(`${GH}/user`, opts);
+                // Populated only for classic PATs. Fine-grained tokens and app tokens
+                // omit it, and GitHub offers no other way to read their permissions.
+                const raw = headers.get("x-oauth-scopes");
+                const scopes = (raw ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+                const expires = headers.get("github-authentication-token-expiration");
+                const notes = [];
+                if (scopes.length) {
+                    notes.push(`classic PAT, ${scopes.length} scopes, authenticated as ${me.login}`);
+                    if (scopes.includes("delete_repo"))
+                        notes.push("holds delete_repo — this key can delete repositories");
+                    if (scopes.includes("admin:org"))
+                        notes.push("holds organisation admin, beyond what any command uses");
+                }
+                else {
+                    notes.push(`fine-grained PAT or app token as ${me.login}`);
+                    notes.push("GitHub does not expose fine-grained permissions over the API — rights unknown");
+                }
+                notes.push(expires ? `expires ${expires.slice(0, 10)}` : "does not expire");
+                const repos = await listRepos();
+                return {
+                    evidence: scopes.length ? "scopes" : "identity",
+                    scopes,
+                    can: scopes.length
+                        ? SCOPE_MEANING.filter(([s]) => scopes.includes(s)).map(([, m]) => m)
+                        : [`reach ${repos.length} repositories`],
+                    notes,
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=github.js.map

package/dist/admin/services/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/admin/services/github.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAoB,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAErG,MAAM,EAAE,GAAG,wBAAwB,CAAC;AACpC,MAAM,OAAO,GAAG,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC;AAUzD,qEAAqE;AACrE,MAAM,aAAa,GAAuB;IACxC,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;IACzD,CAAC,WAAW,EAAE,uDAAuD,CAAC;IACtE,CAAC,aAAa,EAAE,uBAAuB,CAAC;IACxC,CAAC,MAAM,EAAE,mDAAmD,CAAC;IAC7D,CAAC,UAAU,EAAE,qCAAqC,CAAC;IACnD,CAAC,SAAS,EAAE,+BAA+B,CAAC;IAC5C,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;CACrD,CAAC;AAEF,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAEtD,KAAK,UAAU,SAAS,CAAC,WAAW,GAAG,2BAA2B;QAChE,MAAM,GAAG,GAAW,EAAE,CAAC;QACvB,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,GAAG,EAAE,2BAA2B,WAAW,sBAAsB,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACjF,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACnB,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM;QAChC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,uEAAuE;IACvE,KAAK,UAAU,eAAe;QAC5B,OAAO,OAAO,CAAS,GAAG,EAAE,8DAA8D,EAAE,IAAI,CAAC,CAAC;IACpG,CAAC;IAED,yEAAyE;IACzE,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,CAAoB,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAEvF;;;;;OAKG;IACH,KAAK,UAAU,QAAQ,CAAC,QAAgB;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAO,GAAG,EAAE,UAAU,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa;gBAAE,OAAO,SAAS,CAAC;YACnD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAAY;QAClD,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC;QACpF,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,IAA4C,EAAE;QAE9C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC;QACrE,OAAO,OAAO,CAAO,GAAG,EAAE;YACxB,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM;YACvB,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;SAC3E,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,CAAsB;QAChE,IAAI,CAAC,CAAC,EAAE,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,uBAAuB,CAAC,CAAC;QAC1F,MAAM,OAAO,CAAC,GAAG,EAAE,UAAU,QAAQ,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY;QACxE,MAAM,GAAG,GAAG,MAAM,OAAO,CAA8B,GAAG,EAAE,UAAU,QAAQ,kBAAkB,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9G,MAAM,OAAO,CAAC,GAAG,EAAE,UAAU,QAAQ,WAAW,EAAE;YAChD,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM;YACvB,IAAI,EAAE,EAAE,GAAG,EAAE,cAAc,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK;QACL,SAAS;QACT,eAAe;QACf,QAAQ;QACR,WAAW;QACX,UAAU;QACV,UAAU;QACV,YAAY;QAEZ,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBAChC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAoB,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBAChE,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;gBACpC,OAAO,GAAG,EAAE,CAAC,KAAK,MAAM,GAAG,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;oBAC5E,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACtC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CAAoB,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC9F,sEAAsE;gBACtE,qEAAqE;gBACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC1C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;gBACtE,MAAM,KAAK,GAAa,EAAE,CAAC;gBAE3B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,KAAK,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,MAAM,6BAA6B,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;oBACjF,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;oBACvG,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;gBACzG,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,oCAAoC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;oBAC3D,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;gBAC9F,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAE5E,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;gBAChC,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAE,UAAoB;oBACrE,MAAM;oBACN,GAAG,EAAE,MAAM,CAAC,MAAM;wBAChB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;wBACrE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,eAAe,CAAC;oBAC1C,KAAK;iBACN,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/neon.d.ts

