better-supabase 0.8.0 → 0.9.0

package/dist/cli/add-Bd5M6uEZ.js

@@ -0,0 +1,75 @@
+import { n as CliError } from "./errors-Caiz_0so.js";
+import { D as providerLabel, _ as providerOwnsMemberships, g as layoutFor, m as MEMBERSHIP_CLAIM_MODULES } from "./module-migration-YFFdWC5X.js";
+import { n as applyPlan } from "./files-DDvAwTko.js";
+import { n as addBlocksToJson, s as keyText, t as addBlocksToConfig } from "./config-edit-Ct1lXe8a.js";
+import { a as write, i as unlistedModuleFiles, n as nextStep } from "./write-BS6F3Yvz.js";
+import { basename, dirname } from "node:path";
+import { readFile } from "node:fs/promises";
+import { SQL_MODULES, resolveModules } from "better-supabase/sql";
+//#region src/cli/sql/add.ts
+async function addModules(config, args, names, deps) {
+	if (names.length === 0) throw new CliError("input_required", "Name at least one module.", {
+		missing: ["<module>"],
+		choices: { "<module>": Object.keys(SQL_MODULES) }
+	});
+	const unknown = names.filter((name) => !(name in SQL_MODULES));
+	if (unknown.length > 0) throw new CliError("usage", `Unknown module ${unknown.join(", ")}. Available: ${Object.keys(SQL_MODULES).join(", ")}`);
+	const owner = config.authorization && providerOwnsMemberships(config) ? providerLabel(config.authorization) : void 0;
+	const hookModules = names.filter((name) => MEMBERSHIP_CLAIM_MODULES.has(name));
+	if (owner && hookModules.length > 0 && args["allow-hook-overlap"] !== true) return {
+		code: 1,
+		error: [
+			`The access token hook of ${owner} writes the memberships claim.`,
+			`${hookModules.join(" and ")} would add a second source for it. Use the provider's hook instead,`,
+			"or pass --allow-hook-overlap to write the modules anyway."
+		].join("\n")
+	};
+	const listed = [...config.blockNames, ...names.filter((name) => !config.blockNames.includes(name))];
+	const sqlLayout = await layoutFor(config, args, listed);
+	const added = resolveModules(names, sqlLayout).map((module) => module.name);
+	const lines = await write(config, args, listed, sqlLayout, deps.now, added);
+	const pulledIn = resolveModules(names, sqlLayout).map((module) => module.name).filter((name) => MEMBERSHIP_CLAIM_MODULES.has(name) && !names.includes(name));
+	if (owner && pulledIn.length > 0) lines.push("", `${pulledIn.join(" and ")} came along as a dependency: its memberships table backs has_organization_role() and has_entitlement().`, `The hook of ${owner} still writes the memberships claim, so don't call better_supabase.membership_claims from a hook.`, "Make better_supabase.memberships one of the provider's membership sources if both should agree.");
+	const untracked = resolveModules(names, sqlLayout).map((module) => module.name).filter((name) => !config.blockNames.includes(name));
+	if (untracked.length > 0) lines.push("", ...await listInConfig(args, untracked, deps));
+	if (args["dry-run"] !== true) lines.push(...await unlistedModuleFiles(config, names, sqlLayout));
+	return {
+		code: 0,
+		output: lines.join("\n"),
+		data: {
+			added,
+			pulledIn,
+			untracked
+		},
+		next: [await nextStep(config)]
+	};
+}
+/**
+* Lists `untracked` in `blocks` of the config file, so `sql sync
+* --check` keeps them current, or prints the snippet when the file isn't a
+* literal object the edit can follow.
