ekwo-os 0.4.1

package/dist/checklist.js

@@ -0,0 +1,64 @@
+/**
+ * The four things an operator has to do on their own Supabase project, which
+ * no installer can do for them.
+ *
+ * Three of the four are settings of the project rather than of the database —
+ * whether strangers may sign themselves up, who holds the `service_role` key —
+ * and a connection string reaches none of them. The fourth is a piece of
+ * reading. So they are printed at the end of a successful `ekwo init`, where
+ * the person running it still has the dashboard open, and they are written in
+ * the installation documentation in the same words.
+ *
+ * `ekwo doctor` does not check them, and says nothing about them: it holds a
+ * database connection, and the answers are not in the database. The day the
+ * CLI accepts a Supabase management token it could ask the API instead, and
+ * that is a phase 1 question with an obvious cost — a token that can read a
+ * project's settings can change them.
+ */
+import { bold, dim, heading, line, note } from './ui.js';
+/**
+ * Kept as data rather than as four calls to `line()` so that a test can read
+ * them, and so the documentation and the terminal cannot drift into saying
+ * different things.
+ */
+export const OPERATOR_CHECKLIST = [
+    {
+        instruction: 'Turn off self sign-up on your project.',
+        because: 'Supabase dashboard → Authentication → Sign In / Providers → "Allow new users to sign up". ' +
+            'An Ekwo installation is closed: the people who keep the books are invited to it, ' +
+            'and a stranger who signs themselves up is a row in auth.users nobody asked for.',
+    },
+    {
+        instruction: 'Keep two administrators.',
+        because: 'An administrator invites the others and claims the instance. One lost account, ' +
+            'one person on holiday, and a set of books has nobody who can let anyone in.',
+    },
+    {
+        instruction: 'Keep the service_role key off every machine that does not need it.',
+        because: 'It bypasses row level security completely: it is not an administrator, it is the ' +
+            'absence of a door. This installer reads it from a flag or a prompt, uses it to create ' +
+            'the first account, and writes it nowhere.',
+    },
+    {
+        instruction: 'Read DISCLAIMER.md before you file anything.',
+        because: 'A country pack is a reading of a country\'s rules at the date of its version, not a ' +
+            'legal opinion, and the golden test proves that a pack agrees with itself rather than ' +
+            'with the law. The books are yours, in every country where you file.',
+    },
+];
+/**
+ * Prints the checklist. Called at the end of a successful installation, and
+ * exported so a test can read what it writes.
+ */
+export function printOperatorChecklist() {
+    heading('Four things on your project, which this installer cannot do for you');
+    for (const [index, item] of OPERATOR_CHECKLIST.entries()) {
+        line();
+        line(`  ${bold(`${index + 1}.`)} ${item.instruction}`);
+        line(`     ${dim(item.because)}`);
+    }
+    line();
+    note(dim('None of these is something Ekwo does to your project. It is your project: ' +
+        'the settings are yours to change and the key is yours to hold.'));
+}
+//# sourceMappingURL=checklist.js.map

package/dist/checklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checklist.js","sourceRoot":"","sources":["../src/checklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AASzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE;QACE,WAAW,EAAE,wCAAwC;QACrD,OAAO,EACL,4FAA4F;YAC5F,mFAAmF;YACnF,iFAAiF;KACpF;IACD;QACE,WAAW,EAAE,0BAA0B;QACvC,OAAO,EACL,iFAAiF;YACjF,6EAA6E;KAChF;IACD;QACE,WAAW,EAAE,oEAAoE;QACjF,OAAO,EACL,mFAAmF;YACnF,wFAAwF;YACxF,2CAA2C;KAC9C;IACD;QACE,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EACL,sFAAsF;YACtF,uFAAuF;YACvF,qEAAqE;KACxE;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,qEAAqE,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,EAAE,CAAC;QACP,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,EAAE,CAAC;IACP,IAAI,CACF,GAAG,CACD,4EAA4E;QAC1E,gEAAgE,CACnE,CACF,CAAC;AACJ,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The command line itself: parse and dispatch. What a command answers and
+ * which exit code it ends on is `output.ts`, for every command at once.