@@ -0,0 +1,42 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface NeonProject {
+    id: string;
+    name: string;
+    region_id: string;
+    pg_version: number;
+}
+export interface NeonBranch {
+    id: string;
+    name: string;
+    parent_id?: string;
+    default?: boolean;
+    current_state?: string;
+}
+export declare function neon(token: string): {
+    organizations: () => Promise<{
+        id: string;
+        name: string;
+        plan: string;
+    }[]>;
+    projects: () => Promise<NeonProject[]>;
+    findProject: (name: string) => Promise<NeonProject | undefined>;
+    createProject: (name: string, opts?: {
+        orgId?: string;
+        region?: string;
+    }) => Promise<NeonProject>;
+    branches: (projectId: string) => Promise<NeonBranch[]>;
+    createBranch: (projectId: string, name: string, parentId?: string) => Promise<NeonBranch>;
+    resetFromParent: (projectId: string, branchId: string, opts: {
+        confirmed: true;
+    }) => Promise<void>;
+    deleteBranch: (projectId: string, branchId: string, opts: {
+        confirmed: true;
+    }) => Promise<void>;
+    connectionUri: (projectId: string, branchId: string, opts?: {
+        database?: string;
+        role?: string;
+    }) => Promise<string>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=neon.d.ts.map

package/dist/admin/services/neon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"neon.d.ts","sourceRoot":"","sources":["../../../src/admin/services/neon.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAIrG,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAChG,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;AAEvH,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM;;YAKQ,MAAM;cAAQ,MAAM;cAAQ,MAAM;;oBAE/C,OAAO,CAAC,WAAW,EAAE,CAAC;wBAShB,MAAM,KAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;0BAelE,MAAM,SAAQ;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KACtD,OAAO,CAAC,WAAW,CAAC;0BAYY,MAAM;8BAY5B,MAAM,QAAQ,MAAM,aAAa,MAAM,KACjD,OAAO,CAAC,UAAU,CAAC;iCAwDT,MAAM,YAAY,MAAM,QAAQ;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,KAC7D,OAAO,CAAC,IAAI,CAAC;8BA9BH,MAAM,YAAY,MAAM,QAAQ;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,KAC7D,OAAO,CAAC,IAAI,CAAC;+BAYH,MAAM,YAAY,MAAM,SAC7B;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KACzC,OAAO,CAAC,MAAM,CAAC;cAoCA,OAAO,CAAC,aAAa,CAAC;cAOtB,OAAO,CAAC,aAAa,CAAC;EAyBzC"}