+*/
+async function listInConfig(args, untracked, deps) {
+	const file = deps.configFile;
+	if (file === void 0) return ["Add them to blocks in better-supabase.config.ts so `sql sync --check` keeps them current:", ...untracked.map((name) => `  ${keyText(name)}: {},`)];
+	const source = await readFile(file, "utf-8");
+	const edit = file.endsWith(".json") ? addBlocksToJson(source, untracked) : addBlocksToConfig(source, untracked);
+	if (!edit.ok) return [
+		`${basename(file)} wasn't changed: ${edit.reason}.`,
+		"Add them to blocks so `sql sync --check` keeps them current:",
+		...untracked.map((name) => `  ${keyText(name)}: {},`)
+	];
+	await applyPlan({
+		root: dirname(file),
+		regenerate: "better-supabase sql add",
+		files: [{
+			path: file,
+			contents: edit.text,
+			policy: "edit"
+		}]
+	}, { "dry-run": args["dry-run"] });
+	if (args["dry-run"] === true) return [`Would add ${untracked.join(", ")} to blocks in ${basename(file)}.`];
+	return [`Added ${untracked.join(", ")} to blocks in ${basename(file)}.`];
+}
+//#endregion
+export { addModules as t };

package/dist/cli/add-CT6p5psO.js

@@ -0,0 +1 @@
+export { t as addCommand } from "./add-B0zoJUYX.js";

package/dist/cli/adopt-C9jl8z0h.js

@@ -0,0 +1 @@
+export { t as adoptCommand } from "./adopt-CebmlHL-.js";

package/dist/cli/adopt-CebmlHL-.js

@@ -0,0 +1,393 @@
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { i as plain } from "./style-2JfIPVMQ.js";
+import { n as CliError } from "./errors-Caiz_0so.js";
+import { t as display } from "./io-BiPX-_J1.js";
+import { t as toCatalog } from "./catalog-Di15TkM2.js";
+import { t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
+import { n as applyPlan, s as planResult } from "./files-DDvAwTko.js";
+import { d as setBlockInJson, u as setBlockInConfig } from "./config-edit-Ct1lXe8a.js";
+import { t as blockNames } from "./blocks-Dq25D80b.js";
+import { n as SOURCE_ARGS, r as sourceArgs } from "./source-args-0I9zylYy.js";
+import { readFile } from "node:fs/promises";
+import { SQL_MODULES, adoptedColumnProblems, adoptedTables, migrationOptionUses, moduleIdType } from "better-supabase/sql";
+import { toSnake } from "better-supabase";
+//#region src/cli/sql/adopt.ts
+/**
+* Other names apps give a logical column. They are tried after the module's
+* default name and the logical name in snake case.
+*/
+const ALIASES = {
+	tenant: [
+		"organization_id",
+		"org_id",
+		"tenant_id",
+		"workspace_id",
+		"account_id",
+		"company_id"
+	],
+	user: [
+		"user_id",
+		"profile_id",
+		"owner_id",
+		"member_id"
+	],
+	createdBy: [
+		"created_by",
+		"author_id",
+		"creator_id",
+		"owner_id"
+	],
+	rank: [
+		"position",
+		"sort_order",
+		"sort_key",
+		"order_index"
+	],
+	key: ["id", "user_id"],
+	note: ["notes", "note"]
+};
+/** The blocks with an adopt mode, in registry order. */
+function adoptableBlocks() {
+	return Object.values(SQL_MODULES).filter((module) => module.modes?.includes("adopt") === true).map((module) => module.name);
+}
+/** `schema.table` from `table` or `schema.table`; an unqualified name is in `public`. */
+function qualifiedName(name) {
+	return name.includes(".") ? name : `public.${name}`;
+}
+/** The introspected tables in the shape a proposal reads. */
+function existingTables(tables) {
+	return tables.filter((table) => table.kind === "table");
+}
+function candidates(logical, physical) {
+	const snake = toSnake(logical);
+	const singular = physical.endsWith("s") ? physical.slice(0, -1) : void 0;
+	return [
+		physical,
+		snake,
+		`${snake}_id`,
+		`${physical}s`,
+		...singular === void 0 ? [] : [singular],
+		...ALIASES[logical] ?? []
+	];
+}
+/** The logical columns of `logical` matched to the columns of `table`. */
+function matchColumns(spec, table) {
+	const names = new Set(table.columns.map((column) => column.name));
+	const used = /* @__PURE__ */ new Set();
+	const matches = [];
+	for (const physical of Object.values(spec.columns)) if (names.has(physical)) used.add(physical);
+	for (const [logical, physical] of Object.entries(spec.columns)) {
+		if (names.has(physical)) {
+			matches.push({
+				logical,
+				column: physical,
+				by: "name"
+			});
+			continue;
+		}
+		const found = candidates(logical, physical).find((name) => names.has(name) && !used.has(name)) ?? unique(table.columns.map((column) => column.name).filter((name) => name.endsWith(`_${physical}`) && !used.has(name)));
+		if (found === void 0) matches.push({
+			logical,
+			column: null,
+			by: "missing"
+		});
+		else {
+			used.add(found);
+			matches.push({
+				logical,
+				column: found,
+				by: "alias"
+			});
+		}
+	}
+	return matches;
+}
+const unique = (names) => names.length === 1 ? names[0] : void 0;
+/** The share of logical columns a table matches, so a wide table doesn't win on size. */
+const score = (matches) => matches.length === 0 ? 0 : matches.filter((match) => match.column !== null).length / matches.length;
+/**
+* The table each logical table of `block` maps to: the tables in `from`
+* go to the logical tables whose columns they match best, and the rest are
+* looked up by the module's default names in `schemas`.
