@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/cjs/cli/ops/operation-logger.js

@@ -0,0 +1,183 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initOperationLogger = initOperationLogger;
+exports.getOperationsPath = getOperationsPath;
+exports.logOperation = logOperation;
+exports.shutdownOperationLogger = shutdownOperationLogger;
+exports.withOperation = withOperation;
+exports.readRecentOperations = readRecentOperations;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const paths_1 = require("../../config/paths");
+const cloud_client_1 = require("../../audit/cloud-client");
+const OPERATIONS_PATH_SUFFIX = 'operations.jsonl';
+const OPERATIONS_INGEST_PATH = '/api/agent/operations/ingest';
+let client = null;
+let agentId;
+/**
+ * Operation logger — a local + cloud record of CLI/lifecycle operations, with
+ * two sinks available to any caller:
+ *
+ *   1. Local: `~/.sw-agent/operations.jsonl` (synchronous append, 0o600).
+ *   2. Cloud: POST /api/agent/operations/ingest (best-effort, batched, only
+ *      once {@link initOperationLogger} has attached a client).
+ *
+ * **Nothing in this repository emits an operation yet.** `logOperation()` and
+ * `withOperation()` have no callers outside this module, so `operations.jsonl` is
+ * not written and no ingest request is ever made — only the daemon calls
+ * {@link initOperationLogger}, which attaches the client and sets `agentId`.
+ *
+ * That is stated here rather than implied by a comment claiming that init, db
+ * add/remove, agent start/stop and config changes are recorded, because the old
+ * header asserted behaviour the code did not have (audit finding M-23). Wiring it
+ * up is a deliberate step at real lifecycle points in `src/cli/commands/*` and
+ * `src/cli/daemon/runtime.ts`; do not infer from this file that those points
+ * exist. Until then, treat this as an available mechanism, not an active record.
+ */
+function initOperationLogger(opts) {
+    agentId = opts.agentId;
+    if (!opts.enabled || !opts.token || opts.token === 'swagt_DEV_LOCAL_ONLY') {
+        client = null;
+        return;
+    }
+    const baseUrl = opts.cloudUrl ? (0, cloud_client_1.deriveHttpBase)(opts.cloudUrl) : undefined;
+    if (!baseUrl) {
+        client = null;
+        return;
+    }
+    client = new cloud_client_1.CloudClient({
+        baseUrl,
+        token: opts.token,
+        agentId: opts.agentId || 'unknown',
+    });
+    client.start();
+}
+/** Path to the local operations log. */
+function getOperationsPath() {
+    return path.join((0, paths_1.getSwAgentDir)(), OPERATIONS_PATH_SUFFIX);
+}
+/**
+ * Record an operation event to local + cloud. Never throws.
+ *
+ * No caller reaches this today (see the module header); it is the entry point a
+ * lifecycle call site would use.
+ */
+function logOperation(event) {
+    // Local sink — synchronous, reliable.
+    try {
+        const p = getOperationsPath();
+        fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+        fs.appendFileSync(p, JSON.stringify(event) + '\n', { encoding: 'utf8', mode: 0o600 });
+    }
+    catch {
+        // never let logging break the operation
+    }
+    // Cloud sink — best-effort.
+    try {
+        client?.enqueue(OPERATIONS_INGEST_PATH, event);
+    }
+    catch {
+        /* ignore */
+    }
+}
+/** Flush + close the cloud client. Call on daemon/REPL shutdown. */
+async function shutdownOperationLogger() {
+    if (client) {
+        await client.shutdown();
+        client = null;
+    }
+}
+/**
+ * Wrap an async operation so it emits `started` and `ok`/`error` events
+ * automatically. Returns whatever the wrapped function returns (or rethrows
+ * after logging the error).
+ *
+ * No caller reaches this today (see the module header).
