@loompad/cli 0.1.0 → 1.1.1

package/dist/hub/supabase-client.js

@@ -0,0 +1,843 @@
+/**
+ * SupabaseHubClient — a daemon's connection to the hosted Loom Team Hub.
+ *
+ * Same `HubClient` contract as MemoryHub (the reference) and HttpHubClient
+ * (a self-hosted `loom hub`), against the Supabase schema in
+ * supabase/migrations/0002–0007: reads are RLS-guarded selects, writes are the
+ * SECURITY DEFINER rule functions called through `rpc`, and live events are
+ * Realtime `postgres_changes` (RLS decides who hears what).
+ *
+ * Sessions: the client holds a Supabase session (access + refresh token) and
+ * supabase-js refreshes it on its own. Refresh tokens rotate — the one that
+ * was just used is dead — so whoever persists the session (Team Link, in
+ * team.json) must listen with `onSession` and store every new one.
+ *
+ * Sign-in (D65) is GitHub OAuth through Supabase, PKCE with a loopback
+ * redirect: `hostedSignIn`.
+ */
+import { spawn } from "../core/process.js";
+import http from "node:http";
+import { HubError, LEASE_TTL_MS, normalizeRepo, } from "../core/team-hub.js";
+function toHostedSession(s) {
+    return {
+        accessToken: s.access_token,
+        refreshToken: s.refresh_token,
+        expiresAt: (s.expires_at ?? Math.floor(Date.now() / 1000) + (s.expires_in ?? 3600)) * 1000,
+        userId: s.user.id,
+    };
+}
+/** supabase-js wants somewhere to keep its session (and the PKCE verifier); memory is right for a daemon. */
+function memoryStorage() {
+    const m = new Map();
+    return {
+        getItem: (k) => m.get(k) ?? null,
+        setItem: (k, v) => void m.set(k, v),
+        removeItem: (k) => void m.delete(k),
+    };
+}
+async function newSupabase(supabaseUrl, publishableKey) {
+    const { createClient } = await import("@supabase/supabase-js");
+    return createClient(supabaseUrl, publishableKey, {
+        auth: {
+            persistSession: true,
+            storage: memoryStorage(),
+            storageKey: "loom-team-hub",
+            autoRefreshToken: true,
+            detectSessionInUrl: false,
+            flowType: "pkce",
+        },
+        realtime: { params: { eventsPerSecond: 20 } },
+    });
+}
+/** A Postgres / PostgREST error as the HubError MemoryHub would have thrown. */
+export function hubErrorFrom(err, httpStatus) {
+    const code = err?.code ?? "";
+    const message = err?.message || `hosted hub request failed${httpStatus ? ` (${httpStatus})` : ""}`;
+    let status = 400;
+    if (code === "42501")
+        status = 403;
+    else if (code === "P0002")
+        status = 404;
+    else if (code === "40001")
+        status = 409;
+    else if (/^PT[45]\d\d$/.test(code))
+        status = Number(code.slice(2)); // PostgREST's "PTxyz" = HTTP xyz
+    else if (code === "PGRST301" || code === "PGRST302" || code === "PGRST303" || httpStatus === 401)
+        status = 401;
+    return new HubError(message, status);
+}
+/** Postgres timestamps (PostgREST's ISO, or the text form Realtime sends) → epoch ms. */
+export function ms(v) {
+    if (typeof v === "number")
+        return v;
+    if (typeof v !== "string" || !v)
+        return 0;
+    const iso = v
+        .replace(" ", "T")
+        .replace(/(\.\d{3})\d+/, "$1")
+        .replace(/([+-]\d\d)$/, "$1:00");
+    const t = Date.parse(iso);
+    return Number.isFinite(t) ? t : 0;
+}
+const str = (v) => (v == null ? "" : String(v));
+const arr = (v) => (Array.isArray(v) ? v.map(String) : []);
+/** Only the optional fields that are set, the way MemoryHub spreads its input. */
+function opt(o) {
+    const out = {};
+    for (const [k, v] of Object.entries(o))
+        if (v !== null && v !== undefined)
+            out[k] = v;
+    return out;
+}
+export function mapTeam(r) {
+    return { id: str(r.id), name: str(r.name), createdAt: ms(r.created_at), keyVersion: Number(r.key_version ?? 1) };
+}
+export function mapDevice(r) {
+    return {
+        id: str(r.id),
+        userId: str(r.user_id),
+        label: str(r.label),
+        sealPub: str(r.seal_pub),
+        signPub: str(r.sign_pub),
+        createdAt: ms(r.created_at),
+    };
+}
+export function mapPresence(r, github) {
+    return {
+        deviceId: str(r.device_id),
+        repo: str(r.repo),
+        ...opt({ runId: r.run_id, taskId: r.task_id }),
+        agent: str(r.agent),
+        kind: str(r.kind),
+        ...opt({ branch: r.branch }),
+        touches: arr(r.touches),