+*/
+function matchTables(block, tables, from, schemas, errors) {
+	const spec = SQL_MODULES[block]?.names?.tables ?? {};
+	const byName = new Map(tables.map((table) => [`${table.schema}.${table.name}`, table]));
+	const chosen = /* @__PURE__ */ new Map();
+	for (const name of from) {
+		const table = byName.get(qualifiedName(name));
+		if (table === void 0) {
+			errors.push(`${qualifiedName(name)} is not a table in the database.`);
+			continue;
+		}
+		const best = Object.entries(spec).filter(([logical]) => !chosen.has(logical)).map(([logical, names]) => ({
+			logical,
+			score: score(matchColumns(names, table)) + (table.name === names.name ? 1 : 0)
+		})).sort((left, right) => right.score - left.score)[0];
+		if (best === void 0 || best.score === 0) {
+			errors.push(`${qualifiedName(name)} matches none of the ${block} tables (${Object.keys(spec).join(", ")}).`);
+			continue;
+		}
+		chosen.set(best.logical, table);
+	}
+	for (const [logical, table] of Object.entries(spec)) {
+		if (chosen.has(logical)) continue;
+		const found = schemas.map((schema) => byName.get(`${schema}.${table.name}`)).find((match) => match !== void 0);
+		if (found !== void 0) chosen.set(logical, found);
+		else if (table.optionalTable === true) chosen.set(logical, null);
+		else errors.push(`blocks.${block} needs a table for ${logical} (${table.name} by default) and none was found. Pass it with --tables.`);
+	}
+	return chosen;
+}
+/** A `create table` per adopted table, for `adoptedColumnProblems`. */
+const declaration = (table) => `create table ${table.schema}.${table.name} (\n${table.columns.map((column) => `  "${column.name}" ${column.udt}`).join(",\n")}\n);`;
+/** The adopt-mode entry for `block` over `tables`, and what can't map. */
+function proposeAdoption(block, tables, options = {}) {
+	const module = SQL_MODULES[block];
+	if (module?.modes?.includes("adopt") !== true) return {
+		block,
+		entry: {},
+		tables: [],
+		errors: [module === void 0 ? `${block} is not a block. See \`better-supabase blocks list\`.` : `${block} has no adopt mode. Blocks you can adopt: ${adoptableBlocks().join(", ")}.`],
+		warnings: []
+	};
+	const errors = [];
+	const spec = module.names?.tables ?? {};
+	const chosen = matchTables(block, tables, options.from ?? [], options.schemas ?? ["public"], errors);
+	const matched = [];
+	const entryTables = {};
+	const entryColumns = {};
+	let idType;
+	for (const [logical, table] of Object.entries(spec)) {
+		if (!chosen.has(logical)) continue;
+		const existing = chosen.get(logical) ?? null;
+		if (existing === null) {
+			entryTables[logical] = null;
+			matched.push({
+				logical,
+				table: null,
+				columns: []
+			});
+			continue;
+		}
+		const name = `${existing.schema}.${existing.name}`;
+		entryTables[logical] = name;
+		const columns = matchColumns(table, existing);
+		matched.push({
+			logical,
+			table: name,
+			columns
+		});
+		const mapped = {};
+		for (const match of columns) {
+			if (match.column === null) {
+				if (table.optional?.includes(match.logical) === true) mapped[match.logical] = null;
+				else errors.push(`${name} has no column for ${logical}.${match.logical} (${table.columns[match.logical]} by default). Add the column, or map blocks.${block}.columns.${logical}.${match.logical} to the one that holds it.`);
+				continue;
+			}
+			if (match.column !== table.columns[match.logical]) mapped[match.logical] = match.column;
+			if (match.logical === "tenant" && idType === void 0) {
+				const udt = existing.columns.find((column) => column.name === match.column)?.udt;
+				const type = udt === void 0 ? void 0 : moduleIdType(udt);
+				if (type !== void 0 && type !== "uuid") idType = type;