+ */
+async function withOperation(op, target, fn) {
+    const start = Date.now();
+    logOperation({ ts: new Date(start).toISOString(), op, status: 'started', target, agent_id: agentId });
+    try {
+        const result = await fn();
+        logOperation({
+            ts: new Date().toISOString(),
+            op,
+            status: 'ok',
+            target,
+            duration_ms: Date.now() - start,
+            agent_id: agentId,
+        });
+        return result;
+    }
+    catch (err) {
+        logOperation({
+            ts: new Date().toISOString(),
+            op,
+            status: 'error',
+            target,
+            duration_ms: Date.now() - start,
+            error: err instanceof Error ? err.message : String(err),
+            agent_id: agentId,
+        });
+        throw err;
+    }
+}
+/**
+ * Read recent operation events from the local log, newest last.
+ *
+ * Returns an empty list while nothing emits operations: the file does not exist
+ * until `logOperation()` runs at least once.
+ */
+async function readRecentOperations(limit) {
+    try {
+        const content = await fs.promises.readFile(getOperationsPath(), 'utf8');
+        const lines = content.split('\n').filter(Boolean);
+        const events = [];
+        for (const line of lines) {
+            try {
+                events.push(JSON.parse(line));
+            }
+            catch {
+                // ignore malformed
+            }
+        }
+        return events.slice(-limit);
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=operation-logger.js.map

package/dist/cjs/cli/ops/operation-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-logger.js","sourceRoot":"","sources":["../../../../src/cli/ops/operation-logger.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,kDAsBC;AAGD,8CAEC;AAQD,oCAgBC;AAGD,0DAKC;AASD,sCA8BC;AAQD,oDAgBC;AArKD,uCAAyB;AACzB,2CAA6B;AAC7B,8CAAmD;AACnD,2DAAuE;AAcvE,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAClD,MAAM,sBAAsB,GAAG,8BAA8B,CAAC;AAE9D,IAAI,MAAM,GAAuB,IAAI,CAAC;AACtC,IAAI,OAA2B,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,mBAAmB,CAAC,IAKnC;IACC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,sBAAsB,EAAE,CAAC;QAC1E,MAAM,GAAG,IAAI,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,6BAAc,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,GAAG,IAAI,CAAC;QACd,OAAO;IACT,CAAC;IACD,MAAM,GAAG,IAAI,0BAAW,CAAC;QACvB,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;KACnC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,wCAAwC;AACxC,SAAgB,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAA,qBAAa,GAAE,EAAE,sBAAsB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAqB;IAChD,sCAAsC;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,uBAAuB;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,MAA0B,EAC1B,EAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QAC1B,YAAY,CAAC;YACX,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,EAAE;YACF,MAAM,EAAE,IAAI;YACZ,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC/B,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC;YACX,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,EAAE;YACF,MAAM,EAAE,OAAO;YACf,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC/B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACvD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,oBAAoB,CAAC,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC,CAAC;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB;YACrB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/cjs/cli/palette.d.ts

@@ -0,0 +1,11 @@
+interface PaletteItem {
+    command: string;
+    desc: string;
+}
+interface PaletteResult {
+    command: string;
+    args: string[];
+}
+export declare function showInlinePalette(items: PaletteItem[], _initialQuery: string): Promise<PaletteResult | null>;
+export {};
+//# sourceMappingURL=palette.d.ts.map

package/dist/cjs/cli/palette.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"palette.d.ts","sourceRoot":"","sources":["../../../src/cli/palette.ts"],"names":[],"mappings":"AAIA,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAuBD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,WAAW,EAAE,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoN/B"}

package/dist/cjs/cli/palette.js

@@ -0,0 +1,243 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showInlinePalette = showInlinePalette;
+const node_process_1 = require("node:process");
+const colors_1 = require("./ui/colors");
+const symbols_1 = require("./ui/symbols");
+const PALETTE_MAX_VISIBLE = 8;
+const PALETTE_WIDTH = 48;