+ */
+import { type InitDeps } from './commands/init.js';
+import { type LoginDeps } from './commands/login.js';
+import type { BooksDeps } from './books.js';
+export declare function version(): string;
+export declare const COMMANDS: readonly ["init", "migrate", "status", "doctor", "module", "pack", "company", "register", "unregister", "demo", "login", "logout", "use", "whoami", "contact", "invoice", "post", "payment", "match", "doc"];
+/** What a test may hand a command instead of the network, the disk and the environment. */
+export type RunDeps = InitDeps & LoginDeps & BooksDeps;
+export declare function help(): string;
+export declare function run(argv: string[], deps?: RunDeps): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAA+B,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAQlF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,wBAAgB,OAAO,IAAI,MAAM,CAQhC;AAED,eAAO,MAAM,QAAQ,8MAqBX,CAAC;AAEX,2FAA2F;AAC3F,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEvD,wBAAgB,IAAI,IAAI,MAAM,CAuL7B;AAED,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,OAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA4E7E"}

package/dist/cli.js

@@ -0,0 +1,318 @@
+/**
+ * The command line itself: parse and dispatch. What a command answers and
+ * which exit code it ends on is `output.ts`, for every command at once.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { UsageError, boolFlag, parseArgs } from './args.js';
+import { companyCommand } from './commands/company.js';
+import { contactCommand } from './commands/contact.js';
+import { demoCommand } from './commands/demo.js';
+import { docCommand, invoiceCommand, postCommand } from './commands/document.js';
+import { doctorCommand } from './commands/doctor.js';
+import { initCommand } from './commands/init.js';
+import { loginCommand, logoutCommand } from './commands/login.js';
+import { migrateCommand } from './commands/migrate.js';
+import { moduleCommand } from './commands/module.js';
+import { packCommand } from './commands/pack.js';
+import { matchCommand, paymentCommand } from './commands/payment.js';
+import { registerCommand, unregisterCommand } from './commands/register.js';
+import { statusCommand } from './commands/status.js';
+import { useCommand, whoamiCommand } from './commands/whoami.js';
+import { askedForJson, commandLabel, execute, reportFailure, setResult } from './output.js';
+import { bold, cyan, dim, line } from './ui.js';
+export function version() {
+    try {
+        const path = fileURLToPath(new URL('../package.json', import.meta.url));
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return parsed.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+export const COMMANDS = [
+    'init',
+    'migrate',
+    'status',
+    'doctor',
+    'module',
+    'pack',
+    'company',
+    'register',
+    'unregister',
+    'demo',
+    'login',
+    'logout',
+    'use',
+    'whoami',
+    'contact',
+    'invoice',
+    'post',
+    'payment',
+    'match',
+    'doc',
+];
+export function help() {
+    return `${bold('ekwo')} — install and operate Ekwo OS on a Supabase project you own.
+
+${bold('Usage')}
+  npx ekwo-os <command> [options]
+
+${bold('Commands')}
+  ${cyan('init')}        Apply the schema, seed the reference data, create the first
+              administrator and the first company, on a project you already have.
+  ${cyan('migrate')}     Apply the migrations this release adds, and show the gap first.
+  ${cyan('status')}      Schema version installed against available, the instance,
+              its administrators and its companies.
+  ${cyan('doctor')}      Check what the schema cannot enforce on its own: row level
+              security everywhere, no pending migration, no membership pointing
+              at a deleted user, statements that tie to their lines.
+  ${cyan('module')}      The modules beside the socle: what is installed, apply their
+              migrations, and turn one on or off for a company.
+  ${cyan('pack')}        Compile a country pack into its seed, check that the committed
+              seed is still the exact output of the pack, and move a company
+              onto the version an installation holds.
+  ${cyan('company')}     One company leaves an installation with its books, as an archive
+              anybody can read, and arrives in another one alive.
+  ${cyan('register')}    Opt in to security advisories and release notes. Never required.
+  ${cyan('unregister')}  Opt back out. Clears the address and the date.
+  ${cyan('demo')}        Load the sample company. Fictional data; ask for it explicitly.
+
+  ${cyan('login')}       Sign in to an instance as yourself and keep the session, in your
+              own configuration directory and never in a repository.
+  ${cyan('logout')}      End that session, here and on the instance.
+  ${cyan('use')}         Pick the company the next commands run on.
+  ${cyan('whoami')}      Who you are on which instance, the companies you can see, and
+              what you may do on the one in use.
+
+${bold('Connecting')} ${dim('(every command)')}
+  --db-url <url>            Postgres connection string. Supabase dashboard →
+                            Project Settings → Database. The reliable way.
+  --project-ref <ref>       With --db-password, the host is guessed from the ref.
