@sequelsh/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,1068 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import open from "open";
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import pc from "picocolors";
+import * as p$4 from "@clack/prompts";
+import * as p$3 from "@clack/prompts";
+import * as p$2 from "@clack/prompts";
+import * as p$1 from "@clack/prompts";
+import * as p from "@clack/prompts";
+import { execFileSync } from "node:child_process";
+import YAML from "yaml";
+
+//#region src/lib/config.ts
+/** Default production API base. Override with SEQUEL_API_URL for local/dev. */
+const DEFAULT_API_URL = "https://api.sequel.sh";
+/** Directory holding the CLI's state. Overridable for tests. */
+function configDir() {
+	return process.env.SEQUEL_CONFIG_DIR || join(homedir(), ".sequel");
+}
+function configPath() {
+	return join(configDir(), "auth.json");
+}
+/** The API base URL: explicit env wins, then a saved value, then the default. */
+function resolveApiUrl(config) {
+	return process.env.SEQUEL_API_URL || config?.apiUrl || DEFAULT_API_URL;
+}
+function emptyConfig() {
+	return {
+		version: 1,
+		apiUrl: resolveApiUrl(),
+		tokens: {}
+	};
+}
+/** Read auth.json, returning a fresh empty config if missing or corrupt. */
+function readConfig() {
+	const path = configPath();
+	if (!existsSync(path)) return emptyConfig();
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf8"));
+		if (!parsed || typeof parsed !== "object" || !parsed.tokens) return emptyConfig();
+		parsed.tokens ??= {};
+		return parsed;
+	} catch {
+		return emptyConfig();
+	}
+}
+/** Persist auth.json with locked-down permissions (dir 0700, file 0600). */
+function writeConfig(config) {
+	const dir = configDir();
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const path = configPath();
+	writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+	chmodSync(path, 384);
+}
+/** Remove all stored credentials. Idempotent. */
+function clearConfig() {
+	const path = configPath();
+	if (existsSync(path)) rmSync(path);
+}
+function isLoggedIn$1(config) {
+	return Boolean(config.activeOrgId && config.tokens[config.activeOrgId]);
+}
+
+//#endregion
+//#region src/lib/auth.ts
+/** Refresh a token this many ms before it actually expires. */
+const EXPIRY_SKEW_MS = 6e4;
+function base64url(buf) {
+	return buf.toString("base64url");
+}
+/** PKCE pair: challenge = base64url(sha256(verifier)), matching the API's S256. */
+function generatePkce() {
+	const verifier = base64url(randomBytes(32));
+	const challenge = base64url(createHash("sha256").update(verifier).digest());
+	return {
+		verifier,
+		challenge
+	};
+}
+/** POST the OAuth token endpoint (form-encoded, per RFC 6749). */
+async function postToken(apiUrl, params) {
+	const res = await fetch(`${apiUrl}/oauth/token`, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(params).toString()
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new Error(`Token request failed (${res.status}): ${body}`);
+	}
+	return await res.json();
+}
+/** Register a fresh dynamic OAuth client bound to this run's loopback URI. */
+async function registerClient(apiUrl, redirectUri) {
+	const res = await fetch(`${apiUrl}/oauth/register`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			client_name: "Sequel CLI",
+			redirect_uris: [redirectUri]
+		})
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new Error(`Client registration failed (${res.status}): ${body}`);
+	}
+	const data = await res.json();
+	return data.client_id;
+}
+async function fetchWhoAmI(apiUrl, accessToken) {
+	const res = await fetch(`${apiUrl}/users/me`, { headers: { Authorization: `Bearer ${accessToken}` } });
+	if (!res.ok) throw new Error(`Failed to resolve identity (${res.status})`);
+	return await res.json();
+}
+async function fetchOrganizations(apiUrl, accessToken) {
+	const res = await fetch(`${apiUrl}/organizations`, { headers: { Authorization: `Bearer ${accessToken}` } });
+	if (!res.ok) throw new Error(`Failed to list organizations (${res.status})`);
+	const rows = await res.json();
+	return rows.map((r) => ({
+		id: r.organization.id,
+		name: r.organization.name,
+		slug: r.organization.slug,
+		role: r.role
+	}));
+}
+/**
+* Wait for the browser to hit the loopback redirect and hand back `?code&state`.
+* Resolves with the authorization code once `state` is verified.