+        state: str(r.state),
+        since: ms(r.since),
+        ...opt({ sealed: r.sealed, sig: r.sig }),
+        teamId: str(r.team_id),
+        userId: str(r.user_id),
+        github,
+        ts: ms(r.ts),
+    };
+}
+export function mapLease(r, github, now = Date.now()) {
+    const ts = ms(r.ts);
+    return {
+        globs: arr(r.globs),
+        files: arr(r.files),
+        prefixes: arr(r.prefixes),
+        id: str(r.id),
+        teamId: str(r.team_id),
+        userId: str(r.user_id),
+        github,
+        deviceId: str(r.device_id),
+        repo: str(r.repo),
+        runId: str(r.run_id),
+        taskId: str(r.task_id),
+        state: (str(r.state) || "active"),
+        ...opt({ sealed: r.sealed }),
+        since: ms(r.since),
+        ts,
+        stale: now - ts > LEASE_TTL_MS,
+    };
+}
+export function mapMemory(r) {
+    return {
+        id: str(r.id),
+        teamId: str(r.team_id),
+        repo: str(r.repo),
+        authorId: str(r.author_id),
+        author: str(r.author),
+        hmac: str(r.hmac),
+        sealed: r.sealed,
+        state: str(r.state),
+        ...opt({
+            supersedes: r.supersedes,
+            supersededBy: r.superseded_by,
+            resolvedBy: r.resolved_by,
+            resolvedReason: r.resolved_reason,
+        }),
+        confirmedBy: arr(r.confirmed_by),
+        createdAt: ms(r.created_at),
+        updatedAt: ms(r.updated_at),
+    };
+}
+export function mapFeed(r, github) {
+    return {
+        ...opt({ repo: r.repo }),
+        type: str(r.type),
+        meta: r.meta ?? {},
+        ...opt({
+            sealed: r.sealed,
+            deviceId: r.device_id,
+            sig: r.sig,
+            dedupeKey: r.dedupe_key,
+        }),
+        id: Number(r.id),
+        teamId: str(r.team_id),
+        userId: r.user_id ?? null,
+        github,
+        ts: ms(r.ts),
+    };
+}
+/** A `jobs` row (PostgREST or Realtime) → the Job MemoryHub returns. */
+export function mapJob(r) {
+    return {
+        id: str(r.id),
+        teamId: str(r.team_id),
+        repo: str(r.repo),
+        kind: str(r.kind),
+        userId: str(r.user_id),
+        github: str(r.github),
+        ...opt({ target: r.target }),
+        state: str(r.state),
+        ...opt({
+            runnerId: r.runner_id,
+            runnerGithub: r.runner_github,
+            claimedAt: r.claimed_at == null ? undefined : ms(r.claimed_at),
+            heartbeatAt: r.heartbeat_at == null ? undefined : ms(r.heartbeat_at),
+        }),
+        sealed: r.sealed,
+        ...opt({
+            progress: r.progress,
+            result: r.result,
+            error: r.error,
+        }),
+        createdAt: ms(r.created_at),
+        updatedAt: ms(r.updated_at),
+    };
+}
+/** team_runners / register_runner JSON (already camelCase) → Runner. */
+export function mapRunner(r) {
+    return {
+        deviceId: str(r.deviceId),
+        userId: str(r.userId),
+        github: str(r.github),
+        label: str(r.label),
+        kinds: arr(r.kinds),
+        shared: Boolean(r.shared),
+        capacity: Number(r.capacity ?? 1),
+        lastSeen: ms(r.lastSeen),
+    };
+}
+export class SupabaseHubClient {
+    opts;
+    sbP = null;
+    current;
+    listeners = new Set();
+    githubs = new Map(); // user id → GitHub login
+    closed = false;
+    constructor(opts) {
+        this.opts = opts;
+        if (!opts.session && !opts.refreshToken)
+            throw new HubError("the hosted hub needs a session — sign in again", 401);
+        this.current = opts.session ?? null;
+        if (opts.onSession)
+            this.listeners.add(opts.onSession);
+    }
+    /** Hear every new session (refreshes rotate the refresh token). Returns an unsubscribe. */
+    onSession(cb) {
+        this.listeners.add(cb);
+        return () => this.listeners.delete(cb);
+    }
+    /** The session in effect right now (null until the first call has restored it). */
+    session() {
+        return this.current;
+    }
+    get supabaseUrl() {
+        return this.opts.supabaseUrl;
+    }
+    /** Stop refreshing and drop every live subscription. */
+    async close() {
+        this.closed = true;
+        const p = this.sbP;
+        this.sbP = null;
+        if (!p)
+            return;
+        const sb = await p.catch(() => null);
+        if (!sb)
+            return;
+        await sb.auth.stopAutoRefresh().catch(() => { });