+  --db-password <password>  Database password. Prompted, masked, if omitted.
+  --db-region <region>      Use the pooler in this region, e.g. eu-central-1.
+  --supabase-url <url>      https://<ref>.supabase.co — needed to create a user.
+  --service-role-key <key>  Project Settings → API. Needed to create a user.
+
+  ${cyan('contact')}     add <name> | list — the people and companies the books name.
+  ${cyan('invoice')}     new | line add <document> — a draft and its lines. Any kind of
+              document, with --type; a draft books nothing.
+  ${cyan('post')}        <document> — book it, through post_document(). --dry-run shows
+              the entry the database would write, and writes nothing.
+  ${cyan('payment')}     record — money in or out, booked and matched.
+  ${cyan('match')}       <bank transaction> <document> — a statement line pays a document.
+  ${cyan('doc')}         list | show <document> — what exists, and what is still owed.
+
+${bold('Acting as a person')} ${dim('(login … whoami, and every verb that keeps books — never a service_role key)')}
+  --profile <name>          Which profile: a demo instance, production, one client
+                            of a firm. Defaults to the one last signed in to.
+  --company <name|id>       The company for this one command, over the one in use.
+  --supabase-url <url>      ${dim('login')}  https://<ref>.supabase.co. Read from ekwo.json
+                            when the working directory has one.
+  --anon-key <key>          ${dim('login')}  The publishable key. Project Settings → API.
+  --email <address>         ${dim('login')}  Who signs in.
+  --password <password>     ${dim('login')}  Prompted, masked, if omitted. Sent to the
+                            instance once and never written to disk.
+
+${bold('Keeping books')} ${dim('(each verb is one function the MCP server calls too; no rule lives here)')}
+  --ref <reference>         On what creates — contact add, invoice new, payment
+                            record. Your own reference: the same one a second
+                            time returns what the first created, and creates
+                            nothing. Pass it whenever a call might be repeated.
+  --stdin                   Read one JSON document on the standard input, with
+                            the fields of the MCP tool of the same meaning.
+                            The form that is authoritative; flags beside it win.
+  --line "k=v,k=v"          invoice new, repeatable. Keys: name, price, qty,
+                            account, tax, product, unit, discount, description.
+                            Codes, never rates; a comma in a value is \\,.
+  --dry-run                 post. Ask the database what it would write.
+  <document>                Its id, its number, or the --ref it was created under.
+  Amounts are decimal strings, in and out: 1500.00. Nothing is computed here.
+
+${bold('Output')} ${dim('(every command)')}
+  --json                    One JSON document on the standard output, and the
+                            prose on the standard error. Never asks a question.
+                            The shape is packages/cli/schema/output.1.json.
+  --yes, -y                 Never ask a question, in either form.
+
+  Exit codes: 0 done · 1 it failed, or a check found something · 2 the command
+  was called wrong · 3 the database refused — a locked period, a capability
+  you do not hold. The refusal is printed as the database wrote it.
+
+${bold('ekwo init')}
+  --country <cc>            Which pack: its chart of accounts and its VAT rules.
+                            Required unless the terminal can ask, which lists
+                            the packs this installation holds, by name.
+  --org <name>              Your organisation. Written on the instance row.
+  --company <name>          The first company. Defaults to --org.
+  --admin-email <address>   The first administrator, created in your Supabase Auth.
+  --admin-password <pw>     Their password. Omitted: an invite link is generated.
+  --admin-user-id <uuid>    Use an account that already exists instead.
+  --fiscal-year <year>      Calendar year the first financial year opens in.
+                            Defaults to this year.
+  --fiscal-year-start <d>   First day of it, as YYYY-MM-DD. Defaults to the
+                            month the country pack opens a year on; required
+                            when the pack names none.
+  --language <xx>           Language of the books. Defaults to the country pack's.
+  --vat-period <cadence>    How often the company files its VAT return: month,
+                            quarter or year. Asked when the country's form
+                            offers several and the law proposes none.
+  --filing-period <c>=<p>   The same, for any declaration the country files, by
+                            the code of its form. Repeatable, one per
+                            declaration: a company files its return and its
+                            recapitulative statement on cadences of their own.
+  --demo                    Also load the sample company.
+  --register                Register without being asked. --register-email sets
+                            the address; otherwise --admin-email is used.
+  --yes, -y                 Never ask a question. Everything must come from
+                            flags or the environment.
