ekwo-os 0.4.1

package/dist/commands/login.js

@@ -0,0 +1,128 @@
+/**
+ * `ekwo login` and `ekwo logout`.
+ *
+ * Signing in is what turns "every command takes a connection string" into
+ * something a person can use twenty times a day. It asks the instance for a
+ * session with an address and a password, keeps the session in the person's
+ * own configuration directory, and keeps the password nowhere.
+ *
+ * What it needs comes from a flag, then the environment, then a profile that
+ * already exists — so signing in again after a session ended is `ekwo login`
+ * and a password — then `ekwo.json` for the instance URL, and a question last,
+ * when there is somebody to ask.
+ */
+import { IDENTITY_ENV } from '@ekwo-ai/core';
+import { boolFlag, rejectUnknownFlags, stringFlag } from '../args.js';
+import { readConfig } from '../config.js';
+import { fetchOf, profileName, refuseInstallerKey, refuseServiceRole } from '../identity.js';
+import { setContext, setResult } from '../output.js';
+import { FIRST_PROFILE, assertOutsideRepository, configDir, forgetSession, readProfiles, readSession, writeProfiles, writeSession, } from '../profiles.js';
+import { NotInteractiveError, askRequired, askSecret, isInteractive } from '../prompt.js';
+import { signIn, signOut } from '../session.js';
+import { dim, heading, note, pairs, skipped, step } from '../ui.js';
+export const LOGIN_FLAGS = ['profile', 'supabase-url', 'anon-key', 'email', 'password', 'yes'];
+export const LOGOUT_FLAGS = ['profile'];
+export async function loginCommand(args, deps = {}) {
+    refuseInstallerKey(args);
+    rejectUnknownFlags(args, LOGIN_FLAGS);
+    const env = deps.env ?? process.env;
+    const interactive = !boolFlag(args, 'yes') && isInteractive();
+    const dir = configDir(env);
+    // Before anything is asked: a password typed for a session that cannot be
+    // kept is a password typed for nothing.
+    assertOutsideRepository(dir);
+    const file = await readProfiles(dir);
+    const name = profileName(args, env) ?? file.current ?? FIRST_PROFILE;
+    const known = file.profiles[name];
+    const installation = await readConfig(deps.cwd);
+    const value = (flag, variable, remembered) => stringFlag(args, flag) ?? (env[variable]?.trim() || undefined) ?? remembered;
+    const supabaseUrl = value('supabase-url', IDENTITY_ENV.supabaseUrl, known?.supabase_url ?? installation?.project_url) ??
+        (interactive ? await askRequired('URL of the instance (https://<ref>.supabase.co)?') : undefined);
+    if (supabaseUrl === undefined)
+        throw new NotInteractiveError('the URL of the instance', '--supabase-url');
+    const anonKey = value('anon-key', IDENTITY_ENV.anonKey, known?.supabase_url === supabaseUrl ? known.anon_key : undefined) ??
+        (interactive ? await askRequired('Publishable (anon) key of the instance (Project Settings → API)?') : undefined);
+    if (anonKey === undefined)
+        throw new NotInteractiveError('the publishable (anon) key', '--anon-key');
+    refuseServiceRole(anonKey, stringFlag(args, 'anon-key') !== undefined ? '--anon-key' : IDENTITY_ENV.anonKey, 'apikey');
+    const email = value('email', IDENTITY_ENV.email, known?.email) ??
+        (interactive ? await askRequired('E-mail address?') : undefined);
+    if (email === undefined)
+        throw new NotInteractiveError('the e-mail address', '--email');
+    const password = stringFlag(args, 'password') ??
+        (env[IDENTITY_ENV.password] || undefined) ??
+        (interactive ? await askSecret(`Password for ${email}. It is sent to the instance and never written to disk:`) : undefined);
+    if (password === undefined || password.length === 0) {
+        throw new NotInteractiveError('the password', `--password, or ${IDENTITY_ENV.password}`);
+    }
+    heading('Signing in');
+    const instance = { supabaseUrl, anonKey };
+    const { session, user } = await signIn(fetchOf(deps), instance, email, password);
+    step(`signed in to ${supabaseUrl} as ${user.email ?? email}`);
+    // The company in use belongs to an instance and to a person. Signing in as
+    // somebody else, or somewhere else, is not a reason to keep it.