package/dist/admin/services/neon.js

@@ -0,0 +1,157 @@
+/**
+ * Neon — the control plane. Projects, branches, endpoints.
+ *
+ * App data goes through ../../services/neon.ts, which reaches for a connection
+ * string and never for this key.
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+const API = "https://console.neon.tech/api/v2";
+export function neon(token) {
+    const creds = { token };
+    const o = { credentials: creds };
+    const organizations = async () => (await request(`${API}/users/me/organizations`, o)).organizations;
+    async function projects() {
+        const out = [];
+        for (const org of await organizations()) {
+            const r = await request(`${API}/projects?org_id=${org.id}`, o);
+            out.push(...r.projects);
+        }
+        return out;
+    }
+    const findProject = async (name) => (await projects()).find((p) => p.name === name);
+    /**
+     * Create a project, with its default branch and endpoint.
+     *
+     * The region follows whatever the account already uses rather than a
+     * hardcoded default — an app whose database sits on another continent from
+     * its siblings is a latency bug nobody goes looking for.
+     *
+     * Neon's response includes live connection URIs, password and all. Only the
+     * project's identity leaves this function; a connection string is something a
+     * caller asks for deliberately.
+     */
+    async function createProject(name, opts = {}) {
+        const existing = await projects();
+        const org = opts.orgId ?? (await organizations())[0]?.id;
+        if (!org)
+            throw new Error("No Neon organisation this key can create in");
+        const region = opts.region ?? existing[0]?.region_id ?? "aws-us-east-2";
+        const { project: p } = await request(`${API}/projects`, {
+            ...o, method: "POST",
+            body: { project: { name, org_id: org, region_id: region } },
+        });
+        return { id: p.id, name: p.name, region_id: p.region_id, pg_version: p.pg_version };
+    }
+    const branches = async (projectId) => (await request(`${API}/projects/${projectId}/branches`, o)).branches ?? [];
+    /**
+     * Create a branch, with a compute endpoint so it can be connected to.
+     *
+     * Neon will happily create a branch with no endpoint — it costs nothing and
+     * is unreachable, which is a confusing thing to hand someone as a working
+     * environment. The endpoint is what makes it a database rather than a
+     * snapshot.
+     */
+    async function createBranch(projectId, name, parentId) {
+        const { branch } = await request(`${API}/projects/${projectId}/branches`, {
+            ...o, method: "POST",
+            body: {
+                branch: { name, ...(parentId ? { parent_id: parentId } : {}) },
+                endpoints: [{ type: "read_write" }],
+            },
+        });
+        return { id: branch.id, name: branch.name, parent_id: branch.parent_id, default: branch.default };
+    }
+    /**
+     * Refresh one branch from its parent — copy-on-write, no dump, no transfer.
+     *
+     * Two guards live here rather than in a skill, so they hold whatever a future
+     * caller believes: the default branch (production) can never be the target,
+     * and the branch must have a parent to be reset from. `confirmed` is required
+     * because this discards everything in the target.
+     */
+    /**
+     * Delete a branch and everything in it.
+     *
+     * Neon refuses to delete a default branch, which is the protection that
+     * matters — production cannot be removed by naming it.
+     */
+    async function deleteBranch(projectId, branchId, opts) {
+        if (!opts?.confirmed)
+            throw new Error(`Refusing to delete ${branchId} without confirmation`);
+        await request(`${API}/projects/${projectId}/branches/${branchId}`, { ...o, method: "DELETE" });
+    }
+    /**
+     * The connection string for a branch.
+     *
+     * A credential, so it is never rendered — the only caller is the one that
+     * writes it into the vault, and the CLI has no action that would print it.
+     */
+    async function connectionUri(projectId, branchId, opts = {}) {
+        const query = new URLSearchParams({
+            branch_id: branchId,
+            database_name: opts.database ?? "neondb",
+            role_name: opts.role ?? "neondb_owner",
+        });
+        const body = await request(`${API}/projects/${projectId}/connection_uri?${query}`, o);
+        if (!body.uri)
+            throw new Error(`Neon returned no connection string for ${branchId}`);
+        return body.uri;
+    }
+    async function resetFromParent(projectId, branchId, opts) {
+        if (!opts?.confirmed)
+            throw new Error(`Refusing to reset ${branchId} without confirmation`);
+        const all = await branches(projectId);
+        const target = all.find((b) => b.id === branchId || b.name === branchId);
+        if (!target)
+            throw new Error(`No branch "${branchId}" in project ${projectId}`);
+        if (target.default)
+            throw new Error(`Refusing to reset "${target.name}" — it is the default branch`);
+        if (!target.parent_id)
+            throw new Error(`Branch "${target.name}" has no parent to reset from`);
+        await request(`${API}/projects/${projectId}/branches/${target.id}/reset_to_parent`, { ...o, method: "POST" });
+    }
+    return {
+        organizations,
+        projects,
+        findProject,
+        createProject,
+        branches,
+        createBranch,
+        resetFromParent,
+        deleteBranch,
+        connectionUri,
+        async status() {
+            return probe("neon", async () => {
+                const [orgs, p] = await Promise.all([organizations(), projects()]);
+                return `${p.length} project${p.length === 1 ? "" : "s"} across ${orgs.map((x) => x.name).join(", ")}`;
+            });
+        },
+        async access() {
+            return probeAccess("neon", async () => {
+                const orgs = await organizations();
+                const p = await projects();
+                // A personal key can read /users/me; an organisation key cannot.
+                let scope = "organisation key";
+                try {
+                    const me = await request(`${API}/users/me`, o);
+                    scope = `personal key, acting as ${me.email}`;
+                }
+                catch { /* organisation-scoped, which is narrower */ }
+                return {
+                    evidence: "identity",
+                    can: [
+                        `act across ${orgs.map((x) => `${x.name} (${x.plan})`).join(", ")}`,
+                        `see ${p.length} projects`,
+                        "create and delete projects, branches and endpoints",
+                    ],
+                    notes: [
+                        scope,
+                        "app data is read through a connection string, not this key",
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=neon.js.map