+*/
+function waitForCallback(expectedState) {
+	let resolveCode;
+	let rejectCode;
+	const code = new Promise((resolve, reject) => {
+		resolveCode = resolve;
+		rejectCode = reject;
+	});
+	const server = createServer((req, res) => {
+		const url = new URL(req.url ?? "/", "http://127.0.0.1");
+		if (url.pathname !== "/callback") {
+			res.writeHead(404).end("Not found");
+			return;
+		}
+		const error = url.searchParams.get("error");
+		const returnedState = url.searchParams.get("state");
+		const returnedCode = url.searchParams.get("code");
+		const finish = (title, message) => {
+			res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+			res.end(`<!doctype html><html><head><title>${title}</title></head><body style="font-family:system-ui;padding:3rem;text-align:center"><h2>${title}</h2><p>${message}</p><p>You can close this tab and return to your terminal.</p></body></html>`);
+		};
+		if (error) {
+			finish("Sign-in failed", `The authorization server returned: ${error}`);
+			rejectCode(new Error(`Authorization failed: ${error}`));
+			return;
+		}
+		if (!returnedState || returnedState !== expectedState) {
+			finish("Sign-in failed", "State mismatch — possible CSRF. Please try again.");
+			rejectCode(new Error("State mismatch in OAuth callback"));
+			return;
+		}
+		if (!returnedCode) {
+			finish("Sign-in failed", "No authorization code was returned.");
+			rejectCode(new Error("Missing authorization code"));
+			return;
+		}
+		finish("Signed in to Sequel", "Authentication complete.");
+		resolveCode(returnedCode);
+	});
+	const port = new Promise((resolve, reject) => {
+		server.on("error", reject);
+		server.listen(0, "127.0.0.1", () => resolve(server.address().port));
+	});
+	return {
+		server,
+		port,
+		code
+	};
+}
+/**
+* Run the full OAuth 2.0 + PKCE loopback flow: register a client, open the
+* browser to the consent page (where the user picks an org), capture the code,
+* exchange it for an org-bound token, then cache that token keyed by its org.
+*
+* Shared by `login` and `switch` (for orgs without a cached token).
+*/
+async function runLoginFlow(options) {
+	const config = readConfig();
+	const apiUrl = resolveApiUrl(config);
+	const { verifier, challenge } = generatePkce();
+	const state = base64url(randomBytes(16));
+	const { server, port: portPromise, code: codePromise } = waitForCallback(state);
+	const port = await portPromise;
+	const redirectUri = `http://127.0.0.1:${port}/callback`;
+	try {
+		const clientId = await registerClient(apiUrl, redirectUri);
+		const authorizeUrl = new URL(`${apiUrl}/oauth/authorize`);
+		authorizeUrl.searchParams.set("client_id", clientId);
+		authorizeUrl.searchParams.set("redirect_uri", redirectUri);
+		authorizeUrl.searchParams.set("response_type", "code");
+		authorizeUrl.searchParams.set("code_challenge", challenge);
+		authorizeUrl.searchParams.set("code_challenge_method", "S256");
+		authorizeUrl.searchParams.set("state", state);
+		if (!options?.silent) open(authorizeUrl.toString()).catch(() => {});
+		process.stderr.write(`\nOpen this URL to continue:\n${authorizeUrl.toString()}\n\n`);
+		const code = await codePromise;
+		const token = await postToken(apiUrl, {
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: redirectUri,
+			client_id: clientId,
+			code_verifier: verifier
+		});
+		const me = await fetchWhoAmI(apiUrl, token.access_token);
+		const orgs = await fetchOrganizations(apiUrl, token.access_token).catch(() => config.orgs ?? []);
+		const next = {
+			...config,
+			version: 1,
+			apiUrl,
+			clientId,
+			activeOrgId: me.organizationId,
+			tokens: {
+				...config.tokens,
+				[me.organizationId]: {
+					accessToken: token.access_token,
+					refreshToken: token.refresh_token,
+					expiresAt: Date.now() + token.expires_in * 1e3
+				}
+			},
+			user: {
+				id: me.id,
+				email: me.email,
+				name: me.name
+			},
+			orgs
+		};
+		writeConfig(next);
+		return {
+			user: next.user,
+			org: orgs.find((o) => o.id === me.organizationId),
+			organizationId: me.organizationId
+		};
+	} finally {
+		server.close();
+	}
+}
+/** True when there's a cached token for the active org (cheap, non-throwing). */
+function isLoggedIn() {
+	const config = readConfig();
+	const orgId = config.activeOrgId;
+	return Boolean(orgId && config.tokens[orgId]);
+}
+/**
+* Return a valid access token for the active org, refreshing it in place when
+* expired. Throws a friendly error if there is no token or the refresh fails.