+    const sameBooks = known !== undefined && known.supabase_url === supabaseUrl && known.user_id === user.id;
+    const company = sameBooks ? known.company : undefined;
+    await writeSession(dir, name, session);
+    await writeProfiles(dir, {
+        current: name,
+        profiles: {
+            ...file.profiles,
+            [name]: {
+                supabase_url: supabaseUrl,
+                anon_key: anonKey,
+                email: user.email ?? email,
+                user_id: user.id,
+                ...(company === undefined ? {} : { company }),
+            },
+        },
+    });
+    step(`kept the session under the profile ${name}, in ${dir}`);
+    if (company === undefined)
+        note(dim('No company in use yet: `ekwo whoami` lists them, `ekwo use <company>` picks one.'));
+    setContext({ profile: name, instance: supabaseUrl, company: company ?? null });
+    setResult({
+        profile: name,
+        instance: { url: supabaseUrl },
+        user: { id: user.id, email: user.email ?? email },
+        company: company ?? null,
+        expiresAt: new Date(session.expires_at * 1000).toISOString(),
+        configDir: dir,
+    });
+    pairs([
+        ['profile', name],
+        ['user', user.email ?? email],
+        ['company', company?.name ?? dim('none in use')],
+    ]);
+    return 0;
+}
+export async function logoutCommand(args, deps = {}) {
+    rejectUnknownFlags(args, LOGOUT_FLAGS);
+    const env = deps.env ?? process.env;
+    const dir = configDir(env);
+    const file = await readProfiles(dir);
+    const name = profileName(args, env) ?? file.current;
+    const profile = name === undefined ? undefined : file.profiles[name];
+    heading('Signing out');
+    if (name === undefined || profile === undefined) {
+        skipped('nobody was signed in');
+        setResult({ profile: name ?? null, signedOut: false, revoked: false });
+        return 0;
+    }
+    const session = await readSession(dir, name);
+    // The instance is told, so the refresh token stops working there too; the
+    // local copy goes whether or not the instance could be reached.
+    const revoked = session === undefined
+        ? false
+        : await signOut(fetchOf(deps), { supabaseUrl: profile.supabase_url, anonKey: profile.anon_key }, session.access_token);
+    const signedOut = await forgetSession(dir, name);
+    if (signedOut)
+        step(`forgot the session of the profile ${name}`);
+    else
+        skipped(`the profile ${name} held no session`);
+    if (signedOut && !revoked)
+        note(dim('The instance could not be told; the session there ends on its own.'));
+    setResult({ profile: name, signedOut, revoked });
+    return 0;
+}
+//# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAmB,MAAM,YAAY,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAiB,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,SAAS,EACT,aAAa,EACb,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEpE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAU,CAAC;AACxG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAS,CAAU,CAAC;AAOjD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAgB,EAAE,OAAkB,EAAE;IACvE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;IAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,0EAA0E;IAC1E,wCAAwC;IACxC,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAE7B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,UAA8B,EAAsB,EAAE,CACnG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,UAAU,CAAC;IAE/E,MAAM,WAAW,GACf,KAAK,CAAC,cAAc,EAAE,YAAY,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,IAAI,YAAY,EAAE,WAAW,CAAC;QACjG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,kDAAkD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,IAAI,WAAW,KAAK,SAAS;QAAE,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;IAE1G,MAAM,OAAO,GACX,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,kEAAkE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpH,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;IACrG,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEvH,MAAM,KAAK,GACT,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;QAChD,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;IAExF,MAAM,QAAQ,GACZ,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC;QAC5B,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QACzC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,gBAAgB,KAAK,yDAAyD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9H,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAAC,cAAc,EAAE,kBAAkB,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,CAAC,YAAY,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAC1C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjF,IAAI,CAAC,gBAAgB,WAAW,OAAO,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;IAE9D,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,WAAW,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;IACzG,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtD,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,aAAa,CAAC,GAAG,EAAE;QACvB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE;YACR,GAAG,IAAI,CAAC,QAAQ;YAChB,CAAC,IAAI,CAAC,EAAE;gBACN,YAAY,EAAE,WAAW;gBACzB,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;gBAC1B,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC9C;SACF;KACF,CAAC,CAAC;IACH,IAAI,CAAC,sCAAsC,IAAI,QAAQ,GAAG,EAAE,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC,CAAC;IAEzH,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/E,SAAS,CAAC;QACR,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;QAC9B,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE;QACjD,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC5D,SAAS,EAAE,GAAG;KACf,CAAC,CAAC;IACH,KAAK,CAAC;QACJ,CAAC,SAAS,EAAE,IAAI,CAAC;QACjB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;QAC7B,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;KACjD,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB,EAAE,OAAiB,EAAE;IACvE,kBAAkB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAErE,OAAO,CAAC,aAAa,CAAC,CAAC;IACvB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAChC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,OAAO,GACX,OAAO,KAAK,SAAS;QACnB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3H,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,SAAS;QAAE,IAAI,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;;QAC5D,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC,CAAC;IACpD,IAAI,SAAS,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC,CAAC;IAE3G,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/migrate.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `ekwo migrate` — bring an existing installation up to this release.