package/dist/admin/services/neon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"neon.js","sourceRoot":"","sources":["../../../src/admin/services/neon.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAErG,MAAM,GAAG,GAAG,kCAAkC,CAAC;AAK/C,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAEjC,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE,CAC/B,CAAC,MAAM,OAAO,CAAkE,GAAG,GAAG,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAErI,KAAK,UAAU,QAAQ;QACrB,MAAM,GAAG,GAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,aAAa,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,MAAM,OAAO,CAA8B,GAAG,GAAG,oBAAoB,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,EAAE,IAAY,EAAoC,EAAE,CAC3E,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAElD;;;;;;;;;;OAUG;IACH,KAAK,UAAU,aAAa,CAC1B,IAAY,EAAE,OAA4C,EAAE;QAE5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,eAAe,CAAC;QACxE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,MAAM,OAAO,CAA2B,GAAG,GAAG,WAAW,EAAE;YAChF,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM;YACpB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;SAC5D,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,SAAiB,EAAE,EAAE,CAC3C,CAAC,MAAM,OAAO,CAA6B,GAAG,GAAG,aAAa,SAAS,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;IAEzG;;;;;;;OAOG;IACH,KAAK,UAAU,YAAY,CACzB,SAAiB,EAAE,IAAY,EAAE,QAAiB;QAElD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAC9B,GAAG,GAAG,aAAa,SAAS,WAAW,EAAE;YACvC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM;YACpB,IAAI,EAAE;gBACJ,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAC9D,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;aACpC;SACF,CAAC,CAAC;QACL,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACpG,CAAC;IAED;;;;;;;OAOG;IACH;;;;;OAKG;IACH,KAAK,UAAU,YAAY,CACzB,SAAiB,EAAE,QAAgB,EAAE,IAAyB;QAE9D,IAAI,CAAC,IAAI,EAAE,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,uBAAuB,CAAC,CAAC;QAC7F,MAAM,OAAO,CAAC,GAAG,GAAG,aAAa,SAAS,aAAa,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,aAAa,CAC1B,SAAiB,EAAE,QAAgB,EACnC,OAA6C,EAAE;QAE/C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;YAChC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;YACxC,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,cAAc;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,GAAG,GAAG,aAAa,SAAS,mBAAmB,KAAK,EAAE,EAAE,CAAC,CAC1D,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EAAE,QAAgB,EAAE,IAAyB;QAE9D,IAAI,CAAC,IAAI,EAAE,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,uBAAuB,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,gBAAgB,SAAS,EAAE,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,IAAI,8BAA8B,CAAC,CAAC;QACrG,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,IAAI,+BAA+B,CAAC,CAAC;QAC9F,MAAM,OAAO,CAAC,GAAG,GAAG,aAAa,SAAS,aAAa,MAAM,CAAC,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,OAAO;QACL,aAAa;QACb,QAAQ;QACR,WAAW;QACX,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,eAAe;QACf,YAAY;QACZ,aAAa;QAEb,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;gBAC9B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxG,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,IAAI,GAAG,MAAM,aAAa,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;gBAC3B,iEAAiE;gBACjE,IAAI,KAAK,GAAG,kBAAkB,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAoB,GAAG,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC;oBAClE,KAAK,GAAG,2BAA2B,EAAE,CAAC,KAAK,EAAE,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC,CAAC,4CAA4C,CAAC,CAAC;gBACxD,OAAO;oBACL,QAAQ,EAAE,UAAmB;oBAC7B,GAAG,EAAE;wBACH,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBACnE,OAAO,CAAC,CAAC,MAAM,WAAW;wBAC1B,oDAAoD;qBACrD;oBACD,KAAK,EAAE;wBACL,KAAK;wBACL,4DAA4D;qBAC7D;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/resend.d.ts