+
+${bold('ekwo module')}
+  list                      What this release carries, and what the database holds.
+  migrate [<cc>]            Apply the module migrations and their country seeds.
+  enable <code> --company   Turn a module on for a company. Prints the schema to
+                            add to the project's exposed schemas, which no
+                            migration can do.
+  disable <code> --company  Turn it off. Nothing the module wrote is deleted.
+
+${bold('ekwo pack')} ${dim('(build, check and list need a checkout of the repository)')}
+  build <cc> | --all        Compile packs/<cc> into supabase/seed/.
+  check <cc> | --all        Refuse a seed that is not the output of its pack.
+  list                      The packs this checkout carries.
+  status                    What each company copied, against what is loaded on
+                            the installation this connects to. Read-only.
+  upgrade <company>         Move it to the version loaded there. An addition and
+                            a closed validity are applied; everything else is
+                            listed and left alone until --apply.
+
+${bold('ekwo company')}
+  export <company> --out <dir>
+                            Write the archive of one company: manifest.json and
+                            one data/<table>.jsonl per table. Read as a member
+                            who holds company.export (--as-user, an owner by
+                            default), under row level security.
+  import <dir>              Take an archive in, whole or not at all. The
+                            installer or an administrator of the installation
+                            (--as-user); --owner names the first owner. A
+                            company already here is refused.
+
+${bold('Environment')}
+  EKWO_DB_URL               Same as --db-url. SUPABASE_DB_URL also works.
+  EKWO_DB_PASSWORD          Same as --db-password.
+  SUPABASE_URL              Same as --supabase-url.
+  SUPABASE_SERVICE_ROLE_KEY Same as --service-role-key.
+  SUPABASE_ANON_KEY         Same as --anon-key.
+  EKWO_EMAIL, EKWO_PASSWORD Sign in for this one command. With SUPABASE_URL and
+                            SUPABASE_ANON_KEY they come before any profile, and
+                            nothing is read from or written to the disk: a CI job.
+  EKWO_ACCESS_TOKEN         The same, with a session token already in hand.
+  EKWO_PROFILE              Same as --profile.
+  EKWO_CONFIG_DIR           Where profiles and sessions are kept. Defaults to
+                            $XDG_CONFIG_HOME/ekwo, else ~/.config/ekwo.
+  EKWO_REGISTRY_URL         Where registrations are announced.
+  NO_COLOR                  Plain output.
+
+${bold('What this CLI does not do')}
+  It does not create or pay for a Supabase project. You create one — the free
+  plan is enough — and the CLI connects to it. Your data is on your account
+  from the first row, and there is nothing for us to hold back.
+
+  It never writes a password or a key to disk. The database password and the
+  service_role key are read from a flag, the environment or a masked prompt,
+  used, and forgotten. ${cyan('ekwo.json')} holds the project URL, the country and the
+  schema version, and nothing else. The one thing kept is the session
+  ${cyan('ekwo login')} obtains, in your own configuration directory, readable by you
+  alone, and refused anywhere inside a repository.
+
+  It never keeps books with a service_role key. ${cyan('init')} and ${cyan('migrate')} install,
+  as the owner of the database, and say so; everything else that touches a
+  ledger acts as the person signed in, under row level security.
+
+  There is no ${cyan('eject')} command, because there is nothing to eject from. The
+  schema is in your database, the migrations are in this repository under
+  AGPL-3.0, and ${cyan('supabase db push')} applies them without this CLI ever running
+  again — the migration history is the one the Supabase CLI writes.