+			}
+		}
+		if (Object.keys(mapped).length > 0) entryColumns[logical] = mapped;
+	}
+	const current = options.blocks?.[block];
+	const entry = {
+		...current,
+		mode: "adopt",
+		tables: entryTables,
+		...Object.keys(entryColumns).length > 0 ? { columns: entryColumns } : {},
+		...idType === void 0 || current?.idType !== void 0 ? {} : { idType }
+	};
+	const warnings = [];
+	if (errors.length === 0) {
+		const blocks = {
+			...options.blocks,
+			[block]: entry
+		};
+		try {
+			adoptedTables(blocks);
+			const adopted = [...chosen.values()].filter((table) => table !== null);
+			errors.push(...adoptedColumnProblems(blocks, adopted.map((table) => ({ text: declaration(table) })), [...new Set(adopted.map((table) => table.schema))]));
+		} catch (error) {
+			errors.push(error instanceof Error ? error.message : String(error));
+		}
+		warnings.push(...migrationOptionUses({ [block]: entry }).map((use) => use.message));
+	}
+	return {
+		block,
+		entry,
+		tables: matched,
+		errors,
+		warnings
+	};
+}
+/**
+* Whether one of `block`'s logical tables has an existing table under its
+* default name, so `apply --adopt` proposes adopting the block.
+*/
+function hasDefaultTable(block, tables, schemas = ["public"]) {
+	const names = new Set(Object.values(SQL_MODULES[block]?.names?.tables ?? {}).map((table) => table.name));
+	return tables.some((table) => names.has(table.name) && schemas.includes(table.schema));
+}
+/** The proposal as lines: each table and column, then the errors and warnings. */
+function describeProposal(proposal) {
+	const lines = [];
+	for (const table of proposal.tables) {
+		lines.push(`  ${table.logical}: ${table.table ?? "null (not in the app)"}`);
+		const width = Math.max(0, ...table.columns.map((c) => c.logical.length));
+		for (const column of table.columns) {
+			const target = column.column === null ? "null (not in the table)" : column.by === "alias" ? `${column.column} (guessed)` : column.column;
+			lines.push(`    ${column.logical.padEnd(width)}  ${target}`);
+		}
+	}
+	for (const error of proposal.errors) lines.push(`  error  ${error}`);
+	for (const warning of proposal.warnings) lines.push(`  warn   ${warning}`);
+	return lines;
+}
+//#endregion
+//#region src/cli/commands/adopt.ts
+const ADOPT_ARGS = {
+	block: {
+		type: "positional",
+		required: false,
+		description: "The block to adopt existing tables for"
+	},
+	tables: {
+		type: "string",
+		description: "The existing tables, as table or schema.table; the block's other tables are looked up by their default names",
+		valueHint: "schema.table,..."
+	},
+	"dry-run": {
+		type: "boolean",
+		description: "Show the proposed mapping and the config diff, and write nothing"
+	},
+	check: {
+		type: "boolean",
+		description: "Write nothing; exit 1 with the diff when the config lacks this mapping"
+	}
+};
+/** The schemas searched for a block's default table names. */
+const adoptSchemas = (config) => [.../* @__PURE__ */ new Set(["public", ...config.schemas])];
+/** `source` with `blocks.<block>` set to the proposal's entry. */
+function withAdoptedBlock(file, source, proposal) {
+	return file.endsWith(".json") ? setBlockInJson(source, proposal.block, proposal.entry) : setBlockInConfig(source, proposal.block, proposal.entry);
+}
+/** The tables `loadSnapshot` reads, for the adopt commands. */
+function snapshotTables(config, env, source) {
+	return async () => existingTables(toCatalog(await loadSnapshot(config, env, source)).tables);
+}
+/**
+* Proposes `blocks.<block>` in adopt mode over existing tables, reports what
+* can't map, and writes the entry to the config when everything maps.