@@ -0,0 +1,38 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface Domain {
+    id: string;
+    name: string;
+    status: string;
+    region?: string;
+}
+/** A record the domain's DNS has to carry before Resend will send from it. */
+export interface DomainRecord {
+    record: string;
+    name: string;
+    type: string;
+    value: string;
+    ttl?: string;
+    priority?: number;
+}
+export declare function resend(token: string): {
+    domains: () => Promise<Domain[]>;
+    apiKeys: () => Promise<{
+        id: string;
+        name: string;
+    }[]>;
+    createDomain: (name: string) => Promise<Domain & {
+        records: DomainRecord[];
+    }>;
+    verifyDomain: (id: string) => Promise<{
+        id: string;
+        object?: string;
+    }>;
+    createSendingKey: (name: string, domainId: string) => Promise<{
+        id: string;
+        token: string;
+    }>;
+    verifiedDomains: () => Promise<Domain[]>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=resend.d.ts.map

package/dist/admin/services/resend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend.d.ts","sourceRoot":"","sources":["../../../src/admin/services/resend.ts"],"names":[],"mappings":"AAIA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAErG,MAAM,WAAW,MAAM;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAErF,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM;;;YAKuB,MAAM;cAAQ,MAAM;;yBAS3C,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG;QAAE,OAAO,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;uBAwBxD,MAAM,KAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;6BATzE,MAAM,YAAY,MAAM,KAC7B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;;cAsBvB,OAAO,CAAC,aAAa,CAAC;cAStB,OAAO,CAAC,aAAa,CAAC;EAsBzC"}

package/dist/admin/services/resend.js

@@ -0,0 +1,81 @@
+/**
+ * Resend — transactional email.
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+export function resend(token) {
+    const creds = { token };
+    const BASE = "https://api.resend.com";
+    const domains = async () => (await request(`${BASE}/domains`, { credentials: creds })).data;
+    const apiKeys = async () => (await request(`${BASE}/api-keys`, { credentials: creds })).data;
+    /**
+     * Add a sending domain, and return the DNS it now needs.
+     *
+     * Resend answers with the records rather than a bare id, because a domain it
+     * cannot verify is not a sending domain yet — the useful result of creating
+     * one is the work it leaves behind.
+     */
+    async function createDomain(name) {
+        return await request(`${BASE}/domains`, {
+            credentials: creds, method: "POST", body: { name },
+        });
+    }
+    /**
+     * A key that can only send, and only from one domain.
+     *
+     * The factory's own key can read every key on the account and add domains.
+     * An app needs neither, and giving it one would put a credential that can
+     * reach every other app inside a workload — so a scoped key is what an app
+     * gets, and this is where the scoping is stated rather than remembered.
+     */
+    async function createSendingKey(name, domainId) {
+        return await request(`${BASE}/api-keys`, {
+            credentials: creds, method: "POST",
+            body: { name, permission: "sending_access", domain_id: domainId },
+        });
+    }
+    /** Ask Resend to check the DNS. Verification is its answer, not ours. */
+    async function verifyDomain(id) {
+        return await request(`${BASE}/domains/${id}/verify`, {
+            credentials: creds, method: "POST", body: {},
+        });
+    }
+    return {
+        domains,
+        apiKeys,
+        createDomain,
+        verifyDomain,
+        createSendingKey,
+        verifiedDomains: async () => (await domains()).filter((d) => d.status === "verified"),
+        async status() {
+            return probe("resend", async () => {
+                const d = await domains();
+                const unverified = d.filter((x) => x.status !== "verified").length;
+                return `${d.filter((x) => x.status === "verified").length} verified domains` +
+                    (unverified ? ` ⚠️ ${unverified} unverified` : "");
+            });
+        },
+        async access() {
+            return probeAccess("resend", async () => {
+                const d = await domains();
+                // Listing API keys requires full access — a sending-only key cannot.
+                // So reaching this line is itself the proof.
+                const keys = await apiKeys();
+                return {
+                    evidence: "identity",
+                    can: [
+                        "list and manage API keys for the whole account",
+                        `send from ${d.filter((x) => x.status === "verified").length} verified domains`,
+                        "read and add sending domains",
+                    ],
+                    notes: [
+                        "listing API keys requires full access — a sending-only key cannot, so this one is full access",
+                        `${keys.length} keys on the account: ${keys.map((k) => k.name).join(", ")}`,
+                        "per-app keys are named per app, which is a convention and not an isolation boundary",
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=resend.js.map

