@ophan/cli 0.0.1 → 0.0.2

package/README.md

@@ -1,82 +1,72 @@
 # @ophan/cli
 
-Command-line interface for analyzing codebases and managing Ophan databases.
+AI-powered security analysis and documentation for your codebase. Detects vulnerabilities, maps data flows, and auto-documents every function — from the command line.
 
-## Usage
+Part of [Ophan](https://ophan.dev). Works standalone or alongside the [VS Code extension](https://marketplace.visualstudio.com/items?itemName=ophan.ophan).
 
-### Repository Analysis
-```bash
-# Analyze a repo (creates .ophan/index.db)
-npx ophan analyze --path /path/to/repo
+## Quick Start
 
-# Or as dev dependency
-npm install --save-dev ophan
-npx ophan analyze
+```bash
+npx @ophan/cli analyze
 ```
 
-### Commands
-- `ophan analyze` — Scan repo, extract functions, analyze with Claude, store by content hash
-- `ophan sync` — Push/pull analysis to/from Supabase (requires auth)
-- `ophan gc` — Garbage collect orphaned analysis entries (manual only, never automatic, 30-day grace period)
+That's it. Ophan scans your repo, extracts every function, and sends them to Claude for security analysis and documentation. Results are stored locally in `.ophan/index.db`.
 
-## How Analysis Works
+You'll need an [Anthropic API key](https://console.anthropic.com/) set as `ANTHROPIC_API_KEY` in your environment or a `.env` file.
 
-### Initial Run
-1. Discovers all TypeScript/JavaScript source files
-2. Extracts functions, computes SHA256 content hash for each
-3. Checks local DB — skips functions with existing analysis for that hash
-4. Sends new functions to Claude for analysis
-5. Stores results in `function_analysis` (keyed by content_hash)
-6. Updates `file_functions` with file path, function name, content_hash, mtime
+## What You Get
 
-### Incremental Updates
-1. Checks `file_mtime` in `file_functions` — skips entirely unchanged files (no parsing needed)
-2. Re-parses changed files, re-hashes functions
-3. Only analyzes functions with new/unknown hashes
-4. Updates `file_functions` mappings
+For every function in your codebase:
 
-### Garbage Collection
-`ophan gc` is manual only — never runs automatically. This protects against branch switching scenarios (e.g. function deleted on feature branch but still exists on main).
+- **Security analysis** — SQL injection, XSS, hardcoded secrets, path traversal, unsanitized input
+- **Data flow tags** — which functions touch user input, PII, credentials, databases, external APIs
+- **Documentation** — plain-English descriptions, parameter docs, return type docs
 
-How it works:
-1. Scans codebase, computes all current hashes
-2. Compares to stored `function_analysis` entries
-3. Only deletes entries not seen in grace period (default 30 days, configurable)
-4. Updates `last_referenced_at` in Supabase for synced entries
-5. If synced, GC'd entries can be re-downloaded on next sync instead of re-analyzed
+## Commands
 
-`file_functions` is ephemeral — rebuilt on every scan. `function_analysis` is persistent until explicit GC.
+```bash
+npx @ophan/cli analyze          # Analyze current directory
+npx @ophan/cli analyze --path . # Analyze a specific path
+npx @ophan/cli sync             # Sync results to ophan.dev (optional)
+npx @ophan/cli gc               # Clean up old analysis entries
+```
 
-### Sync
-`ophan sync` pushes/pulls `function_analysis` rows to/from Supabase:
-- Insert-only (content-addressed = immutable, no conflicts)
-- Free users: scoped to `user_id`
-- Team users: scoped to `team_id` (new members pull existing analysis)
+### As a dev dependency
 
-## Design Principles
+```bash
+npm install --save-dev @ophan/cli
+npx ophan analyze
+```
+
+Add to your team's repo so everyone gets the CLI on `npm install`. Analysis is cached by content hash — unchanged functions are never re-analyzed.