+        await sb.removeAllChannels().catch(() => { });
+        sb.realtime.disconnect();
+    }
+    emitSession(s) {
+        const hs = toHostedSession(s);
+        const changed = !this.current || this.current.refreshToken !== hs.refreshToken || this.current.accessToken !== hs.accessToken;
+        this.current = hs;
+        if (!changed)
+            return;
+        for (const l of this.listeners) {
+            try {
+                l(hs);
+            }
+            catch {
+                /* a listener's failure never breaks the session */
+            }
+        }
+    }
+    /** The supabase-js client, with the session restored (once). */
+    sb() {
+        if (this.closed)
+            return Promise.reject(new HubError("this hub connection is closed", 400));
+        if (!this.sbP) {
+            this.sbP = (async () => {
+                const sb = await newSupabase(this.opts.supabaseUrl, this.opts.publishableKey);
+                sb.auth.onAuthStateChange((event, session) => {
+                    // Synchronous on purpose: awaiting auth calls in here deadlocks supabase-js.
+                    if (session && (event === "SIGNED_IN" || event === "TOKEN_REFRESHED" || event === "USER_UPDATED")) {
+                        this.emitSession(session);
+                        void sb.realtime.setAuth(session.access_token);
+                    }
+                });
+                const s = this.current;
+                const { data, error } = s
+                    ? await sb.auth.setSession({ access_token: s.accessToken, refresh_token: s.refreshToken })
+                    : await sb.auth.refreshSession({ refresh_token: this.opts.refreshToken });
+                if (error || !data.session) {
+                    const status = error?.status;
+                    // 4xx: the refresh token is spent or revoked — only a new sign-in helps
+                    if (status && status < 500)
+                        throw new HubError(`the hosted hub session expired — sign in again (${error.message})`, 401);
+                    throw new HubError(error?.message ?? "couldn't restore the hosted hub session", 503);
+                }
+                this.emitSession(data.session);
+                await sb.realtime.setAuth(data.session.access_token);
+                return sb;
+            })();
+            // a failed restore can be retried (network); a spent token will just fail again with 401
+            this.sbP.catch(() => {
+                this.sbP = null;
+            });
+        }
+        return this.sbP;
+    }
+    uid() {
+        if (!this.current)
+            throw new HubError("not signed in to the hosted hub", 401);
+        return this.current.userId;
+    }
+    async rpc(fn, args) {
+        const sb = await this.sb();
+        const res = await sb.rpc(fn, args);
+        if (res.error)
+            throw hubErrorFrom(res.error, res.status);
+        return res.data;
+    }
+    async select(build) {
+        const sb = await this.sb();
+        const res = await build(sb);
+        if (res.error)
+            throw hubErrorFrom(res.error, res.status);
+        return res.data ?? [];
+    }
+    /** GitHub logins for user ids, cached (profiles are readable for self and teammates). */
+    async logins(ids) {
+        const missing = [...new Set(ids.filter((x) => Boolean(x) && !this.githubs.has(x)))];
+        if (missing.length) {
+            const rows = await this.select((sb) => sb.from("profiles").select("user_id, github").in("user_id", missing));
+            for (const r of rows)
+                this.githubs.set(str(r.user_id), str(r.github));
+        }
+        return this.githubs;
+    }
+    async login(id) {
+        if (!id)
+            return "";
+        return (await this.logins([id])).get(id) ?? "";
+    }
+    async leasesOf(rows) {
+        const g = await this.logins(rows.map((r) => r.user_id));
+        const now = Date.now();
+        return rows.map((r) => mapLease(r, g.get(str(r.user_id)) ?? "", now));
+    }
+    async claimResult(raw) {
+        const rows = [raw.lease, ...(raw.overlaps ?? []).map((o) => o.lease), raw.blockedBy?.lease].filter((x) => Boolean(x));
+        const g = await this.logins(rows.map((r) => r.user_id));
+        const now = Date.now();
+        const lease = (r) => mapLease(r, g.get(str(r.user_id)) ?? "", now);
+        return {
+            lease: raw.lease ? lease(raw.lease) : null,