+*/
+async function getValidAccessToken() {
+	const config = readConfig();
+	const orgId = config.activeOrgId;
+	if (!orgId || !config.tokens[orgId]) throw new Error("Not logged in. Run `sequel login` first.");
+	const entry = config.tokens[orgId];
+	if (entry.expiresAt - EXPIRY_SKEW_MS > Date.now()) return {
+		token: entry.accessToken,
+		config
+	};
+	const apiUrl = resolveApiUrl(config);
+	try {
+		const refreshed = await postToken(apiUrl, {
+			grant_type: "refresh_token",
+			refresh_token: entry.refreshToken,
+			client_id: config.clientId ?? ""
+		});
+		config.tokens[orgId] = {
+			accessToken: refreshed.access_token,
+			refreshToken: refreshed.refresh_token,
+			expiresAt: Date.now() + refreshed.expires_in * 1e3
+		};
+		writeConfig(config);
+		return {
+			token: refreshed.access_token,
+			config
+		};
+	} catch {
+		throw new Error("Your session for this organization has expired. Run `sequel login` (or `sequel switch`) to sign in again.");
+	}
+}
+
+//#endregion
+//#region src/lib/api.ts
+var ApiError = class extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+		this.name = "ApiError";
+	}
+};
+/**
+* Authenticated request against the Sequel API using the active org's token.
+* Refreshes the token transparently and scopes the call to that org.
+*/
+async function request(path, options = {}) {
+	const { token, config } = await getValidAccessToken();
+	const apiUrl = resolveApiUrl(config);
+	const orgId = config.activeOrgId;
+	const orgMode = options.org ?? "query";
+	const url = new URL(`${apiUrl}${path}`);
+	if (orgMode === "query" && orgId) url.searchParams.set("organizationId", orgId);
+	for (const [k, v] of Object.entries(options.query ?? {})) if (v !== void 0) url.searchParams.set(k, v);
+	let bodyObj = options.body;
+	if ((orgMode === "organizationId" || orgMode === "organization_id") && orgId) bodyObj = {
+		...bodyObj ?? {},
+		[orgMode]: orgId
+	};
+	const headers = { Authorization: `Bearer ${token}` };
+	let body;
+	if (bodyObj !== void 0) {
+		headers["Content-Type"] = "application/json";
+		body = JSON.stringify(bodyObj);
+	}
+	const res = await fetch(url.toString(), {
+		method: options.method ?? "GET",
+		headers,
+		body
+	});
+	if (!res.ok) {
+		let message = `Request failed (${res.status})`;
+		const text$1 = await res.text().catch(() => "");
+		try {
+			const json = JSON.parse(text$1);
+			if (json.error) message = json.error;
+		} catch {
+			if (text$1) message = text$1;
+		}
+		throw new ApiError(res.status, message);
+	}
+	if (res.status === 204) return void 0;
+	const text = await res.text();
+	return text ? JSON.parse(text) : void 0;
+}
+/** The active organization id, or throws if not logged in. */
+async function activeOrgId() {
+	const { config } = await getValidAccessToken();
+	if (!config.activeOrgId) throw new Error("No active organization. Run `sequel login`.");
+	return config.activeOrgId;
+}
+function listConnectors() {
+	return request("/connectors", { org: "none" });
+}
+function listConnections() {
+	return request("/connections");
+}
+function getConnection(id) {
+	return request(`/connections/${id}`);
+}
+function deleteConnection(id) {
+	return request(`/connections/${id}`, { method: "DELETE" });
+}
+function testConnection(id) {
+	return request(`/connections/${id}/test`, {
+		method: "POST",
+		org: "organizationId"
+	});
+}
+function getConnectionConfig(id) {
+	return request(`/connections/${id}/config`);
+}
+/** Mint a connect link / create a connection for the given connector. */
+function createLink(appId, body) {
+	return request(`/link/${appId}`, {
+		method: "POST",
+		org: "none",
+		body
+	});
+}
+/**
+* Poll a connect link's status. Uses the authenticated route, which (unlike the
+* public one) reports terminal states — `completed`/`failed` — so the CLI can
+* tell when the browser flow has finished.
+*/
+function getLinkStatus(token) {
+	return request(`/link/${token}/status`, { org: "none" });
+}
+function execute(connectionId, tool, params) {
+	return request("/execute", {
+		method: "POST",
+		org: "organization_id",
+		body: {
+			connection_id: connectionId,
+			tool,
+			params
+		}
+	});
+}
+function search(useCase, connectionIds) {
+	return request("/search", {
+		method: "POST",
+		org: "organization_id",
+		body: {
+			action_info: `CLI search: ${useCase}`,
+			use_case: useCase,
+			connection_ids: connectionIds
+		}
+	});
+}
+async function createApiKey(name) {
+	const orgId = await activeOrgId();
+	return request(`/organizations/${orgId}/api-keys`, {
+		method: "POST",
+		org: "none",
+		body: { name }
+	});
+}
+
+//#endregion
+//#region src/lib/output.ts
+/** True when the user passed a global --json flag (set by index.ts). */
+let jsonMode = false;
+function setJsonMode(on) {
+	jsonMode = on;
+}
+function isJsonMode() {
+	return jsonMode;
+}
+function printJson(data) {
+	process.stdout.write(`${JSON.stringify(data, null, 2)}\n`);
+}
+function cell(value) {
+	if (value === null || value === void 0) return "";
+	if (typeof value === "object") return JSON.stringify(value);
+	return String(value);
+}
+/**
+* Render an array of records as an aligned text table. `columns` controls order
+* and which keys are shown; defaults to the union of keys in the first row.