package/dist/admin/services/resend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend.js","sourceRoot":"","sources":["../../../src/admin/services/resend.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAcrG,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,wBAAwB,CAAC;IAEtC,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,CAAqB,GAAG,IAAI,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChH,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,CAA2C,GAAG,IAAI,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvI;;;;;;OAMG;IACH,KAAK,UAAU,YAAY,CAAC,IAAY;QACtC,OAAO,MAAM,OAAO,CAAuC,GAAG,IAAI,UAAU,EAAE;YAC5E,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,UAAU,gBAAgB,CAC7B,IAAY,EAAE,QAAgB;QAE9B,OAAO,MAAM,OAAO,CAAgC,GAAG,IAAI,WAAW,EAAE;YACtE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;YAClC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,UAAU,YAAY,CAAC,EAAU;QACpC,OAAO,MAAM,OAAO,CAAkC,GAAG,IAAI,YAAY,EAAE,SAAS,EAAE;YACpF,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO;QACP,OAAO;QACP,YAAY;QACZ,YAAY;QACZ,gBAAgB;QAChB,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;QAErF,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBAChC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC1B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;gBACnE,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,mBAAmB;oBAC1E,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACtC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC1B,qEAAqE;gBACrE,6CAA6C;gBAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC7B,OAAO;oBACL,QAAQ,EAAE,UAAmB;oBAC7B,GAAG,EAAE;wBACH,gDAAgD;wBAChD,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,mBAAmB;wBAC/E,8BAA8B;qBAC/B;oBACD,KAAK,EAAE;wBACL,+FAA+F;wBAC/F,GAAG,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBAC3E,qFAAqF;qBACtF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/togetherai.d.ts

@@ -0,0 +1,10 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export declare function togetherai(token: string): {
+    models: () => Promise<{
+        id: string;
+        type?: string;
+    }[]>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=togetherai.d.ts.map

package/dist/admin/services/togetherai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"togetherai.d.ts","sourceRoot":"","sources":["../../../src/admin/services/togetherai.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAErG,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM;kBAIb,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;cAM/C,OAAO,CAAC,aAAa,CAAC;cAOtB,OAAO,CAAC,aAAa,CAAC;EAWzC"}

package/dist/admin/services/togetherai.js

@@ -0,0 +1,36 @@
+/**
+ * Together AI — inference.
+ *
+ * One account-wide key. Together declares nothing about a key's rights, so the
+ * access report says `reachability` and nothing more.
+ */
+import { request } from "../../http/request.js";
+import { probe, probeAccess } from "../../services/types.js";
+export function togetherai(token) {
+    const creds = { token };
+    const BASE = "https://api.together.xyz/v1";
+    async function models() {
+        return request(`${BASE}/models`, { credentials: creds });
+    }
+    return {
+        models,
+        async status() {
+            return probe("togetherai", async () => {
+                const all = await models();
+                const chat = all.filter((m) => m.type === "chat").length;
+                return `${all.length} models, ${chat} chat`;
+            });
+        },
+        async access() {
+            return probeAccess("togetherai", async () => {
+                const all = await models();
+                return {
+                    evidence: "reachability",
+                    can: [`run inference against ${all.length} models`],
+                    notes: ["account-wide key; Together declares nothing about a key's rights"],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=togetherai.js.map

package/dist/admin/services/togetherai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"togetherai.js","sourceRoot":"","sources":["../../../src/admin/services/togetherai.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAErG,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,6BAA6B,CAAC;IAE3C,KAAK,UAAU,MAAM;QACnB,OAAO,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,MAAM;QACN,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBACpC,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;gBACzD,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,IAAI,OAAO,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;gBAC3B,OAAO;oBACL,QAAQ,EAAE,cAAc;oBACxB,GAAG,EAAE,CAAC,yBAAyB,GAAG,CAAC,MAAM,SAAS,CAAC;oBACnD,KAAK,EAAE,CAAC,kEAAkE,CAAC;iBAC5E,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/services/vercel.d.ts