+            overlaps: (raw.overlaps ?? []).map((o) => ({ lease: lease(o.lease), paths: arr(o.paths) })),
+            ...(raw.blockedBy ? { blockedBy: { lease: lease(raw.blockedBy.lease), zone: raw.blockedBy.zone } } : {}),
+        };
+    }
+    // ── Phase 1 ──
+    async me() {
+        await this.sb();
+        const rows = await this.select((sb) => sb.from("profiles").select("user_id, github, name").eq("user_id", this.uid()));
+        const r = rows[0];
+        if (!r)
+            throw new HubError("no such user", 404);
+        this.githubs.set(str(r.user_id), str(r.github));
+        return { id: str(r.user_id), github: str(r.github), name: str(r.name) || str(r.github) };
+    }
+    async createTeam(name) {
+        const clean = name.trim().slice(0, 80);
+        if (!clean)
+            throw new HubError("a team needs a name");
+        return mapTeam(await this.rpc("create_team", { p_name: clean }));
+    }
+    async teams() {
+        await this.sb();
+        const rows = await this.select((sb) => sb.from("team_members").select("role, teams(*)").eq("user_id", this.uid()));
+        return rows.filter((r) => r.teams).map((r) => ({ ...mapTeam(r.teams), role: str(r.role) }));
+    }
+    async registerDevice(input) {
+        if (!input.sealPub || !input.signPub)
+            throw new HubError("a device needs both public keys");
+        return mapDevice(await this.rpc("register_device", { p_label: input.label, p_seal_pub: input.sealPub, p_sign_pub: input.signPub }));
+    }
+    async createInvite(teamId, ttlMs) {
+        const args = { p_team: teamId };
+        if (typeof ttlMs === "number" && Number.isFinite(ttlMs))
+            args.p_ttl_seconds = Math.round(ttlMs / 1000);
+        const out = await this.rpc("create_invite", args);
+        return { invite: out.invite, expiresAt: Number(out.expiresAt) };
+    }
+    async redeemInvite(invite) {
+        const out = await this.rpc("redeem_invite", { p_invite: invite });
+        return { team: mapTeam(out.team), role: out.role };
+    }
+    async members(teamId) {
+        const list = await this.rpc("team_member_list", { p_team: teamId });
+        for (const m of list)
+            this.githubs.set(m.user.id, m.user.github);
+        return list.map((m) => ({ ...m, user: { ...m.user, name: m.user.name || m.user.github } }));
+    }
+    async removeMember(teamId, userId) {
+        await this.rpc("remove_member", { p_team: teamId, p_user: userId });
+    }
+    async putKeyEnvelopes(teamId, version, envelopes) {
+        await this.rpc("put_key_envelopes", { p_team: teamId, p_version: version, p_envelopes: envelopes });
+    }
+    async keyEnvelopes(teamId, deviceId) {
+        const rows = await this.select((sb) => sb.from("key_envelopes").select("version, box").eq("team_id", teamId).eq("device_id", deviceId).order("version"));
+        return rows.map((r) => ({ version: Number(r.version), box: str(r.box) }));
+    }
+    async shareRepo(teamId, repo) {
+        await this.rpc("share_repo", { p_team: teamId, p_repo: normalizeRepo(repo) });
+    }
+    async repos(teamId) {
+        const rows = await this.select((sb) => sb.from("team_repos").select("repo").eq("team_id", teamId).order("repo"));
+        return rows.map((r) => str(r.repo));
+    }
+    async heartbeat(teamId, p) {
+        await this.rpc("heartbeat", { p_team: teamId, p });
+    }
+    async clearPresence(teamId, key) {
+        await this.rpc("clear_presence", { p_team: teamId, p_device: key.deviceId, p_repo: key.repo, p_agent: key.agent });
+    }
+    async presence(teamId) {
+        const rows = await this.select((sb) => sb.from("presence").select("*").eq("team_id", teamId));
+        const g = await this.logins(rows.map((r) => r.user_id));
+        return rows.map((r) => mapPresence(r, g.get(str(r.user_id)) ?? ""));
+    }
+    async appendFeed(teamId, e) {
+        const row = await this.rpc("append_feed", { p_team: teamId, e });
+        if (!row || row.id == null)
+            return null; // deduped
+        return mapFeed(row, await this.login(row.user_id));
+    }
+    async feed(teamId, opts = {}) {
+        const limit = Math.min(Math.max(opts.limit ?? 200, 1), 1000);
+        const rows = await this.select((sb) => sb
+            .from("feed")
+            .select("*")
+            .eq("team_id", teamId)
+            .gt("id", opts.since ?? 0)
+            .order("id", { ascending: false })