+
+## How It Works
 
-### Local-First
-All analysis stored in per-repo `.ophan/index.db` (gitignored). No cloud required for core functionality. Supabase sync is optional.
+1. Parses your source files using language-native ASTs (TypeScript compiler API, Python's `ast` module)
+2. Extracts every function and computes a SHA256 content hash
+3. Skips functions that haven't changed since last analysis
+4. Sends new/changed functions to Claude for security and documentation analysis
+5. Stores results locally in `.ophan/index.db` (gitignored)
 
-### Dev Dependency Model
-Add to `devDependencies` — one engineer installs, whole team gets CLI on `npm install`. Bottom-up adoption path.
+Supports **TypeScript**, **JavaScript**, and **Python**.
 
-### Non-Invasive
-Database in hidden `.ophan/` directory, gitignored. Does not modify source code or project configuration.
+## Cloud Sync
 
-### Content-Addressed
-Analysis keyed by function content hash, not file path. Branch-agnostic, merge-friendly, deduplication built in.
+Optionally sync your analysis to [ophan.dev](https://ophan.dev) for a web dashboard, team sharing, and cross-machine access.
+
+```bash
+npx @ophan/cli login             # Authenticate with ophan.dev
+npx @ophan/cli analyze           # Auto-pulls from cloud, then analyzes remaining
+npx @ophan/cli sync              # Push new results to cloud
+```
 
-## Output
+## Resources
 
-Creates `.ophan/index.db` containing:
-- `function_analysis` — content_hash, analysis JSON, model version, timestamp
-- `file_functions` — file path, function name, content_hash, file mtime
+- [Documentation](https://docs.ophan.dev)
+- [CLI Reference](https://docs.ophan.dev/cli/commands)
+- [VS Code Extension](https://marketplace.visualstudio.com/items?itemName=ophan.ophan)
+- [GitHub](https://github.com/nicholasgriffintn/ophan)
 
-## CI/CD Integration
+## License
 
-### GitHub Action (Planned)
-Run `ophan analyze` on PRs:
-- Comment with new function documentation
-- Fail if new security warnings introduced
-- Show data flow changes in PR review
+MIT

package/package.json

@@ -1,7 +1,9 @@
 {
   "name": "@ophan/cli",
-  "version": "0.0.1",
-  "files": ["dist"],
+  "version": "0.0.2",
+  "files": [
+    "dist"
+  ],
   "bin": {
     "ophan": "./dist/index.js"
   },

package/dist/sync.test.js

@@ -1,288 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const vitest_1 = require("vitest");
-const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
-const test_utils_1 = require("./test-utils");
-const sync_1 = require("./sync");
-const test_utils_2 = require("@ophan/core/test-utils");
-const USER_A = "user-aaaa-aaaa-aaaa-aaaaaaaaaaaa";
-const USER_B = "user-bbbb-bbbb-bbbb-bbbbbbbbbbbb";
-const REPO_ID = "repo-1";
-function defaultRepoResponse() {
-    return { data: { id: REPO_ID }, error: null };
-}
-// ============ syncToSupabase ============
-(0, vitest_1.describe)("syncToSupabase", () => {
-    const cleanups = [];
-    function tracked(result) {
-        cleanups.push(result.cleanup);
-        return result;
-    }
-    (0, vitest_1.afterEach)(() => {
-        cleanups.forEach((fn) => fn());
-        cleanups.length = 0;
-    });
-    (0, vitest_1.describe)("account change detection", () => {
-        (0, vitest_1.it)("first sync — stores user_id, no reset", async () => {
-            const { rootPath, dbPath } = tracked((0, test_utils_1.createTempDb)());
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            const db = new better_sqlite3_1.default(dbPath);
-            const row = db
-                .prepare("SELECT value FROM sync_meta WHERE key = 'last_synced_user_id'")
-                .get();
-            db.close();
-            (0, vitest_1.expect)(row.value).toBe(USER_A);
-        });
-        (0, vitest_1.it)("same user re-sync — no reset of synced_at", async () => {
-            const { rootPath, dbPath } = tracked((0, test_utils_1.createTempDb)((db) => {