+*/
+function renderTable(rows, columns) {
+	if (rows.length === 0) return pc.dim("(no rows)");
+	const cols = columns ?? Object.keys(rows[0]);
+	const widths = cols.map((c) => Math.max(c.length, ...rows.map((r) => cell(r[c]).length)));
+	const header = cols.map((c, i) => pc.bold(c.padEnd(widths[i]))).join("  ");
+	const sep = cols.map((_, i) => "─".repeat(widths[i])).join("  ");
+	const body = rows.map((r) => cols.map((c, i) => cell(r[c]).padEnd(widths[i])).join("  ")).join("\n");
+	return `${header}\n${pc.dim(sep)}\n${body}`;
+}
+function printTable(rows, columns) {
+	process.stdout.write(`${renderTable(rows, columns)}\n`);
+}
+function success(message) {
+	process.stdout.write(`${pc.green("✓")} ${message}\n`);
+}
+function info(message) {
+	process.stdout.write(`${message}\n`);
+}
+function fail(message) {
+	process.stderr.write(`${pc.red("✗")} ${message}\n`);
+}
+
+//#endregion
+//#region src/commands/login.ts
+async function loginCommand() {
+	p$4.intro(pc.cyan("Sign in to Sequel"));
+	p$4.log.info("Opening your browser to authorize…");
+	const res = await runLoginFlow();
+	success(`Logged in as ${pc.bold(res.user.email)}${res.org ? ` · ${pc.bold(res.org.name)}` : ""}`);
+	p$4.outro("You're all set. Try `sequel sources list` or `sequel connect`.");
+}
+
+//#endregion
+//#region src/commands/logout.ts
+async function logoutCommand() {
+	const config = readConfig();
+	if (!isLoggedIn$1(config)) {
+		info("You are not logged in.");
+		return;
+	}
+	clearConfig();
+	success("Logged out. Cached credentials removed from ~/.sequel/auth.json.");
+}
+
+//#endregion
+//#region src/commands/switch.ts
+async function switchCommand() {
+	const config = readConfig();
+	if (!isLoggedIn$1(config)) throw new Error("Not logged in. Run `sequel login` first.");
+	let orgs = config.orgs ?? [];
+	try {
+		const { token } = await getValidAccessToken();
+		orgs = await fetchOrganizations(resolveApiUrl(config), token);
+		writeConfig({
+			...readConfig(),
+			orgs
+		});
+	} catch {}
+	if (orgs.length === 0) throw new Error("No organizations available for this account.");
+	const selection = await p$3.select({
+		message: "Switch to organization",
+		options: orgs.map((o) => ({
+			value: o.id,
+			label: o.id === config.activeOrgId ? `${o.name} ${pc.dim("(current)")}` : o.name,
+			hint: config.tokens[o.id] ? o.role : "sign-in required"
+		}))
+	});
+	if (p$3.isCancel(selection)) {
+		p$3.cancel("Cancelled.");
+		return;
+	}
+	const orgId = selection;
+	const org = orgs.find((o) => o.id === orgId);
+	const fresh = readConfig();
+	if (fresh.tokens[orgId]) {
+		writeConfig({
+			...fresh,
+			activeOrgId: orgId
+		});
+		success(`Switched to ${pc.bold(org?.name ?? orgId)}.`);
+		return;
+	}
+	p$3.log.info(`You haven't authorized ${pc.bold(org?.name ?? orgId)} yet — opening your browser…`);
+	const res = await runLoginFlow();
+	success(`Switched to ${pc.bold(res.org?.name ?? res.organizationId)}.`);
+}
+
+//#endregion
+//#region src/commands/connect.ts
+const SECRET_RE = /pass|secret|token|key|connection|credential/i;
+function fieldsFor(connector) {
+	if (connector.userInputFields?.length) return connector.userInputFields;
+	const props = connector.credentialsSchema?.properties;
+	return props ? Object.keys(props) : [];
+}
+function isOAuth(connector) {
+	return Boolean(connector.configuration) || /oauth/i.test(connector.authId);
+}
+/** Poll a pending connect link until it completes or fails (or times out). */
+async function pollLink(token) {
+	const deadline = Date.now() + 5 * 6e4;
+	while (Date.now() < deadline) {
+		await new Promise((r) => setTimeout(r, 2e3));
+		let status;
+		try {
+			status = await getLinkStatus(token);
+		} catch {
+			continue;
+		}
+		if (status.status === "failed") return {
+			ok: false,
+			reason: status.reason
+		};
+		if (status.status === "success" || status.status === "completed") return { ok: true };
+	}
+	return {
+		ok: false,
+		reason: "Timed out waiting for the browser to finish."