@@ -0,0 +1,66 @@
+import { type ServiceAccess, type ServiceStatus } from "../../services/types.ts";
+export interface VercelProject {
+    id: string;
+    name: string;
+}
+export type Target = "production" | "preview" | "development";
+/**
+ * Where one variable applies.
+ *
+ * A custom environment is not a fourth target — Vercel addresses it by id, in
+ * a different field — so the two cannot be expressed as one list.
+ */
+export type Scope = {
+    target: Target;
+} | {
+    customEnvironmentId: string;
+};
+export interface CustomEnvironment {
+    id: string;
+    slug: string;
+}
+export interface EnvVar {
+    id?: string;
+    key: string;
+    target?: Target[];
+    customEnvironmentIds?: string[];
+}
+export declare function vercel(token: string): {
+    projects: () => Promise<VercelProject[]>;
+    findProject: (app: string) => Promise<VercelProject | undefined>;
+    teamId: () => Promise<string | undefined>;
+    createProject: (name: string, opts?: {
+        repo?: string;
+        framework?: string | null;
+    }) => Promise<VercelProject>;
+    projectDomains: (projectId: string, teamId?: string) => Promise<{
+        name: string;
+        verified: boolean;
+    }[]>;
+    addDomain: (projectId: string, domain: string, teamId?: string) => Promise<{
+        name: string;
+        verified: boolean;
+    }>;
+    deploy: (name: string, opts: {
+        repo: string;
+        ref: string;
+        target?: "production" | "staging";
+        teamId?: string;
+    }) => Promise<{
+        id: string;
+        url: string;
+        readyState: string;
+    }>;
+    promote: (projectId: string, deploymentId: string, teamId?: string) => Promise<unknown>;
+    envVars: (projectId: string, teamId?: string) => Promise<EnvVar[]>;
+    customEnvironments: (projectId: string, teamId?: string) => Promise<CustomEnvironment[]>;
+    ensureCustomEnvironment: (projectId: string, slug: string, teamId?: string) => Promise<CustomEnvironment>;
+    setEnv: (projectId: string, key: string, value: string, scope: Scope, opts?: {
+        teamId?: string;
+        sensitive?: boolean;
+    }) => Promise<void>;
+    deployments: (projectId?: string, limit?: number) => Promise<unknown[]>;
+    status(): Promise<ServiceStatus>;
+    access(): Promise<ServiceAccess>;
+};
+//# sourceMappingURL=vercel.d.ts.map

package/dist/admin/services/vercel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../../../src/admin/services/vercel.ts"],"names":[],"mappings":"AASA,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAIrG,MAAM,WAAW,aAAa;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3D,MAAM,MAAM,MAAM,GAAG,YAAY,GAAG,SAAS,GAAG,aAAa,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,MAAM,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAE/D,MAAM,WAAW,MAAM;IACrB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM;;uBAeF,MAAM,KAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;kBAYlD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;0BA8B5C,MAAM,SACN;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KACjD,OAAO,CAAC,aAAa,CAAC;gCAsEgB,MAAM,WAAW,MAAM;cAC5B,MAAM;kBAAY,OAAO;;2BAKzB,MAAM,UAAU,MAAM,WAAW,MAAM;cALvC,MAAM;kBAAY,OAAO;;mBAsBrD,MAAM,QACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;YAG5D,MAAM;aAAO,MAAM;oBAAc,MAAM;;yBAclC,MAAM,gBAAgB,MAAM,WAAW,MAAM;yBAjF7C,MAAM,WAAW,MAAM;oCAuFZ,MAAM,WAAW,MAAM;yCAYvD,MAAM,QAAQ,MAAM,WAAW,MAAM,KAC/C,OAAO,CAAC,iBAAiB,CAAC;wBAtFhB,MAAM,OAAO,MAAM,SAAS,MAAM,SAAS,KAAK,SACrD;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAC7C,OAAO,CAAC,IAAI,CAAC;8BA0GkB,MAAM;cAItB,OAAO,CAAC,aAAa,CAAC;cAOtB,OAAO,CAAC,aAAa,CAAC;EA0BzC"}