+
+${bold('Docs')}  https://github.com/Ekwo-ai/ekwo-os
+`;
+}
+export async function run(argv, deps = {}) {
+    let args;
+    try {
+        args = parseArgs(argv);
+    }
+    catch (error) {
+        return reportFailure('ekwo', askedForJson(argv), error);
+    }
+    let json;
+    try {
+        json = boolFlag(args, 'json');
+    }
+    catch (error) {
+        return reportFailure(commandLabel(args), false, error);
+    }
+    return execute(args, json, async () => {
+        if (args.flags.get('version') === true && args.command === undefined) {
+            setResult({ version: version() });
+            line(version());
+            return 0;
+        }
+        if (args.command === undefined || args.command === 'help' || args.flags.get('help') === true) {
+            if (args.command !== undefined && args.command !== 'help' && !isKnown(args.command)) {
+                throw new UsageError(`unknown command: ${args.command}`);
+            }
+            setResult({ version: version(), commands: [...COMMANDS] });
+            line(help().trimEnd());
+            return 0;
+        }
+        switch (args.command) {
+            case 'init':
+                return await initCommand(args, deps);
+            case 'migrate':
+                return await migrateCommand(args, deps);
+            case 'status':
+                return await statusCommand(args, deps);
+            case 'doctor':
+                return await doctorCommand(args, deps);
+            case 'module':
+                return await moduleCommand(args, deps);
+            case 'pack':
+                return await packCommand(args, deps);
+            case 'company':
+                return await companyCommand(args, deps);
+            case 'register':
+                return await registerCommand(args, deps);
+            case 'unregister':
+                return await unregisterCommand(args, deps);
+            case 'demo':
+                return await demoCommand(args, deps);
+            case 'login':
+                return await loginCommand(args, deps);
+            case 'logout':
+                return await logoutCommand(args, deps);
+            case 'use':
+                return await useCommand(args, deps);
+            case 'whoami':
+                return await whoamiCommand(args, deps);
+            case 'contact':
+                return await contactCommand(args, deps);
+            case 'invoice':
+                return await invoiceCommand(args, deps);
+            case 'post':
+                return await postCommand(args, deps);
+            case 'payment':
+                return await paymentCommand(args, deps);
+            case 'match':
+                return await matchCommand(args, deps);
+            case 'doc':
+                return await docCommand(args, deps);
+            default:
+                throw new UsageError(`unknown command: ${args.command}\nRun \`ekwo --help\` for the list.`);
+        }
+    });
+}
+function isKnown(command) {
+    return COMMANDS.includes(command);
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAmB,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAiB,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,UAAU,OAAO;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC9E,OAAO,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,MAAM;IACN,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,SAAS;IACT,UAAU;IACV,YAAY;IACZ,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,SAAS;IACT,SAAS;IACT,MAAM;IACN,SAAS;IACT,OAAO;IACP,KAAK;CACG,CAAC;AAKX,MAAM,UAAU,IAAI;IAClB,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;;EAEtB,IAAI,CAAC,OAAO,CAAC;;;EAGb,IAAI,CAAC,UAAU,CAAC;IACd,IAAI,CAAC,MAAM,CAAC;;IAEZ,IAAI,CAAC,SAAS,CAAC;IACf,IAAI,CAAC,QAAQ,CAAC;;IAEd,IAAI,CAAC,QAAQ,CAAC;;;IAGd,IAAI,CAAC,QAAQ,CAAC;;IAEd,IAAI,CAAC,MAAM,CAAC;;;IAGZ,IAAI,CAAC,SAAS,CAAC;;IAEf,IAAI,CAAC,UAAU,CAAC;IAChB,IAAI,CAAC,YAAY,CAAC;IAClB,IAAI,CAAC,MAAM,CAAC;;IAEZ,IAAI,CAAC,OAAO,CAAC;;IAEb,IAAI,CAAC,QAAQ,CAAC;IACd,IAAI,CAAC,KAAK,CAAC;IACX,IAAI,CAAC,QAAQ,CAAC;;;EAGhB,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC;;;;;;;;;IAS1C,IAAI,CAAC,SAAS,CAAC;IACf,IAAI,CAAC,SAAS,CAAC;;IAEf,IAAI,CAAC,MAAM,CAAC;;IAEZ,IAAI,CAAC,SAAS,CAAC;IACf,IAAI,CAAC,OAAO,CAAC;IACb,IAAI,CAAC,KAAK,CAAC;;EAEb,IAAI,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,8EAA8E,CAAC;;;;8BAIrF,GAAG,CAAC,OAAO,CAAC;;8BAEZ,GAAG,CAAC,OAAO,CAAC;8BACZ,GAAG,CAAC,OAAO,CAAC;8BACZ,GAAG,CAAC,OAAO,CAAC;;;EAGxC,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,0EAA0E,CAAC;;;;;;;;;;;;;;;EAexG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC;;;;;;;;;;EAUxC,IAAI,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BjB,IAAI,CAAC,aAAa,CAAC;;;;;;;;EAQnB,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,2DAA2D,CAAC;;;;;;;;;;EAUrF,IAAI,CAAC,cAAc,CAAC;;;;;;;;;;;EAWpB,IAAI,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;EAgBnB,IAAI,CAAC,2BAA2B,CAAC;;;;;;;yBAOV,IAAI,CAAC,WAAW,CAAC;;IAEtC,IAAI,CAAC,YAAY,CAAC;;;kDAG4B,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC;;;;gBAIrE,IAAI,CAAC,OAAO,CAAC;;kBAEX,IAAI,CAAC,kBAAkB,CAAC;;;EAGxC,IAAI,CAAC,MAAM,CAAC