+	};
+}
+async function connectCommand(source) {
+	const connectors = await listConnectors();
+	let connector;
+	if (source) {
+		connector = connectors.find((c) => c.id === source);
+		if (!connector) throw new Error(`Unknown connector "${source}". Available: ${connectors.map((c) => c.id).join(", ")}`);
+	} else {
+		const choice = await p$2.select({
+			message: "Which data source do you want to connect?",
+			options: connectors.slice().sort((a, b) => a.appType.localeCompare(b.appType) || a.name.localeCompare(b.name)).map((c) => ({
+				value: c.id,
+				label: c.name,
+				hint: c.appType
+			}))
+		});
+		if (p$2.isCancel(choice)) {
+			p$2.cancel("Cancelled.");
+			return;
+		}
+		connector = connectors.find((c) => c.id === choice);
+	}
+	p$2.intro(`Connect ${pc.bold(connector.name)}`);
+	if (!isOAuth(connector)) {
+		const fields = fieldsFor(connector);
+		const credentials = {};
+		for (const field of fields) {
+			const secret = SECRET_RE.test(field);
+			const value = await (secret ? p$2.password : p$2.text)({ message: field });
+			if (p$2.isCancel(value)) {
+				p$2.cancel("Cancelled.");
+				return;
+			}
+			credentials[field] = value;
+		}
+		const name = await p$2.text({
+			message: "Name for this source (optional)",
+			placeholder: connector.name
+		});
+		if (p$2.isCancel(name)) {
+			p$2.cancel("Cancelled.");
+			return;
+		}
+		const s$1 = p$2.spinner();
+		s$1.start("Validating credentials…");
+		const res$1 = await createLink(connector.id, {
+			credentials,
+			...name ? { name } : {}
+		});
+		if (res$1.status === "success") {
+			s$1.stop("Connected.");
+			success(`Created source ${pc.bold(res$1.connection.name)} (${res$1.connection.shortId}).`);
+			return;
+		}
+		s$1.stop("Continue in your browser…");
+		open(res$1.redirect_url).catch(() => {});
+		info(`Open: ${res$1.redirect_url}`);
+		const result$1 = await pollLink(res$1.link_token);
+		if (result$1.ok) success("Connected.");
+		else throw new Error(result$1.reason ?? "Connection failed.");
+		return;
+	}
+	const res = await createLink(connector.id, {});
+	if (res.status === "success") {
+		success(`Created source ${pc.bold(res.connection.name)} (${res.connection.shortId}).`);
+		return;
+	}
+	open(res.redirect_url).catch(() => {});
+	info(`Complete authorization in your browser:\n${res.redirect_url}`);
+	const s = p$2.spinner();
+	s.start("Waiting for you to finish in the browser…");
+	const result = await pollLink(res.link_token);
+	if (result.ok) {
+		s.stop("Connected.");
+		success("Source connected.");
+	} else {
+		s.stop("Failed.");
+		throw new Error(result.reason ?? "Connection failed.");
+	}
+}
+
+//#endregion
+//#region src/commands/sources.ts
+/** Resolve a user-supplied id (uuid or shortId) to the connection's real id. */
+async function resolveConnection(idOrShort) {
+	const all = await listConnections();
+	const match = all.find((c) => c.id === idOrShort || c.shortId === idOrShort);
+	if (!match) throw new Error(`No source found matching "${idOrShort}".`);
+	return match;
+}
+async function pickConnection(message) {
+	const all = await listConnections();
+	if (all.length === 0) {
+		info("No sources connected yet. Run `sequel connect`.");
+		return void 0;
+	}
+	const choice = await p$1.select({
+		message,
+		options: all.map((c) => ({
+			value: c.shortId,
+			label: `${c.name} (${c.shortId})`,
+			hint: c.type
+		}))
+	});
+	if (p$1.isCancel(choice)) return void 0;
+	return all.find((c) => c.shortId === choice);
+}
+function toRow(c) {
+	return {
+		id: c.shortId,
+		name: c.name,
+		type: c.type,
+		created: c.createdAt.slice(0, 10)
+	};
+}
+async function sourcesList() {
+	const connections = await listConnections();
+	if (isJsonMode()) return printJson(connections);
+	if (connections.length === 0) return info("No sources connected yet. Run `sequel connect`.");
+	printTable(connections.map(toRow), [
+		"id",
+		"name",
+		"type",
+		"created"
+	]);
+}
+async function sourcesActive() {
+	const connections = await listConnections();
+	const rows = await Promise.all(connections.map(async (c) => {
+		let status = "unknown";
+		try {
+			const t = await testConnection(c.id);
+			status = t.success ? "healthy" : "error";
+		} catch {
+			status = "error";
+		}
+		return {
+			...toRow(c),