+*/
+async function runAdopt(config, args, deps) {
+	const block = args.block;
+	if (block === void 0) throw new CliError("usage", "Name the block to adopt, e.g. `better-supabase adopt teams --tables public.teams`.");
+	const proposal = proposeAdoption(block, await deps.tables(), {
+		from: list(args.tables),
+		blocks: config.blocks,
+		schemas: adoptSchemas(config)
+	});
+	const lines = [`Adopting ${block}:`, ...describeProposal(proposal)];
+	const data = {
+		block,
+		entry: proposal.entry,
+		tables: proposal.tables,
+		errors: proposal.errors,
+		warnings: proposal.warnings
+	};
+	if (proposal.errors.length > 0) return {
+		code: 1,
+		output: lines.join("\n"),
+		error: `blocks.${block} wasn't written: fix what the report lists, then run adopt again.`,
+		data: {
+			...data,
+			written: false
+		}
+	};
+	const file = deps.configFile;
+	if (file === void 0) {
+		lines.push("", `No config file: add this to blocks yourself.`, `${block}: ${JSON.stringify(proposal.entry, null, 2)}`);
+		return {
+			code: 0,
+			output: lines.join("\n"),
+			data: {
+				...data,
+				written: false
+			}
+		};
+	}
+	const edit = withAdoptedBlock(file, await readFile(file, "utf-8"), proposal);
+	const shown = display(config.root, file);
+	if (!edit.ok) return {
+		code: 1,
+		output: lines.join("\n"),
+		error: `${shown} wasn't changed: ${edit.reason}. Set blocks.${block} in it yourself.`,
+		data: {
+			...data,
+			written: false
+		}
+	};
+	const paint = deps.paint ?? plain;
+	const plan = {
+		root: config.root,
+		regenerate: "better-supabase adopt",
+		files: [{
+			path: file,
+			contents: edit.text,
+			policy: "edit"
+		}]
+	};
+	const applied = await applyPlan(plan, args, paint);
+	if (applied.mode === "check") return planResult(plan, applied, { data: {
+		...data,
+		written: false
+	} });
+	if (applied.drift) lines.push("", ...applied.diffs);
+	if (applied.mode === "dry-run" || !applied.drift) {
+		lines.push("", applied.drift ? "Dry run: nothing written. Run without --dry-run to write it." : `${shown} already holds this mapping.`);
+		return {
+			code: 0,
+			output: lines.join("\n"),
+			data: {
+				...data,
+				written: false
+			}
+		};
+	}
+	lines.push("", `Updated ${shown}. Run \`better-supabase sql sync\` to write the block's module over these tables.`);
+	return {
+		code: 0,
+		output: lines.join("\n"),
+		data: {
+			...data,
+			written: true
+		}
+	};
+}
+const adoptCommand = defineCliCommand({
+	meta: commandMeta("adopt"),
+	args: {
+		...ADOPT_ARGS,
+		...SOURCE_ARGS
+	},
+	lists: ["tables"],
+	completions: { block: blockNames },
+	run: async (args, { config, configFile, env, io, log, paint, signal }) => {
+		const tables = snapshotTables(config, env, {
+			...await sourceArgs(args, io),
+			...signal ? { signal } : {}
+		});
+		return runAdopt(config, args, {
+			paint,
+			tables: () => log.progress("Reading the schema", tables),
+			...configFile === void 0 ? {} : { configFile }
+		});
+	}
+});
+//#endregion
+export { withAdoptedBlock as a, hasDefaultTable as c, snapshotTables as i, proposeAdoption as l, adoptSchemas as n, adoptableBlocks as o, runAdopt as r, describeProposal as s, adoptCommand as t };

package/dist/cli/agent-CCt_aXpJ.js

@@ -0,0 +1,176 @@
+import { n as CliError } from "./errors-Caiz_0so.js";
+import { r as redactUrl, t as isSecretKey } from "./redact-PjNswZOs.js";
+import { t as commandLine } from "./shell-Btv_4Yhe.js";
+import { createHash } from "node:crypto";
+//#region src/cli/core/agent.ts
+/**
+* Agent mode: who runs the CLI, and what an agent gets back when a person
+* has to act. Detection reads only the environment `run()` is given and the
+* probe, never `process`, so tests and embedders stay pure. The signals
+* follow `@vercel/detect-agent`, which `tests/cli/core/agent.test.ts` checks.