-                db.prepare("INSERT INTO sync_meta (key, value) VALUES ('last_synced_user_id', ?)").run(USER_A);
-                (0, test_utils_2.insertAnalysisPair)(db, "hash1", { syncedAt: 1000 });
-            }));
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            // synced_at should still be set (not reset to NULL)
-            const db = new better_sqlite3_1.default(dbPath);
-            const row = db
-                .prepare("SELECT synced_at FROM function_analysis WHERE content_hash = 'hash1' AND analysis_type = 'documentation'")
-                .get();
-            db.close();
-            (0, vitest_1.expect)(row.synced_at).toBe(1000);
-        });
-        (0, vitest_1.it)("different user — resets synced_at to NULL and clears GC", async () => {
-            const { rootPath, dbPath } = tracked((0, test_utils_1.createTempDb)((db) => {
-                db.prepare("INSERT INTO sync_meta (key, value) VALUES ('last_synced_user_id', ?)").run(USER_A);
-                (0, test_utils_2.insertAnalysisPair)(db, "hash1", { syncedAt: 1000 });
-                db.prepare("INSERT INTO function_gc (content_hash, analysis_type, gc_at) VALUES ('old', 'documentation', 999)").run();
-            }));
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_B);
-            const db = new better_sqlite3_1.default(dbPath);
-            // synced_at should be NULL (reset) then re-set by the push
-            const meta = db
-                .prepare("SELECT value FROM sync_meta WHERE key = 'last_synced_user_id'")
-                .get();
-            const gcCount = db
-                .prepare("SELECT count(*) as c FROM function_gc")
-                .get();
-            db.close();
-            (0, vitest_1.expect)(meta.value).toBe(USER_B);
-            (0, vitest_1.expect)(gcCount.c).toBe(0);
-        });
-    });
-    (0, vitest_1.describe)("push batching", () => {
-        (0, vitest_1.it)("pushes only unsynced rows (synced_at IS NULL)", async () => {
-            const { rootPath } = tracked((0, test_utils_1.createTempDb)((db) => {
-                (0, test_utils_2.insertAnalysisPair)(db, "hash-synced", { syncedAt: 1000 });
-                (0, test_utils_2.insertAnalysisPair)(db, "hash-unsynced", { syncedAt: null });
-            }));
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            const result = await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            // Only hash-unsynced's 2 rows (doc + sec) should be pushed
-            (0, vitest_1.expect)(result.pushed).toBe(2);
-        });
-        (0, vitest_1.it)("marks synced_at after push", async () => {
-            const { rootPath, dbPath } = tracked((0, test_utils_1.createTempDb)((db) => {
-                (0, test_utils_2.insertAnalysisPair)(db, "hash1", { syncedAt: null });
-            }));
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            const db = new better_sqlite3_1.default(dbPath);
-            const rows = db
-                .prepare("SELECT synced_at FROM function_analysis WHERE content_hash = 'hash1'")
-                .all();
-            db.close();
-            for (const row of rows) {
-                (0, vitest_1.expect)(row.synced_at).not.toBeNull();
-                (0, vitest_1.expect)(row.synced_at).toBeGreaterThan(0);
-            }
-        });
-    });
-    (0, vitest_1.describe)("location full-sync", () => {
-        (0, vitest_1.it)("DELETE + INSERT pattern for file_functions", async () => {
-            const { rootPath } = tracked((0, test_utils_1.createTempDb)((db) => {
-                (0, test_utils_2.insertFileFunction)(db, "src/a.ts", "fn1", "hash1");
-                (0, test_utils_2.insertFileFunction)(db, "src/b.ts", "fn2", "hash2");
-            }));
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            const result = await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            (0, vitest_1.expect)(result.locations).toBe(2);