+			status
+		};
+	}));
+	if (isJsonMode()) return printJson(rows);
+	if (rows.length === 0) return info("No sources connected yet. Run `sequel connect`.");
+	printTable(rows, [
+		"id",
+		"name",
+		"type",
+		"status",
+		"created"
+	]);
+}
+async function sourcesInfo(idOrShort) {
+	const conn = idOrShort ? await resolveConnection(idOrShort) : await pickConnection("Source to inspect");
+	if (!conn) return;
+	const full = await getConnection(conn.id);
+	let config = null;
+	try {
+		config = await getConnectionConfig(conn.id);
+	} catch {}
+	if (isJsonMode()) return printJson({
+		...full,
+		config
+	});
+	info(`${pc.bold(full.name)}  ${pc.dim(full.shortId)}`);
+	info(`type:    ${full.type}`);
+	info(`id:      ${full.id}`);
+	info(`created: ${full.createdAt}`);
+	if (config?.schemaFilters?.length) info(`schemas: ${config.schemaFilters.join(", ")}`);
+	if (config?.instructions) info(`\n${pc.dim(config.instructions)}`);
+}
+async function sourcesDelete(idOrShort) {
+	const conn = idOrShort ? await resolveConnection(idOrShort) : await pickConnection("Source to delete");
+	if (!conn) return;
+	const confirmed = await p$1.confirm({ message: `Delete ${pc.bold(conn.name)} (${conn.shortId})? This cannot be undone.` });
+	if (p$1.isCancel(confirmed) || !confirmed) {
+		info("Cancelled.");
+		return;
+	}
+	await deleteConnection(conn.id);
+	success(`Deleted ${conn.name} (${conn.shortId}).`);
+}
+
+//#endregion
+//#region src/lib/mcp-clients.ts
+const SERVER_NAME = "sequel";
+const mcpUrl = (apiUrl) => `${apiUrl.replace(/\/$/, "")}/mcp`;
+const bearer = (apiKey) => `Bearer ${apiKey}`;
+function home(opts) {
+	return opts.home ?? homedir();
+}
+function cwd(opts) {
+	return opts.cwd ?? process.cwd();
+}
+/** OS-specific application-support dir for a vendor folder. */
+function appSupport(opts, vendor) {
+	const h = home(opts);
+	switch (platform()) {
+		case "darwin": return join(h, "Library", "Application Support", vendor);
+		case "win32": return join(process.env.APPDATA ?? join(h, "AppData", "Roaming"), vendor);
+		default: return join(process.env.XDG_CONFIG_HOME ?? join(h, ".config"), vendor);
+	}
+}
+/** Read+merge+write a JSON config, preserving every other key already present. */
+function mergeJson(path, mutate) {
+	let cfg = {};
+	if (existsSync(path)) try {
+		cfg = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		cfg = {};
+	}
+	mutate(cfg);
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, `${JSON.stringify(cfg, null, 2)}\n`);
+}
+function mergeYaml(path, mutate) {
+	let cfg = {};
+	if (existsSync(path)) try {
+		cfg = YAML.parse(readFileSync(path, "utf8")) ?? {};
+	} catch {
+		cfg = {};
+	}
+	mutate(cfg);
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, YAML.stringify(cfg));
+}
+function setNested(cfg, key, value) {
+	const obj = cfg[key] ?? {};
+	obj[SERVER_NAME] = value;
+	cfg[key] = obj;
+}
+const mcpClients = [
+	{
+		slug: "claude",
+		name: "Claude Desktop",
+		scopes: ["global"],
+		describe: (o) => join(appSupport(o, "Claude"), "claude_desktop_config.json"),
+		install(o) {
+			const path = join(appSupport(o, "Claude"), "claude_desktop_config.json");
+			mergeJson(path, (cfg) => setNested(cfg, "mcpServers", {
+				url: mcpUrl(o.apiUrl),
+				headers: { Authorization: bearer(o.apiKey) }
+			}));
+			return {
+				kind: "file",
+				path
+			};
+		}
+	},
+	{
+		slug: "claude-code",
+		name: "Claude Code",
+		scopes: ["global", "local"],
+		describe: (o) => `claude mcp add --scope ${o.scope === "global" ? "user" : "local"} --transport http ${SERVER_NAME} …`,
+		install(o) {
+			return {
+				kind: "command",
+				command: "claude",
+				args: [
+					"mcp",
+					"add",
+					"--scope",
+					o.scope === "global" ? "user" : "local",
+					"--transport",
+					"http",
+					SERVER_NAME,
+					mcpUrl(o.apiUrl),
+					"--header",
+					`Authorization: ${bearer(o.apiKey)}`
+				]
+			};
+		}
+	},
+	{
+		slug: "cursor",
+		name: "Cursor",
+		scopes: ["global", "local"],
+		describe: (o) => o.scope === "global" ? join(home(o), ".cursor", "mcp.json") : join(cwd(o), ".cursor", "mcp.json"),
+		install(o) {
+			const path = o.scope === "global" ? join(home(o), ".cursor", "mcp.json") : join(cwd(o), ".cursor", "mcp.json");
+			mergeJson(path, (cfg) => setNested(cfg, "mcpServers", {