+const MOUSE_ENABLE = '\x1b[?1000h\x1b[?1002h\x1b[?1006h';
+const MOUSE_DISABLE = '\x1b[?1006l\x1b[?1002l\x1b[?1000l';
+function rank(query, item) {
+    if (!query)
+        return 0;
+    const q = query.toLowerCase();
+    const cmd = item.command.toLowerCase();
+    const desc = item.desc.toLowerCase();
+    const cmdIdx = cmd.indexOf(q);
+    const descIdx = desc.indexOf(q);
+    if (cmdIdx === 0)
+        return -3; // exact prefix match on command
+    if (cmdIdx >= 0)
+        return -2; // substring match on command
+    if (descIdx === 0)
+        return -1; // exact prefix match on description
+    if (descIdx >= 0)
+        return 0; // substring match on description
+    return 1; // no match
+}
+async function showInlinePalette(items, _initialQuery) {
+    return new Promise((resolve) => {
+        let query = _initialQuery;
+        let filtered = [...items];
+        let selected = 0;
+        let done = false;
+        const getScreenWidth = () => node_process_1.stdout.columns || 80;
+        const enableMouse = () => {
+            node_process_1.stdout.write(MOUSE_ENABLE);
+        };
+        const disableMouse = () => {
+            node_process_1.stdout.write(MOUSE_DISABLE);
+        };
+        const filter = () => {
+            const q = query.toLowerCase();
+            if (!q) {
+                filtered = [...items];
+            }
+            else {
+                filtered = items
+                    .filter((item) => rank(q, item) < 1)
+                    .sort((a, b) => rank(q, a) - rank(q, b));
+            }
+            selected = 0;
+        };
+        const dropdownWidth = () => Math.min(PALETTE_WIDTH, getScreenWidth() - 4);
+        const drawDropdown = () => {
+            const w = dropdownWidth();
+            const visible = filtered.slice(0, PALETTE_MAX_VISIBLE);
+            const lines = [];
+            // Top border
+            lines.push(colors_1.C.cyan(symbols_1.S.tl) + colors_1.C.cyan(symbols_1.S.h.repeat(w - 2)) + colors_1.C.cyan(symbols_1.S.tr));
+            // Items
+            if (filtered.length === 0) {
+                lines.push(colors_1.C.cyan(symbols_1.S.v) + ' ' + colors_1.C.dim('No matches') + ' '.repeat(w - 14) + colors_1.C.cyan(symbols_1.S.v));
+            }
+            else {
+                for (let i = 0; i < visible.length; i++) {
+                    const item = visible[i];
+                    const isSelected = i === selected;
+                    let line = '';
+                    line += colors_1.C.cyan(symbols_1.S.v);
+                    if (isSelected) {
+                        line += ' ' + colors_1.C.brand('▸') + ' ';
+                        line += colors_1.C.brand(colors_1.C.bold(item.command));
+                    }
+                    else {
+                        line += '   ';
+                        line += colors_1.C.cyan(item.command);
+                    }
+                    const cmdLen = (0, colors_1.visibleLength)(item.command);
+                    const padding = Math.max(0, 20 - cmdLen);
+                    line += ' '.repeat(padding);
+                    if (isSelected) {
+                        line += colors_1.C.brand(item.desc);
+                    }
+                    else {
+                        line += colors_1.C.dim(item.desc);
+                    }
+                    const descLen = (0, colors_1.visibleLength)(item.desc);
+                    const rightPad = Math.max(0, w - 4 - padding - cmdLen - descLen);
+                    line += ' '.repeat(rightPad);
+                    line += colors_1.C.cyan(symbols_1.S.v);
+                    lines.push(line);
+                }
+            }
+            // Fill empty rows
+            for (let i = visible.length; i < PALETTE_MAX_VISIBLE; i++) {
+                lines.push(colors_1.C.cyan(symbols_1.S.v) + ' '.repeat(w - 2) + colors_1.C.cyan(symbols_1.S.v));
+            }
+            // Bottom border
+            lines.push(colors_1.C.cyan(symbols_1.S.bl) + colors_1.C.cyan(symbols_1.S.h.repeat(w - 2)) + colors_1.C.cyan(symbols_1.S.br));
+            // Status line
+            const status = filtered.length > 0
+                ? `${selected + 1}/${filtered.length}  ${query ? 'filtered' : 'all'}`
+                : '0/0';
+            lines.push(colors_1.C.dim('  ' + status + '   Enter=select  Esc=cancel  ↑↓=nav'));
+            return lines;
+        };
+        const openDropdown = () => {
+            node_process_1.stdout.write('\n');
+            const lines = drawDropdown();
+            for (const line of lines) {
+                node_process_1.stdout.write(line + '\n');