-            // Verify DELETE was called before INSERT
-            const locationCalls = mock.calls.filter((c) => c.table === "function_locations");
-            const deleteIdx = locationCalls.findIndex((c) => c.method === "delete");
-            const insertIdx = locationCalls.findIndex((c) => c.method === "insert");
-            (0, vitest_1.expect)(deleteIdx).toBeLessThan(insertIdx);
-        });
-        (0, vitest_1.it)("empty file_functions — only deletes remote", async () => {
-            const { rootPath } = tracked((0, test_utils_1.createTempDb)());
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            const result = await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            (0, vitest_1.expect)(result.locations).toBe(0);
-            // Should still call delete (clear remote)
-            const deleteCalls = mock.calls.filter((c) => c.table === "function_locations" && c.method === "delete");
-            (0, vitest_1.expect)(deleteCalls.length).toBe(1);
-            // Should NOT call insert
-            const insertCalls = mock.calls.filter((c) => c.table === "function_locations" && c.method === "insert");
-            (0, vitest_1.expect)(insertCalls.length).toBe(0);
-        });
-    });
-    (0, vitest_1.describe)("GC tombstone propagation", () => {
-        (0, vitest_1.it)("processes unsynced GC entries and cleans them up", async () => {
-            const { rootPath, dbPath } = tracked((0, test_utils_1.createTempDb)((db) => {
-                db.prepare("INSERT INTO function_gc (content_hash, analysis_type, gc_at) VALUES (?, ?, ?)").run("dead-hash", "documentation", Math.floor(Date.now() / 1000));
-            }));
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            const result = await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            (0, vitest_1.expect)(result.gcProcessed).toBe(1);
-            // GC rows should be cleaned up (synced then deleted)
-            const db = new better_sqlite3_1.default(dbPath);
-            const gcCount = db
-                .prepare("SELECT count(*) as c FROM function_gc")
-                .get();
-            db.close();
-            (0, vitest_1.expect)(gcCount.c).toBe(0);
-        });
-        (0, vitest_1.it)("type-specific tombstone — deletes specific analysis_type", async () => {
-            const { rootPath } = tracked((0, test_utils_1.createTempDb)((db) => {
-                db.prepare("INSERT INTO function_gc (content_hash, analysis_type, gc_at) VALUES (?, ?, ?)").run("dead-hash", "security", Math.floor(Date.now() / 1000));
-            }));
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            // Should delete with analysis_type filter
-            const deleteCalls = mock.calls.filter((c) => c.table === "function_analysis" && c.method === "delete");
-            (0, vitest_1.expect)(deleteCalls.length).toBe(1);
-            // Should have eq('analysis_type', 'security') in the chain
-            const eqCalls = mock.calls.filter((c) => c.table === "function_analysis" &&
-                c.method === "eq" &&
-                c.args[0] === "analysis_type");
-            (0, vitest_1.expect)(eqCalls.length).toBe(1);
-            (0, vitest_1.expect)(eqCalls[0].args[1]).toBe("security");
-        });
-        (0, vitest_1.it)("NULL analysis_type (legacy) — deletes all types for hash", async () => {
-            const { rootPath } = tracked((0, test_utils_1.createTempDb)((db) => {
-                db.prepare("INSERT INTO function_gc (content_hash, analysis_type, gc_at) VALUES (?, ?, ?)").run("dead-hash", null, Math.floor(Date.now() / 1000));
-            }));
-            const mock = (0, test_utils_1.createMockSupabase)({
-                "repos.upsert": defaultRepoResponse(),
-            });
-            await (0, sync_1.syncToSupabase)(rootPath, mock.client, USER_A);
-            // Should delete WITHOUT analysis_type filter (no eq('analysis_type', ...))