+            .limit(limit));
+        const g = await this.logins(rows.map((r) => r.user_id));
+        return rows.reverse().map((r) => mapFeed(r, r.user_id ? (g.get(str(r.user_id)) ?? null) : null));
+    }
+    // ── Phase 2: leases ──
+    async claimLease(teamId, c) {
+        return this.claimResult(await this.rpc("claim_lease", { p_team: teamId, c }));
+    }
+    async extendLease(teamId, leaseId, scope, hardZones) {
+        const s = { globs: scope.globs, files: scope.files, prefixes: scope.prefixes };
+        return this.claimResult(await this.rpc("extend_lease", { p_team: teamId, p_lease: leaseId, scope: s, hard_zones: hardZones }));
+    }
+    async renewLeases(teamId, deviceId) {
+        return Number(await this.rpc("renew_leases", { p_team: teamId, p_device: deviceId }));
+    }
+    async setRunLeaseState(teamId, runId, state) {
+        return Number(await this.rpc("set_run_lease_state", { p_team: teamId, p_run: runId, p_state: state }));
+    }
+    async releaseLeases(teamId, runId, reason) {
+        return Number(await this.rpc("release_leases", { p_team: teamId, p_run: runId, p_reason: reason }));
+    }
+    async leases(teamId, repo) {
+        const r = repo ? normalizeRepo(repo) : null;
+        const rows = await this.select((sb) => {
+            const q = sb.from("leases").select("*").eq("team_id", teamId);
+            return r ? q.eq("repo", r) : q;
+        });
+        return this.leasesOf(rows);
+    }
+    // ── Phase 3: the team brain ──
+    async publishMemory(teamId, m) {
+        const out = await this.rpc("publish_memory", { p_team: teamId, m });
+        return { memory: mapMemory(out.memory), merged: Boolean(out.merged) };
+    }
+    async updateTeamMemory(teamId, id, patch) {
+        return mapMemory(await this.rpc("update_team_memory", { p_team: teamId, p_id: id, p_hmac: patch.hmac, p_sealed: patch.sealed }));
+    }
+    async forgetTeamMemory(teamId, id, reason) {
+        await this.rpc("forget_team_memory", { p_team: teamId, p_id: id, p_reason: reason });
+    }
+    async resolveMemories(teamId, winnerId, loserId, reason) {
+        return mapMemory(await this.rpc("resolve_memories", { p_team: teamId, p_winner: winnerId, p_loser: loserId, p_reason: reason }));
+    }
+    async teamMemories(teamId, repo, opts = {}) {
+        const r = normalizeRepo(repo);
+        const rows = await this.select((sb) => {
+            const q = sb.from("team_memories").select("*").eq("team_id", teamId).eq("repo", r).order("created_at");
+            return opts.history ? q : q.eq("state", "live");
+        });
+        return rows.map(mapMemory);
+    }
+    // ── Phase 5: runners and jobs ──
+    async registerRunner(input) {
+        return mapRunner(await this.rpc("register_runner", {
+            p_device: input.deviceId,
+            p_kinds: input.kinds.map(String),
+            p_shared: Boolean(input.shared),
+            p_capacity: Math.floor(input.capacity ?? 1),
+        }));
+    }
+    async runners(teamId) {
+        return ((await this.rpc("team_runners", { p_team: teamId })) ?? []).map(mapRunner);
+    }
+    async revokeDevice(deviceId) {
+        await this.rpc("revoke_device", { p_device: deviceId });
+    }
+    async createJob(teamId, j) {
+        return mapJob(await this.rpc("create_job", { p_team: teamId, j }));
+    }
+    async claimJob(teamId, runnerDeviceId, instantOnly = false) {
+        const row = await this.rpc("claim_job", { p_team: teamId, p_runner: runnerDeviceId, ...(instantOnly ? { p_instant_only: true } : {}) });
+        // a composite-returning function answers "none" as a row of nulls
+        return !row || row.id == null ? null : mapJob(row);
+    }
+    async heartbeatJob(teamId, jobId, runnerDeviceId, progress) {
+        return mapJob(await this.rpc("heartbeat_job", { p_team: teamId, p_job: jobId, p_runner: runnerDeviceId, ...(progress ? { p_progress: progress } : {}) }));
+    }
+    async finishJob(teamId, jobId, runnerDeviceId, outcome) {
+        return mapJob(await this.rpc("finish_job", {
+            p_team: teamId,
+            p_job: jobId,
+            p_runner: runnerDeviceId,
+            p_state: outcome.state,
+            ...(outcome.result ? { p_result: outcome.result } : {}),
+            ...(outcome.error ? { p_error: outcome.error } : {}),
+        }));
+    }
+    async cancelJob(teamId, jobId) {
+        return mapJob(await this.rpc("cancel_job", { p_team: teamId, p_job: jobId }));