+            }
+        };
+        const closeDropdown = () => {
+            const totalLines = PALETTE_MAX_VISIBLE + 3; // items + borders + status
+            // Move cursor up to the top of the dropdown
+            for (let i = 0; i < totalLines; i++) {
+                node_process_1.stdout.write('\x1b[1A\x1b[K');
+            }
+        };
+        const redraw = () => {
+            closeDropdown();
+            node_process_1.stdout.write('\n');
+            const lines = drawDropdown();
+            for (const line of lines) {
+                node_process_1.stdout.write(line + '\n');
+            }
+        };
+        const selectAndClose = () => {
+            if (filtered.length > 0) {
+                const item = filtered[selected];
+                cleanup();
+                resolve({ command: item.command, args: [] });
+            }
+        };
+        const parseMouseEvent = (str) => {
+            // eslint-disable-next-line no-control-regex -- matching ANSI escape sequences is the intent
+            const match = str.match(/^\x1b\[<(\d+);(\d+);(\d+)([Mm])/);
+            if (!match)
+                return null;
+            const button = parseInt(match[1], 10);
+            const y = parseInt(match[3], 10) - 1;
+            let action = match[4] === 'M' ? 'press' : 'release';
+            if (button & 64) {
+                action = (button & 1) ? 'scroll_down' : 'scroll_up';
+            }
+            return { action, y };
+        };
+        const handleMouseClick = (y) => {
+            // The dropdown starts at the line after the prompt. We need to figure out
+            // which row was clicked. Since we don't know the absolute cursor position,
+            // we approximate: the first item row is 1 line after the top border.
+            // This is a simplified approach.
+            const clickedIndex = y; // Approximate
+            if (clickedIndex >= 0 && clickedIndex < Math.min(filtered.length, PALETTE_MAX_VISIBLE)) {
+                selected = clickedIndex;
+                selectAndClose();
+            }
+        };
+        const onData = (chunk) => {
+            const str = chunk.toString('utf8');
+            const mouseEvent = parseMouseEvent(str);
+            if (mouseEvent) {
+                if (mouseEvent.action === 'scroll_up') {
+                    selected = Math.max(0, selected - 1);
+                    redraw();
+                }
+                else if (mouseEvent.action === 'scroll_down') {
+                    selected = Math.min(filtered.length - 1, selected + 1);
+                    redraw();
+                }
+                else if (mouseEvent.action === 'press') {
+                    handleMouseClick(mouseEvent.y);
+                }
+                return;
+            }
+            if (str.startsWith('\x1b[')) {
+                const code = str.slice(2);
+                if (code === 'A') {
+                    selected = Math.max(0, selected - 1);
+                    redraw();
+                    return;
+                }
+                if (code === 'B') {
+                    selected = Math.min(filtered.length - 1, selected + 1);
+                    redraw();
+                    return;
+                }
+                return;
+            }
+            for (const ch of str) {
+                const code = ch.charCodeAt(0);
+                if (code === 3) {
+                    cleanup();
+                    resolve(null);
+                    return;
+                }
+                if (code === 13 || code === 10) {
+                    selectAndClose();
+                    return;
+                }
+                if (code === 27) {
+                    cleanup();
+                    resolve(null);
+                    return;
+                }
+                if (code === 9) {
+                    selected = (selected + 1) % Math.max(1, filtered.length);
+                    redraw();
+                    return;
+                }
+                if (code === 127 || code === 8) {
+                    if (query.length > 0) {
+                        query = query.slice(0, -1);
+                        filter();
+                        redraw();
+                    }
+                    return;
+                }
+                if (code >= 32 && code < 127) {
+                    query += ch;
+                    filter();
+                    redraw();
+                    return;
+                }
+            }
+        };
+        const cleanup = () => {
+            if (done)
+                return;
+            done = true;