-            const eqCalls = mock.calls.filter((c) => c.table === "function_analysis" &&
-                c.method === "eq" &&
-                c.args[0] === "analysis_type");
-            (0, vitest_1.expect)(eqCalls.length).toBe(0);
-        });
-    });
-});
-// ============ pullFromSupabase ============
-(0, vitest_1.describe)("pullFromSupabase", () => {
-    const cleanups = [];
-    function tracked(result) {
-        cleanups.push(result.cleanup);
-        return result;
-    }
-    (0, vitest_1.afterEach)(() => {
-        cleanups.forEach((fn) => fn());
-        cleanups.length = 0;
-    });
-    (0, vitest_1.it)("empty missing hashes — returns early with 0", async () => {
-        const { rootPath } = tracked((0, test_utils_1.createTempDb)());
-        const mock = (0, test_utils_1.createMockSupabase)();
-        const result = await (0, sync_1.pullFromSupabase)(rootPath, mock.client, USER_A, REPO_ID, []);
-        (0, vitest_1.expect)(result.pulled).toBe(0);
-        // Should NOT call supabase at all
-        (0, vitest_1.expect)(mock.calls.length).toBe(0);
-    });
-    (0, vitest_1.it)("applies defensive defaults for missing fields", async () => {
-        const { rootPath, dbPath } = tracked((0, test_utils_1.createTempDb)());
-        const mock = (0, test_utils_1.createMockSupabase)({
-            "function_analysis.select": {
-                data: [
-                    {
-                        content_hash: "hash1",
-                        analysis_type: "documentation",
-                        analysis: { description: "Test" },
-                        model_version: "claude-3",
-                        schema_version: null, // missing — should default to 1
-                        language: null, // missing — should default to 'typescript'
-                        entity_type: null, // missing — should default to 'function'
-                    },
-                ],
-                error: null,
-            },
-        });
-        const result = await (0, sync_1.pullFromSupabase)(rootPath, mock.client, USER_A, REPO_ID, ["hash1"]);
-        (0, vitest_1.expect)(result.pulled).toBe(1);
-        // Verify defaults were applied
-        const db = new better_sqlite3_1.default(dbPath);
-        const row = db
-            .prepare("SELECT language, entity_type, schema_version FROM function_analysis WHERE content_hash = 'hash1'")
-            .get();
-        db.close();
-        (0, vitest_1.expect)(row.language).toBe("typescript");
-        (0, vitest_1.expect)(row.entity_type).toBe("function");
-        (0, vitest_1.expect)(row.schema_version).toBe(1);
-    });
-    (0, vitest_1.it)("handles string vs object analysis field", async () => {
-        const { rootPath, dbPath } = tracked((0, test_utils_1.createTempDb)());
-        const mock = (0, test_utils_1.createMockSupabase)({
-            "function_analysis.select": {
-                data: [
-                    {
-                        content_hash: "hash-obj",
-                        analysis_type: "documentation",
-                        analysis: { description: "Object form" }, // object — should be stringified
-                        model_version: "claude-3",
-                        schema_version: 1,
-                        language: "typescript",
-                        entity_type: "function",
-                    },
-                    {
-                        content_hash: "hash-str",
-                        analysis_type: "documentation",
-                        analysis: '{"description":"String form"}', // already string
-                        model_version: "claude-3",
-                        schema_version: 1,
-                        language: "typescript",
-                        entity_type: "function",
-                    },
-                ],
-                error: null,
-            },
-        });
-        const result = await (0, sync_1.pullFromSupabase)(rootPath, mock.client, USER_A, REPO_ID, ["hash-obj", "hash-str"]);
-        (0, vitest_1.expect)(result.pulled).toBe(2);
-        // Both should be stored as valid JSON strings
-        const db = new better_sqlite3_1.default(dbPath);
-        const objRow = db
-            .prepare("SELECT analysis FROM function_analysis WHERE content_hash = 'hash-obj'")
-            .get();
-        const strRow = db
-            .prepare("SELECT analysis FROM function_analysis WHERE content_hash = 'hash-str'")
-            .get();
-        db.close();
-        (0, vitest_1.expect)(JSON.parse(objRow.analysis).description).toBe("Object form");
-        (0, vitest_1.expect)(JSON.parse(strRow.analysis).description).toBe("String form");
-    });
-});

package/dist/test-utils.js

@@ -1,161 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTempDb = createTempDb;
-exports.createMockSupabase = createMockSupabase;
-const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
-const path = __importStar(require("path"));
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const test_utils_1 = require("@ophan/core/test-utils");
-/**
- * Creates a temp directory with a real .ophan/index.db file.