;CACb,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,OAAgB,EAAE;IAC1D,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;QACpC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrE,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7F,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,UAAU,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACvB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,KAAK,SAAS;gBACZ,OAAO,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,KAAK,QAAQ;gBACX,OAAO,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,KAAK,QAAQ;gBACX,OAAO,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,KAAK,QAAQ;gBACX,OAAO,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,KAAK,MAAM;gBACT,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,KAAK,SAAS;gBACZ,OAAO,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,KAAK,UAAU;gBACb,OAAO,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,KAAK,YAAY;gBACf,OAAO,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7C,KAAK,MAAM;gBACT,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,KAAK,OAAO;gBACV,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,KAAK,QAAQ;gBACX,OAAO,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,KAAK,KAAK;gBACR,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtC,KAAK,QAAQ;gBACX,OAAO,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzC,KAAK,SAAS;gBACZ,OAAO,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,KAAK,SAAS;gBACZ,OAAO,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,KAAK,MAAM;gBACT,OAAO,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,KAAK,SAAS;gBACZ,OAAO,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,KAAK,OAAO;gBACV,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxC,KAAK,KAAK;gBACR,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACtC;gBACE,MAAM,IAAI,UAAU,CAAC,oBAAoB,IAAI,CAAC,OAAO,qCAAqC,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAQ,QAA8B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC"}

package/dist/commands/company.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `ekwo company` — one company leaves an installation, and arrives in another.
+ *
+ *   ekwo company export <company> --out <dir>   write the archive of one company
+ *   ekwo company import <dir>                   take an archive into this installation
+ *
+ * The archive is a directory: `manifest.json`, and one `data/<schema>.<table>.jsonl`
+ * per table, one row per line. `docs/company-archive.md` is the format, and it
+ * is written to be read without this CLI.
+ *
+ * **Exporting runs as a person, under row level security.** The connection the
+ * CLI holds belongs to the owner of the database, for whom every company is
+ * readable at once — which is exactly what `export_company_table()` refuses.
+ * So the export happens inside one transaction that steps down to
+ * `authenticated` and carries the claim of the member it acts for, the way
+ * PostgREST would have: the schema judges that person, and the snapshot is one
+ * snapshot, so the manifest and the rows cannot disagree.
+ *
+ * **The rows are never parsed here.** They are written as the database wrote
+ * them and read back the same way, because a JSON parser that meets `1.50`
+ * inside a jsonb column hands back `1.5`, and the checksum of a table is the
+ * checksum of its bytes.
+ *
+ * **Importing is one call.** The files are checked against the manifest first —
+ * a file damaged on the way is a finding of this CLI, not a refusal of the
+ * books — then handed whole to `import_company()`, which takes all of it or
+ * none of it.
+ */
+import { type ParsedArgs } from '../args.js';
+import { type CommandDeps } from '../context.js';
+export declare const COMPANY_FLAGS: readonly ["db-url", "db-password", "db-region", "project-ref", "supabase-url", "service-role-key", "out", "as-user", "owner", "yes"];
+export interface ArchiveTable {
+    name: string;
+    file: string;
+    rows: number;
+    sha256: string;
+}
+export interface ArchiveManifest {
+    format: string;
+    format_version: number;
+    company: {
+        id: string;
+        name: string;
+    };
+    tables: ArchiveTable[];
+    files?: {
+        transported: boolean;
+        list: unknown[];
+    };
+    [key: string]: unknown;
+}
+export declare function companyCommand(args: ParsedArgs, deps?: CommandDeps): Promise<number>;
+/** Reads an archive directory, checks it against its manifest, and returns it as one JSON text. */
+export declare function readArchive(dir: string): Promise<{
+    manifest: ArchiveManifest;
+    text: string;
+    rows: number;
+}>;
+//# sourceMappingURL=company.d.ts.map

package/dist/commands/company.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.d.ts","sourceRoot":"","sources":["../../src/commands/company.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,EAA8C,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAMjF,eAAO,MAAM,aAAa,sIAAmE,CAAC;AAK9F,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAClD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB9F;AAyFD,mGAAmG;AACnG,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BjH"}