+*/
+const DEVIN_PATH = "/opt/.devin";
+/** The name used when agent mode is forced on and nothing is detected. */
+const UNKNOWN_AGENT = "agent";
+const set = (value) => value !== void 0 && value !== "";
+/**
+* The coding agent running the CLI, or `undefined` for a person. Cursor sets
+* `CURSOR_TRACE_ID` in a person's terminal too, so it counts only when
+* stdout is not a terminal.
+*/
+function detectAgent(env, probe) {
+	const named = env["AI_AGENT"]?.trim();
+	if (named) return named === "github-copilot-cli" ? "github-copilot" : named;
+	const found = [
+		[set(env["CURSOR_TRACE_ID"]) && !probe.stdoutIsTty, "cursor"],
+		[set(env["CURSOR_AGENT"]) || env["CURSOR_EXTENSION_HOST_ROLE"] === "agent-exec", "cursor-cli"],
+		[set(env["GEMINI_CLI"]), "gemini"],
+		[set(env["CODEX_SANDBOX"]) || set(env["CODEX_CI"]) || set(env["CODEX_THREAD_ID"]), "codex"],
+		[set(env["ANTIGRAVITY_AGENT"]), "antigravity"],
+		[set(env["AUGMENT_AGENT"]), "augment-cli"],
+		[set(env["OPENCODE_CLIENT"]), "opencode"],
+		[(set(env["CLAUDECODE"]) || set(env["CLAUDE_CODE"])) && set(env["CLAUDE_CODE_IS_COWORK"]), "cowork"],
+		[set(env["CLAUDECODE"]) || set(env["CLAUDE_CODE"]), "claude"],
+		[set(env["REPL_ID"]), "replit"],
+		[set(env["COPILOT_MODEL"]) || set(env["COPILOT_ALLOW_ALL"]) || set(env["COPILOT_GITHUB_TOKEN"]), "github-copilot"]
+	].find(([matches]) => matches);
+	if (found) return found[1];
+	return probe.exists(DEVIN_PATH) ? "devin" : void 0;
+}
+const SETTINGS = {
+	auto: "auto",
+	yes: "yes",
+	true: "yes",
+	"1": "yes",
+	no: "no",
+	false: "no",
+	"0": "no"
+};
+function settingOf(value, source) {
+	const setting = SETTINGS[value.trim().toLowerCase()];
+	if (!setting) throw new CliError("invalid_value", `${source} takes auto, yes or no, got "${value}".`, source.startsWith("--") ? { flag: source } : {});
+	return setting;
+}
+/** The agent in agent mode, or `undefined`: `--agent`, then `$BETTER_SUPABASE_AGENT`, then detection. */
+function resolveAgent(flag, env, probe) {
+	const fromEnv = env["BETTER_SUPABASE_AGENT"];
+	const setting = flag === void 0 ? fromEnv === void 0 || fromEnv === "" ? "auto" : settingOf(fromEnv, "$BETTER_SUPABASE_AGENT") : settingOf(flag, "--agent");
+	switch (setting) {
+		case "no": return;
+		case "yes": return detectAgent(env, probe) ?? UNKNOWN_AGENT;
+		case "auto": return detectAgent(env, probe);
+		default: return setting;
+	}
+}
+/** The bin `next` commands start with: the package name, since `npx bsb` fetches an unrelated package. */
+const NEXT_BIN = "better-supabase";
+/** `argv` without `--name value` and `--name=value`, before any `--`. */
+function withoutOption(argv, name) {
+	const out = [];
+	for (let index = 0; index < argv.length; index += 1) {
+		const arg = argv[index] ?? "";
+		if (arg === "--") {
+			out.push(...argv.slice(index));
+			break;
+		}
+		if (arg === name) index += 1;
+		else if (!arg.startsWith(`${name}=`)) out.push(arg);
+	}
+	return out;
+}
+/**
+* `argv` safe to print: a secret-looking flag becomes its `--*-stdin`
+* form, and a URL loses its password.