+            node_process_1.stdin.removeListener('data', onData);
+            closeDropdown();
+            disableMouse();
+        };
+        filter();
+        enableMouse();
+        openDropdown();
+        node_process_1.stdin.on('data', onData);
+    });
+}
+//# sourceMappingURL=palette.js.map

package/dist/cjs/cli/palette.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"palette.js","sourceRoot":"","sources":["../../../src/cli/palette.ts"],"names":[],"mappings":";;AAmCA,8CAuNC;AA1PD,+CAA6C;AAC7C,wCAA+C;AAC/C,0CAAiC;AAYjC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,YAAY,GAAG,mCAAmC,CAAC;AACzD,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAE1D,SAAS,IAAI,CAAC,KAAa,EAAE,IAAiB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEhC,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,gCAAgC;IAC7D,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAE,6BAA6B;IAC1D,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,oCAAoC;IAClE,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAG,iCAAiC;IAC/D,OAAO,CAAC,CAAC,CAAC,WAAW;AACvB,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,KAAoB,EACpB,aAAqB;IAErB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,GAAG,aAAa,CAAC;QAC1B,IAAI,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,IAAI,GAAG,KAAK,CAAC;QAEjB,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,qBAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAE1D,MAAM,WAAW,GAAG,GAAG,EAAE;YACvB,qBAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC7B,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,qBAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9B,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,KAAK;qBACb,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;qBACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;QAElF,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAEvD,MAAM,KAAK,GAAa,EAAE,CAAC;YAE3B,aAAa;YACb,KAAK,CAAC,IAAI,CAAC,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,EAAE,CAAC,GAAG,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAEpE,QAAQ;YACR,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,UAAC,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACxC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;oBACxB,MAAM,UAAU,GAAG,CAAC,KAAK,QAAQ,CAAC;oBAElC,IAAI,IAAI,GAAG,EAAE,CAAC;oBACd,IAAI,IAAI,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,CAAC,CAAC,CAAC;oBAEpB,IAAI,UAAU,EAAE,CAAC;wBACf,IAAI,IAAI,GAAG,GAAG,UAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;wBACjC,IAAI,IAAI,UAAC,CAAC,KAAK,CAAC,UAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBACxC,CAAC;yBAAM,CAAC;wBACN,IAAI,IAAI,KAAK,CAAC;wBACd,IAAI,IAAI,UAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC/B,CAAC;oBAED,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;oBACzC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAE5B,IAAI,UAAU,EAAE,CAAC;wBACf,IAAI,IAAI,UAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC7B,CAAC;yBAAM,CAAC;wBACN,IAAI,IAAI,UAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3B,CAAC;oBAED,MAAM,OAAO,GAAG,IAAA,sBAAa,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;oBACjE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAC7B,IAAI,IAAI,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,CAAC,CAAC,CAAC;oBACpB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,kBAAkB;YAClB,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;YAED,gBAAgB;YAChB,KAAK,CAAC,IAAI,CAAC,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,EAAE,CAAC,GAAG,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,UAAC,CAAC,IAAI,CAAC,WAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAEpE,cAAc;YACd,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;gBACrE,CAAC,CAAC,KAAK,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,UAAC,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,qCAAqC,CAAC,CAAC,CAAC;YAEzE,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,YAAY,GAAG,GAAG,EAAE;YACxB,qBAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,qBAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,GAAG,EAAE;YACzB,MAAM,UAAU,GAAG,mBAAmB,GAAG,CAAC,CAAC,CAAC,2BAA2B;YACvE,4CAA4C;YAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,qBAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,aAAa,EAAE,CAAC;YAChB,qBAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,qBAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,GAAG,EAAE;YAC1B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAChC,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,eAAe,GAAG,CAAC,GAAW,EAAwC,EAAE;YAC5E,4FAA4F;YAC5F,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;gBAChB