+    }
+    async jobs(teamId, opts = {}) {
+        const rows = await this.select((sb) => {
+            const q = sb.from("jobs").select("*").eq("team_id", teamId).order("created_at").order("id");
+            return opts.active ? q.in("state", ["queued", "claimed"]) : q;
+        });
+        return rows.map(mapJob);
+    }
+    /** Owners only (0009_phase6.sql); the Edge Function verifies deliveries with it (D83). */
+    async webhookSecret(teamId, rotate = false) {
+        return { secret: String(await this.rpc("webhook_secret", { p_team: teamId, p_rotate: rotate })) };
+    }
+    // ── live events ──
+    /**
+     * Realtime `postgres_changes` on feed, presence, leases, team_memories and jobs,
+     * as the HubEvents MemoryHub emits. Inserts and updates are filtered to the
+     * team and RLS-checked per member. Deletes can't be filtered and carry only
+     * the primary key, so: presence's key includes the team, and lease ids are
+     * matched against the leases this subscription has seen.
+     */
+    async subscribe(teamId, cb) {
+        const sb = await this.sb();
+        // MemoryHub refuses non-members; RLS would just stay silent.
+        const mine = await this.select((s) => s.from("team_members").select("role").eq("team_id", teamId).eq("user_id", this.uid()));
+        if (!mine.length)
+            throw new HubError("not a member of this team", 403);
+        const runOf = new Map(); // lease id → run id
+        for (const l of await this.leases(teamId).catch(() => []))
+            runOf.set(l.id, l.runId);
+        // one event at a time, in arrival order, even when a login lookup has to wait
+        let chain = Promise.resolve();
+        let closed = false;
+        const emit = (make) => {
+            chain = chain
+                .then(async () => {
+                const e = await make();
+                if (e && !closed)
+                    cb(e);
+            })
+                .catch(() => {
+                /* one bad event never breaks the stream */
+            });
+        };
+        const filter = `team_id=eq.${teamId}`;
+        const ch = sb.channel(`loom-team:${teamId}:${Math.random().toString(36).slice(2, 10)}`);
+        const on = (table, event, fn) => ch.on("postgres_changes", { event, schema: "public", table, ...(event === "DELETE" ? {} : { filter }) }, ((p) => fn(p)));
+        on("feed", "INSERT", (p) => emit(async () => ({ type: "feed", teamId, event: mapFeed(p.new, p.new.user_id ? await this.login(str(p.new.user_id)) : null) })));
+        const presence = (p) => emit(async () => ({ type: "presence", teamId, presence: mapPresence(p.new, await this.login(str(p.new.user_id))) }));
+        on("presence", "INSERT", presence);
+        on("presence", "UPDATE", presence);
+        on("presence", "DELETE", (p) => {
+            if (str(p.old.team_id) !== teamId)
+                return;
+            emit(async () => ({
+                type: "presence_gone",
+                teamId,
+                userId: str(p.old.user_id),
+                deviceId: str(p.old.device_id),
+                agent: str(p.old.agent),
+                repo: str(p.old.repo),
+            }));
+        });
+        const lease = (p) => {
+            runOf.set(str(p.new.id), str(p.new.run_id));
+            emit(async () => ({ type: "lease", teamId, lease: mapLease(p.new, await this.login(str(p.new.user_id))) }));
+        };
+        on("leases", "INSERT", lease);
+        on("leases", "UPDATE", lease);
+        on("leases", "DELETE", (p) => {
+            const id = str(p.old.id);
+            const runId = runOf.get(id);
+            if (runId === undefined)
+                return; // another team's lease
+            runOf.delete(id);
+            emit(async () => ({ type: "lease_gone", teamId, leaseIds: [id], runId }));
+        });
+        const memory = (p) => emit(async () => ({ type: "memory", teamId, memory: mapMemory(p.new) }));
+        on("team_memories", "INSERT", memory);
+        on("team_memories", "UPDATE", memory);
+        const job = (p) => emit(async () => ({ type: "job", teamId, job: mapJob(p.new) }));
+        on("jobs", "INSERT", job);
+        on("jobs", "UPDATE", job);
+        // Ready means both: the channel joined (SUBSCRIBED) *and* Realtime says the
+        // Postgres subscription is live — that system message comes later, and a
+        // change in between would be lost.