- * Sync functions take rootPath and construct dbPath internally,
- * so we need an actual file on disk.
- */
-function createTempDb(setup) {
-    const rootPath = fs.mkdtempSync(path.join(os.tmpdir(), "ophan-test-"));
-    const ophanDir = path.join(rootPath, ".ophan");
-    fs.mkdirSync(ophanDir, { recursive: true });
-    const dbPath = path.join(ophanDir, "index.db");
-    // Create a real file-based DB with the current schema
-    const memDb = (0, test_utils_1.createTestDb)();
-    // Serialize the in-memory DB to a file
-    const db = new better_sqlite3_1.default(dbPath);
-    db.exec(memDb.prepare("SELECT sql FROM sqlite_master WHERE type='table'")
-        .all()
-        .map((row) => row.sql + ";")
-        .join("\n"));
-    // Run setup callback if provided
-    if (setup)
-        setup(db);
-    db.close();
-    memDb.close();
-    return {
-        dbPath,
-        rootPath,
-        cleanup: () => {
-            try {
-                fs.rmSync(rootPath, { recursive: true, force: true });
-            }
-            catch {
-                // best-effort cleanup
-            }
-        },
-    };
-}
-/**
- * Creates a mock Supabase client that records calls and returns controlled responses.
- *
- * Usage:
- *   const mock = createMockSupabase({
- *     'repos.upsert': { data: [{ id: 'repo-1' }], error: null },
- *     'function_analysis.select': { data: [], error: null },
- *   })
- *   await syncToSupabase(rootPath, mock.client, userId)
- *   expect(mock.calls).toContainEqual(expect.objectContaining({ table: 'repos', method: 'upsert' }))
- */
-function createMockSupabase(responses = {}) {
-    const calls = [];
-    function createChain(table) {
-        let primaryMethod = "";
-        const resolve = () => {
-            const key = `${table}.${primaryMethod}`;
-            return responses[key] ?? { data: [], error: null };
-        };
-        const chain = {};
-        const handler = {
-            get(_, prop) {
-                // Primary operations
-                if (["select", "insert", "upsert", "update", "delete"].includes(prop)) {
-                    return (...args) => {
-                        primaryMethod = prop;
-                        calls.push({ table, method: prop, args });
-                        return new Proxy(chain, handler);
-                    };
-                }
-                // Filter/modifier methods — chainable
-                if ([
-                    "eq",
-                    "in",
-                    "neq",
-                    "gt",
-                    "lt",
-                    "gte",
-                    "lte",
-                    "like",
-                    "ilike",
-                    "contains",
-                    "order",
-                    "limit",
-                    "range",
-                    "or",
-                    "not",
-                    "is",
-                    "head",
-                ].includes(prop)) {
-                    return (...args) => {
-                        calls.push({ table, method: prop, args });
-                        return new Proxy(chain, handler);
-                    };
-                }
-                // Terminal methods
-                if (prop === "single" || prop === "maybeSingle") {
-                    return (...args) => {
-                        calls.push({ table, method: prop, args });
-                        return Promise.resolve(resolve());
-                    };
-                }
-                // Thenable — allows `await supabase.from(...).select(...).eq(...)`
-                if (prop === "then") {
-                    const result = resolve();
-                    return Promise.resolve(result).then.bind(Promise.resolve(result));
-                }
-                return new Proxy(chain, handler);
-            },
-        };
-        return new Proxy(chain, handler);
-    }
-    const client = {
-        from: (table) => {
-            calls.push({ table, method: "from", args: [table] });
-            return createChain(table);
-        },
-    };
-    return { client: client, calls };
-}