,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;YACtD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACvB,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAE,EAAE;YACrC,0EAA0E;YAC1E,2EAA2E;YAC3E,qEAAqE;YACrE,iCAAiC;YACjC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,cAAc;YACtC,IAAI,YAAY,IAAI,CAAC,IAAI,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBACvF,QAAQ,GAAG,YAAY,CAAC;gBACxB,cAAc,EAAE,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEnC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBACtC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;oBACrC,MAAM,EAAE,CAAC;gBACX,CAAC;qBAAM,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;oBAC/C,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;oBACvD,MAAM,EAAE,CAAC;gBACX,CAAC;qBAAM,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACzC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;oBAAC,MAAM,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC7E,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;oBAAC,MAAM,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC/F,OAAO;YACT,CAAC;YAED,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAE9B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBAAC,OAAO,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACrD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAAC,cAAc,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC7D,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAAC,OAAO,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACtD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBAAC,QAAQ,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAAC,MAAM,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC/F,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACrB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC3B,MAAM,EAAE,CAAC;wBACT,MAAM,EAAE,CAAC;oBACX,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;oBAC7B,KAAK,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,CAAC;oBACT,MAAM,EAAE,CAAC;oBACT,OAAO;gBACT,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,oBAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,EAAE,CAAC;QACT,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;QACf,oBAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cjs/cli/prompt.d.ts

@@ -0,0 +1,186 @@
+import * as readline from 'readline';
+export declare function setReplInterface(interface_: readline.Interface | null): void;
+export declare function setReplMode(mode: boolean): void;
+export declare function isReplMode(): boolean;
+export declare function getReplInterface(): readline.Interface | null;
+export declare function ask(question: string, defaultValue?: string): Promise<string>;
+export declare function askSecret(question: string): Promise<string>;
+export declare function askChoice(question: string, choices: string[], defaultValue?: string): Promise<string>;
+export declare function askConfirm(question: string, defaultValue: boolean): Promise<boolean>;
+export declare function closePrompts(): void;
+/**
+ * Where a resolved value came from.
+ *
+ * `'argv'` is reachable only for a value the caller proved carries no secret
+ * (see {@link ResolveSecretOptions.assertArgvValueSafe}); a secret is never
+ * sourced from argv. `'env'` means a value read from a named environment
+ * variable by the caller, which is a private channel on Linux because
+ * `/proc/<pid>/environ` is mode 0400 and owned by the process's own user.
+ */
+export type SecretSource = 'file' | 'stdin' | 'env' | 'argv' | 'prompt';
+export interface ResolvedSecret {
+    /** The secret, or undefined when no source supplied one. */
+    value?: string;
+    source?: SecretSource;
+}
+export interface ResolveSecretOptions {
+    args: string[];
+    /** Human name used in messages, e.g. "Database password". */
+    label: string;
+    /**
+     * Flags whose value would put the secret inline in `process.argv`.
+     *
+     * An argv value is REFUSED, not warned about: `/proc/<pid>/cmdline` is
+     * world-readable on Linux, so a warning still leaks the credential to every
+     * local UID for the lifetime of the process, and the value is already written
+     * to the shell history by the time the warning is printed. A warning that the
+     * deprecated flag "still works" is a credential leak with extra steps.
+     *
+     * The exception is a value that is only ARGUMENT-SAFE when it carries no
+     * secret — a connection URL without userinfo. `db add --url` passes such a
+     * value through `assertArgvValueSafe`, which is what decides; a URL with a
+     * password in it is refused by that assertion.