+        await new Promise((resolve, reject) => {
+            let settled = false;
+            let joined = false;
+            let pgReady = false;
+            const ready = () => {
+                if (settled || !joined || !pgReady)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve();
+            };
+            ch.on("system", {}, ((m) => {
+                if (m?.extension !== "postgres_changes" || settled)
+                    return;
+                if (m.status === "ok") {
+                    pgReady = true;
+                    ready();
+                }
+                else {
+                    settled = true;
+                    clearTimeout(timer);
+                    reject(new HubError(`hosted hub realtime: ${m.message ?? "postgres changes unavailable"}`, 503));
+                }
+            }));
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(new HubError("the hosted hub's realtime didn't answer", 503));
+            }, 20_000);
+            timer.unref?.();
+            ch.subscribe((status, err) => {
+                if (settled)
+                    return;
+                if (status === "SUBSCRIBED") {
+                    joined = true;
+                    ready();
+                }
+                else if (status === "CHANNEL_ERROR" || status === "TIMED_OUT" || status === "CLOSED") {
+                    settled = true;
+                    clearTimeout(timer);
+                    reject(new HubError(`hosted hub realtime: ${err?.message ?? status.toLowerCase()}`, 503));
+                }
+            });
+        }).catch(async (err) => {
+            await sb.removeChannel(ch).catch(() => { });
+            throw err;
+        });
+        // After the initial join, realtime-js rejoins on its own after a drop.
+        return () => {
+            closed = true;
+            void sb.removeChannel(ch).catch(() => { });
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// Sign-in: GitHub OAuth through Supabase, PKCE, loopback redirect (D65)
+// ---------------------------------------------------------------------------
+export const SIGN_IN_TIMEOUT_MS = 5 * 60_000;
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function page(title, body) {
+    return `<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title>
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<style>body{font:16px/1.5 system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0;background:#f7f7f5;color:#1a1a1a}
+@media (prefers-color-scheme:dark){body{background:#161616;color:#eee}}main{max-width:28rem;padding:2rem;text-align:center}
+h1{font-size:1.25rem;margin:0 0 .5rem}p{margin:0;opacity:.75}</style></head>
+<body><main><h1>${escapeHtml(title)}</h1><p>${escapeHtml(body)}</p></main></body></html>`;
+}
+/**
+ * The loopback half of an OAuth sign-in: listen on 127.0.0.1 (random port),
+ * hand the redirect URL to `start` (build the authorize URL, open a browser),
+ * wait for `/callback?code=…`, trade the code with `exchange`, and tell the
+ * browser tab it can close. Rejects on an OAuth error, or after `timeoutMs`.