+				url: mcpUrl(o.apiUrl),
+				headers: { Authorization: bearer(o.apiKey) }
+			}));
+			return {
+				kind: "file",
+				path
+			};
+		}
+	},
+	{
+		slug: "vscode",
+		name: "VS Code",
+		scopes: ["global", "local"],
+		describe: (o) => o.scope === "global" ? join(appSupport(o, "Code"), "User", "mcp.json") : join(cwd(o), ".vscode", "mcp.json"),
+		install(o) {
+			const path = o.scope === "global" ? join(appSupport(o, "Code"), "User", "mcp.json") : join(cwd(o), ".vscode", "mcp.json");
+			mergeJson(path, (cfg) => setNested(cfg, "servers", {
+				url: mcpUrl(o.apiUrl),
+				type: "http",
+				headers: { Authorization: bearer(o.apiKey) }
+			}));
+			return {
+				kind: "file",
+				path
+			};
+		}
+	},
+	{
+		slug: "windsurf",
+		name: "Windsurf",
+		scopes: ["global"],
+		describe: (o) => join(home(o), ".codeium", "windsurf", "mcp_config.json"),
+		install(o) {
+			const path = join(home(o), ".codeium", "windsurf", "mcp_config.json");
+			mergeJson(path, (cfg) => setNested(cfg, "mcpServers", {
+				serverUrl: mcpUrl(o.apiUrl),
+				headers: { Authorization: bearer(o.apiKey) }
+			}));
+			return {
+				kind: "file",
+				path
+			};
+		}
+	},
+	{
+		slug: "zed",
+		name: "Zed",
+		scopes: ["global", "local"],
+		describe: (o) => o.scope === "global" ? join(home(o), ".config", "zed", "settings.json") : join(cwd(o), ".zed", "settings.json"),
+		install(o) {
+			const path = o.scope === "global" ? join(home(o), ".config", "zed", "settings.json") : join(cwd(o), ".zed", "settings.json");
+			mergeJson(path, (cfg) => setNested(cfg, "context_servers", {
+				url: mcpUrl(o.apiUrl),
+				settings: { headers: { Authorization: bearer(o.apiKey) } }
+			}));
+			return {
+				kind: "file",
+				path
+			};
+		}
+	},
+	{
+		slug: "codex",
+		name: "Codex",
+		scopes: ["global"],
+		describe: (o) => join(home(o), ".codex", "config.yaml"),
+		install(o) {
+			const path = join(home(o), ".codex", "config.yaml");
+			mergeYaml(path, (cfg) => setNested(cfg, "mcp_servers", {
+				url: mcpUrl(o.apiUrl),
+				headers: { Authorization: bearer(o.apiKey) }
+			}));
+			return {
+				kind: "file",
+				path
+			};
+		}
+	}
+];
+function getMcpClient(slug) {
+	return mcpClients.find((c) => c.slug === slug);
+}
+
+//#endregion
+//#region src/commands/install.ts
+async function installCommand(slugArg) {
+	p.intro(pc.cyan("Install the Sequel MCP server"));
+	if (!isLoggedIn()) {
+		p.cancel("Not logged in. Run `sequel login` first.");
+		return;
+	}
+	let slug = slugArg;
+	if (!slug) {
+		const choice = await p.select({
+			message: "Which coding agent do you want to install Sequel into?",
+			options: mcpClients.map((c) => ({
+				value: c.slug,
+				label: c.name
+			}))
+		});
+		if (p.isCancel(choice)) return p.cancel("Cancelled.");
+		slug = choice;
+	}
+	const client = getMcpClient(slug);
+	if (!client) throw new Error(`Unknown agent "${slug}". Options: ${mcpClients.map((c) => c.slug).join(", ")}`);
+	let scope = client.scopes[0];
+	if (client.scopes.length > 1) {
+		const choice = await p.select({
+			message: "Install scope",
+			options: [{
+				value: "global",
+				label: "Global",
+				hint: "available everywhere on this machine"
+			}, {
+				value: "local",
+				label: "Local",
+				hint: "this project only"
+			}].filter((o) => client.scopes.includes(o.value))
+		});
+		if (p.isCancel(choice)) return p.cancel("Cancelled.");
+		scope = choice;
+	}
+	const config = readConfig();
+	const apiUrl = resolveApiUrl(config);
+	const s = p.spinner();
+	s.start("Creating a Sequel API key for this agent…");
+	let key;
+	try {
+		({key} = await createApiKey(`Sequel CLI (${client.name})`));
+	} catch (err) {
+		s.stop("Failed to create API key.");
+		throw err;
+	}
+	s.stop("API key created.");
+	const result = client.install({
+		apiUrl,
+		apiKey: key,
+		scope
+	});
+	if (result.kind === "command") {
+		try {
+			execFileSync(result.command, result.args, { stdio: "inherit" });
+		} catch {
+			throw new Error(`Failed to run \`${result.command}\`. Make sure it's installed, or run manually:\n${result.command} ${result.args.join(" ")}`);
+		}
+		success(`Installed Sequel into ${client.name} (${scope}).`);
+	} else {
+		success(`Installed Sequel into ${client.name}.`);
+		p.log.info(`Config written to ${pc.dim(result.path)}`);