+     */
+    argvFlags: readonly string[];
+    /** Proves an argv value carries no credential. Omit to refuse every one. */
+    assertArgvValueSafe?: (value: string) => void;
+    /** Flags naming a file to read the secret from. */
+    fileFlags: readonly string[];
+    /** Flags that read the secret from stdin. */
+    stdinFlags: readonly string[];
+    /** Masked prompt to fall back to when nothing was supplied. */
+    promptWhenMissing?: boolean;
+    /** Stdin reader, injectable for tests. Defaults to reading fd 0. */
+    readStdin?: () => string;
+    /** Masked prompt, injectable for tests. Defaults to {@link askSecret}. */
+    prompt?: (label: string) => Promise<string>;
+    /**
+     * Accepted for source compatibility. A refusal no longer consults it: whether
+     * an argv value is acceptable is decided by `assertArgvValueSafe`, and the
+     * answer can no longer be downgraded to a warning.
+     */
+    shouldWarnOnArgv?: (value: string) => boolean;
+}
+/** True when both ends are a terminal, i.e. a human can answer a prompt. */
+export declare function isInteractive(): boolean;
+/**
+ * Machine-readable reasons a credential channel was refused. Printed in the
+ * refusal headline so an operator (and a CI gate) can grep for the code instead
+ * of parsing prose.
+ */
+export type SecretRefusalCode = 'password_in_argv_refused' | 'password_file_not_private';
+/**
+ * A credential channel was refused.
+ *
+ * `message` is the complete, self-contained operator explanation — including
+ * the code — because callers that do not know about this class (any command
+ * that catches and prints `err.message`) must still produce the full refusal
+ * text rather than a bare "refused". `lines` is the same text split for
+ * commanders that render it.
+ *
+ * Nothing in a `SecretRefusalError` may contain the rejected secret. The whole
+ * point of refusing is that the value does not reach the terminal, the shell
+ * history again, `errors.jsonl`, or `daemon.log`.
+ */
+export declare class SecretRefusalError extends Error {
+    readonly code: SecretRefusalCode;
+    /** The operator-facing explanation, one array entry per line. */
+    readonly lines: readonly string[];
+    constructor(code: SecretRefusalCode, headline: string, detail: readonly string[]);
+}
+/** True when `err` is a refusal this module raised. */
+export declare function isSecretRefusalError(err: unknown): err is SecretRefusalError;
+/**
+ * Builds the refusal for a secret supplied inline on the command line.
+ *
+ * The rejected value is never echoed. The explanation names the flags, states
+ * why argv is not private, and lists the channels that are.
+ */
+export declare function refuseSecretInArgv(flags: readonly string[], label: string, alternatives: readonly string[]): SecretRefusalError;
+/** The placeholder a redacted password is replaced with. Matches `redactSecrets`. */
+export declare const REDACTED_PLACEHOLDER = "***";
+/**
+ * Replaces the password in a connection URL with a placeholder while keeping
+ * the URL recognisable, so a refusal can show the operator exactly what was
+ * rejected without the rejection itself becoming the leak.
+ *
+ * Percent-encoded passwords are handled by construction: `URL.password` keeps
+ * the encoding, so assigning over the field deletes the whole encoded value
+ * rather than a decoded fragment of it. The textual fallback covers a URL the
+ * WHATWG parser rejects, where the last `@` in the authority is treated as the
+ * userinfo separator.
+ */
+export declare function redactUrlPassword(raw: string): string;
+/**
+ * True when a connection URL carries userinfo, i.e. a credential.
+ *
+ * A URL the parser rejects counts as carrying one: refusing an unparseable URL
+ * is strictly safer than forwarding a value whose shape was never understood.
+ */
+export declare function urlCarriesCredentials(value: string): boolean;
+/**
+ * Asserts a connection URL taken from argv carries no password.
+ *
+ * The URL is the only argv value this CLI still accepts, and only because a URL
+ * without userinfo is not a credential. One WITH userinfo is refused and echoed
+ * back redacted, so the operator can see which URL was rejected without the
+ * rejection itself becoming the leak.