+ */
+export async function loopbackSignIn(opts) {
+    const server = http.createServer();
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const port = server.address().port;
+    const redirectTo = `http://127.0.0.1:${port}/callback`;
+    let timer;
+    const done = new Promise((resolve, reject) => {
+        let finished = false;
+        const finish = (err, value) => {
+            if (finished)
+                return;
+            finished = true;
+            if (err)
+                reject(err);
+            else
+                resolve(value);
+        };
+        timer = setTimeout(() => finish(new HubError("sign-in timed out — nothing came back from the browser in 5 minutes", 408)), opts.timeoutMs ?? SIGN_IN_TIMEOUT_MS);
+        server.on("request", (req, res) => {
+            const url = new URL(req.url ?? "/", redirectTo);
+            const reply = (status, title, body) => {
+                res.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", connection: "close" });
+                res.end(page(title, body));
+            };
+            if (url.pathname !== "/callback")
+                return reply(404, "Not found", "This is Loom's sign-in listener.");
+            if (finished)
+                return reply(410, "Already done", "This sign-in has finished. You can close this tab.");
+            const oauthError = url.searchParams.get("error_description") || url.searchParams.get("error");
+            if (oauthError) {
+                reply(400, "Sign-in failed", `${oauthError}. You can close this tab and try again.`);
+                return finish(new HubError(`sign-in failed: ${oauthError}`, 401));
+            }
+            const code = url.searchParams.get("code");
+            if (!code)
+                return reply(400, "No sign-in code", "The redirect didn't carry a code. Try signing in again.");
+            opts.exchange(code).then((value) => {
+                reply(200, "Signed in to Loom", "You can close this tab and go back to your terminal.");
+                finish(null, value);
+            }, (err) => {
+                const msg = err instanceof Error ? err.message : String(err);
+                reply(400, "Sign-in failed", `${msg}. You can close this tab and try again.`);
+                finish(err instanceof HubError ? err : new HubError(`sign-in failed: ${msg}`, 401));
+            });
+        });
+    });
+    try {
+        await opts.start(redirectTo);
+        return await done;
+    }
+    finally {
+        clearTimeout(timer);
+        server.closeAllConnections?.();
+        server.close();
+    }
+}
+/** Open a URL in the user's browser. */
+export function openInBrowser(url) {
+    const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+    try {
+        const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        /* the caller also prints the URL */
+    }
+}
+/**
+ * Sign in to the hosted hub with GitHub: PKCE through Supabase Auth, the
+ * redirect landing on a loopback listener. Returns the new session.
+ */
+export async function hostedSignIn(opts) {
+    const sb = await newSupabase(opts.supabaseUrl, opts.publishableKey);
+    try {
+        return await loopbackSignIn({
+            timeoutMs: opts.timeoutMs,
+            start: async (redirectTo) => {
+                const { data, error } = await sb.auth.signInWithOAuth({
+                    provider: "github",
+                    options: { redirectTo, skipBrowserRedirect: true },
+                });
+                if (error || !data?.url)
+                    throw hubErrorFrom(error, 400);
+                await (opts.openBrowser ?? openInBrowser)(data.url);
+            },
+            exchange: async (code) => {
+                const { data, error } = await sb.auth.exchangeCodeForSession(code);
+                if (error || !data.session)
+                    throw new HubError(error?.message ?? "no session came back", 401);
+                return toHostedSession(data.session);
+            },
+        });
+    }
+    finally {
+        // This client only existed to sign in; the hub client takes the session from here.
+        await sb.auth.stopAutoRefresh().catch(() => { });
+    }
+}
+/** The authorization code in whatever the user pasted: a full URL, a query string, or the bare code. */
+export function codeFromPasted(pasted) {
+    const t = pasted.trim();
+    if (!t)
+        return null;
+    const m = /[?&#]code=([^&#\s]+)/.exec(t);
+    if (m)
+        return decodeURIComponent(m[1]);
+    const err = /[?&#]error_description=([^&#\s]+)/.exec(t);
+    if (err)
+        throw new HubError(decodeURIComponent(err[1].replace(/\+/g, " ")), 401);
+    return /^[A-Za-z0-9._~-]{8,}$/.test(t) ? t : null;
+}
+/**
+ * Hosted sign-in on a machine with no browser — a runner box over SSH (Loom
+ * Teams D74). Same PKCE flow as hostedSignIn, but the redirect goes to a
+ * loopback address nothing listens on: the user opens the URL anywhere, signs
+ * in with GitHub, lands on an error page, and pastes that page's address back.
+ * The code is useless without this process's verifier, so pasting it is safe.
+ */
+export async function pasteSignIn(opts) {
+    const sb = await newSupabase(opts.supabaseUrl, opts.publishableKey);
+    try {
+        const { data, error } = await sb.auth.signInWithOAuth({
+            provider: "github",
+            options: { redirectTo: "http://127.0.0.1:1/loom-signin", skipBrowserRedirect: true },
+        });
+        if (error || !data?.url)
+            throw hubErrorFrom(error, 400);
+        const code = codeFromPasted(await opts.ask(data.url));
+        if (!code)
+            throw new HubError("that didn't contain a sign-in code — paste the whole address you landed on", 400);
+        const ex = await sb.auth.exchangeCodeForSession(code);
+        if (ex.error || !ex.data.session)
+            throw new HubError(ex.error?.message ?? "no session came back", 401);
+        return toHostedSession(ex.data.session);
+    }
+    finally {
+        await sb.auth.stopAutoRefresh().catch(() => { });
+    }
+}
+//# sourceMappingURL=supabase-client.js.map