+	}
+	p.outro(`Restart ${client.name} and ask it to "list my Sequel connections" to verify.`);
+}
+
+//#endregion
+//#region src/commands/search.ts
+async function searchCommand(useCase, opts) {
+	const res = await search(useCase, opts.connection);
+	if (isJsonMode()) return printJson(res);
+	if (res.results.length === 0) {
+		info("No matching tools found across your connected sources.");
+		return;
+	}
+	for (const r of res.results) {
+		info(`\n${pc.bold(r.connection_name)} ${pc.dim(`(${r.connection_id} · ${r.app_id})`)}`);
+		if (r.instructions) info(pc.dim(r.instructions));
+		for (const tool of r.tools) {
+			info(`  ${pc.cyan(tool.tool_id)}`);
+			if (tool.relevant_tables?.length) info(`    tables: ${tool.relevant_tables.join(", ")}`);
+		}
+		info(pc.dim(`  → sequel execute ${r.connection_id} ${r.tools[0]?.tool_id ?? "<tool>"} -d '{…}'`));
+	}
+}
+
+//#endregion
+//#region src/commands/execute.ts
+async function executeCommand(connectionId, tool, opts) {
+	let params = {};
+	if (opts.data) try {
+		params = JSON.parse(opts.data);
+	} catch {
+		throw new Error("Invalid JSON passed to -d/--data.");
+	}
+	const res = await execute(connectionId, tool, params);
+	if (isJsonMode()) return printJson(res);
+	if (res.data.length === 0) {
+		info(pc.dim("(0 rows)"));
+		return;
+	}
+	printTable(res.data, res.columns.length ? res.columns : void 0);
+	info(pc.dim(`\n${res.row_count} row(s)${res.truncated ? " (truncated)" : ""}`));
+}
+
+//#endregion
+//#region src/index.ts
+const program = new Command();
+program.name("sequel").description("Sequel CLI — connect data sources and run tools from your terminal").version("0.0.0").option("--json", "output machine-readable JSON").enablePositionalOptions();
+/** Wrap a command action with shared --json handling and error reporting. */
+function action(fn) {
+	return async (...args) => {
+		if (program.opts().json) setJsonMode(true);
+		try {
+			await fn(...args);
+		} catch (err) {
+			if (err instanceof ApiError && err.status === 401) fail("Unauthorized. Run `sequel login` to sign in again.");
+			else fail(err instanceof Error ? err.message : String(err));
+			process.exitCode = 1;
+		}
+	};
+}
+program.command("login").description("Sign in to Sequel").action(action(loginCommand));
+program.command("logout").description("Sign out and remove cached credentials").action(action(logoutCommand));
+program.command("switch").description("Switch the active organization").action(action(switchCommand));
+program.command("connect").argument("[source]", "connector id (e.g. postgres); omit to choose interactively").description("Connect a new data source").action(action(connectCommand));
+const sources = program.command("sources").description("Manage connected data sources");
+sources.command("list", { isDefault: true }).description("List connected sources").action(action(sourcesList));
+sources.command("active").description("List sources with live health status").action(action(sourcesActive));
+sources.command("info").argument("[id]", "source id or short id").description("Show details for a source").action(action(sourcesInfo));
+sources.command("delete").argument("[id]", "source id or short id").description("Delete a source").action(action(sourcesDelete));
+program.command("install").argument("[agent]", "coding agent slug (e.g. cursor, claude-code)").description("Install the Sequel MCP server into a coding agent").action(action(installCommand));
+program.command("search").argument("<usecase>", "what you want to do, e.g. \"monthly revenue\"").option("-c, --connection <id...>", "limit to specific connection short ids").description("Find the right tools for a use case across your sources").action(action((usecase, opts) => searchCommand(usecase, opts)));
+program.command("execute").argument("<connection_id>", "connection short id").argument("<tool>", "tool id, e.g. postgres.query").option("-d, --data <json>", "tool input as a JSON string").description("Execute a tool against a connection").action(action((connectionId, tool, opts) => executeCommand(connectionId, tool, opts)));
+program.parseAsync(process.argv).catch((err) => {
+	fail(err instanceof Error ? err.message : String(err));
+	process.exit(1);
+});
+
+//#endregion
+//# sourceMappingURL=index.js.map