+*/
+function shareable(argv) {
+	const out = [];
+	for (let index = 0; index < argv.length; index += 1) {
+		const arg = argv[index] ?? "";
+		const name = arg.startsWith("--") ? arg.slice(2).split("=")[0] : void 0;
+		if (name !== void 0 && !name.endsWith("-stdin") && isSecretKey(name)) {
+			out.push(`--${name}-stdin`);
+			if (!arg.includes("=")) index += 1;
+		} else out.push(/^[a-z][a-z\d+.-]*:\/\//i.test(arg) ? redactUrl(arg) : arg);
+	}
+	return out;
+}
+/** `argv` as the command to run next, with `extra` before any `--`. */
+function nextCommand(argv, extra) {
+	const words = shareable(argv);
+	const end = words.indexOf("--");
+	return commandLine(end === -1 ? [
+		NEXT_BIN,
+		...words,
+		...extra
+	] : [
+		NEXT_BIN,
+		...words.slice(0, end),
+		...extra,
+		...words.slice(end)
+	]);
+}
+/**
+* The step that answers an `input_required` error: the run again with the
+* first choice of each missing flag or `<positional>` (or a placeholder) and
+* `--yes`.
+*/
+function missingInputNext(argv, missing, choices = {}) {
+	const filled = missing.flatMap((name) => name.startsWith("<") ? [choices[name]?.[0] ?? name] : [name, choices[name]?.[0] ?? `<${name.replace(/^-+/, "")}>`]);
+	const yes = argv.includes("--yes") || argv.includes("-y") ? [] : ["--yes"];
+	return {
+		command: nextCommand(argv, [...filled, ...yes]),
+		when: missing.length === 1 && (choices[missing[0] ?? ""]?.length ?? 0) > 1 ? `with the value the user picks from choices["${missing[0] ?? ""}"]` : "with the values the user gives"
+	};
+}
+/** The token for one request on one command line, so a consent covers only that run. */
+function consentToken(argv, request) {
+	return createHash("sha256").update(JSON.stringify([
+		request.effect,
+		request.detail,
+		withoutOption(argv, "--confirm")
+	])).digest("hex").slice(0, 16);
+}
+/**
+* Nothing when `confirm` is the request's token, else a `consent_required`
+* error with the token and the command to run once the user agrees.
+*/
+function checkConsent(argv, request, confirm) {
+	const token = consentToken(argv, request);
+	if (confirm === token) return;
+	const stale = confirm === void 0 ? "" : " The --confirm token is for another command or another target.";
+	throw new CliError("consent_required", `${request.detail}. Ask the user first, then run again with --confirm ${token}.${stale}`, {
+		token,
+		next: [{
+			command: nextCommand(withoutOption(argv, "--confirm"), ["--confirm", token]),
+			when: "after the user agrees"
+		}]
+	});
+}
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"[::1]",
+	"0.0.0.0",
+	"host.docker.internal"
+]);
+/** Whether a connection string points at this machine, like the local stack. */
+function isLocalDatabaseUrl(url) {
+	try {
+		const { hostname } = new URL(url);
+		return hostname === "" || LOCAL_HOSTS.has(hostname.toLowerCase());
+	} catch {
+		return false;
+	}
+}
+/** The host a connection string points at, without credentials. */
+function databaseHost(url) {
+	try {
+		const { host } = new URL(url);
+		return host === "" ? "a local socket" : host;
+	} catch {
+		return "the database";
+	}
+}
+//#endregion
+export { resolveAgent as a, missingInputNext as i, databaseHost as n, isLocalDatabaseUrl as r, checkConsent as t };