+ */
+export declare function assertUrlHasNoPassword(value: string): void;
+/**
+ * Refuses a credential file that any local user can read, or that is a symlink.
+ *
+ * Two separate attacks, so two separate refusals:
+ *
+ *  - Permissions. `fs.readFileSync` on a 0644 file hands the password to every
+ *    local UID. Accepting it would move the leak out of argv (where it is at
+ *    least momentary) and into a file that stays exposed for as long as it
+ *    exists. Owner-only (`0600`, `0400`) is the requirement.
+ *  - Symlink. A link planted by another local user makes the read return whatever
+ *    the link target holds, so the "password" the CLI stores is not necessarily
+ *    the one on disk, and the operator's real secret file can be aimed at a
+ *    process that will read it. `lstat`, never `stat`: `stat` follows the link
+ *    and reports the target's type, which is exactly the check that has to fail.
+ *
+ * POSIX modes are meaningless on Windows, so the permission check is POSIX-only.
+ */
+export declare function assertSecretFileIsPrivate(filePath: string, label: string): void;
+/**
+ * Reads a secret from a file. Refuses a group- or world-readable file and a
+ * symlink first — see {@link assertSecretFileIsPrivate} — then throws with a
+ * caller-facing message on failure.
+ */
+export declare function readSecretFromFile(filePath: string, label: string): string;
+/**
+ * Reads a secret from stdin (fd 0) to end-of-input, so the secret never
+ * appears in argv. Throws when the input is empty.
+ */
+export declare function readSecretFromStdin(label: string, reader?: () => string): string;
+/**
+ * The deprecation warning printed when a secret is taken from argv.
+ *
+ * Kept only so an operator who already scripted the old flag gets told what to
+ * use instead. Nothing calls it on the success path any more: `resolveSecret`
+ * REFUSES an argv secret, and only a refusal is printed.
+ */
+export declare function secretArgvExposureWarning(flags: readonly string[], label: string, alternatives: readonly string[]): string;
+/** Prints the refusal notice for an argv-supplied secret. */
+export declare function warnSecretExposedInArgv(flags: readonly string[], label: string, alternatives: readonly string[]): void;
+/**
+ * Resolves a secret from a channel that is not argv, in order: a private file,
+ * stdin, then a masked prompt.
+ *
+ * An argv value is never returned unless the caller supplied
+ * `assertArgvValueSafe` AND it accepted the value. Without that assertion
+ * (`db add --password`, `db edit --pw`, and every future caller that has not
+ * thought about it) the flag is refused with `password_in_argv_refused` and no
+ * value is ever read out of argv, so the secret cannot reach `ps`,
+ * `/proc/<pid>/cmdline`, the shell history, or any log this process writes.
+ *
+ * Refusal is checked BEFORE the safe channels on purpose. `db add --password x
+ * --password-file f` is refused rather than quietly honoured via the file: the
+ * value is already in argv whatever this command does next, so the operator
+ * needs to hear about it, and the shell history needs to be cleaned.
+ */
+export declare function resolveSecret(opts: ResolveSecretOptions): Promise<ResolvedSecret>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/cjs/cli/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../../src/cli/prompt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAMrC,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAE5E;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE/C;AAED,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAE5D;AAED,wBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C5E;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0E3D;AAED,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB1F;AAED,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,mDAAmD;IACnD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,6CAA6C;IAC7C,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC/C;AAgBD,4EAA4E;AAC5E,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAMD;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,2BAA2B,CAAC;AAEzF;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEtB,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE;CAOjF;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,kBAAkB,CAE5E;AAgCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,kBAAkB,CAOpB;AAKD,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAerD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAkB1D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA2C/E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAe1E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM,GAAG,MAAM,CAchF;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAOR;AAED,6DAA6D;AAC7D,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,IAAI,CAEN;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwCvF"}