+ *
+ * It shows the gap before it closes it, so an operator sees what is about to
+ * run. The reference seeds are re-applied too: they are idempotent, and a new
+ * release that adds an account to a chart would otherwise leave every
+ * installation one row short.
+ *
+ * **The modules this release carries are migrated too, by default.** A module
+ * is a schema whose tables are empty and whose row level security is on until
+ * a company enables it, so there is nothing to ask before creating them — and
+ * a module whose schema is half there is the state nobody can reason about.
+ * `--no-modules` leaves them alone, which is also what to pass before running
+ * `supabase db push`: the Supabase CLI knows the socle's files and not a
+ * module's, so it would report them as history it has no file for.
+ */
+import { type ParsedArgs } from '../args.js';
+import { type CommandDeps } from '../context.js';
+export declare const MIGRATE_FLAGS: readonly ["db-url", "db-password", "db-region", "project-ref", "supabase-url", "service-role-key", "skip-seeds", "no-modules", "yes"];
+/**
+ * The line to print before a migration runs.
+ *
+ * There is no "down" migration in this repository and there never will be:
+ * undoing a schema change on a database holding a year of entries is a
+ * restore, not a script. Which makes the snapshot the only way back, and an
+ * operator who reads this after the fact has already not taken one.
+ */
+export declare function snapshotRecommendation(): void;
+export declare function migrateCommand(args: ParsedArgs, deps?: CommandDeps): Promise<number>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/commands/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3E,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAWjF,eAAO,MAAM,aAAa,uIAAoE,CAAC;AAE/F;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAS7C;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2E9F"}

package/dist/commands/migrate.js

@@ -0,0 +1,115 @@
+/**
+ * `ekwo migrate` — bring an existing installation up to this release.
+ *
+ * It shows the gap before it closes it, so an operator sees what is about to
+ * run. The reference seeds are re-applied too: they are idempotent, and a new
+ * release that adds an account to a chart would otherwise leave every
+ * installation one row short.
+ *
+ * **The modules this release carries are migrated too, by default.** A module
+ * is a schema whose tables are empty and whose row level security is on until
+ * a company enables it, so there is nothing to ask before creating them — and
+ * a module whose schema is half there is the state nobody can reason about.
+ * `--no-modules` leaves them alone, which is also what to pass before running
+ * `supabase db push`: the Supabase CLI knows the socle's files and not a
+ * module's, so it would report them as history it has no file for.
+ */
+import { boolFlag, rejectUnknownFlags } from '../args.js';
+import { migrationsDir, seedDir } from '../bundle.js';
+import { CONNECTION_FLAGS, openDatabase } from '../context.js';
+import { applyMigrations, listMigrations, migrationGap } from '../migrations.js';
+import { applyModuleMigrations } from './module.js';
+import { allModuleMigrations, listModules } from '../module/read.js';
+import { isInteractive } from '../prompt.js';
+import { applySeeds } from '../seeds.js';
+import { schemaIsInstalled } from '../bootstrap.js';
+import { syncSchemaVersion } from '../status.js';
+import { setResult } from '../output.js';
+import { bold, dim, heading, line, note, skipped, step, warn } from '../ui.js';
+export const MIGRATE_FLAGS = [...CONNECTION_FLAGS, 'skip-seeds', 'no-modules', 'yes'];
+/**
+ * The line to print before a migration runs.
+ *
+ * There is no "down" migration in this repository and there never will be:
+ * undoing a schema change on a database holding a year of entries is a
+ * restore, not a script. Which makes the snapshot the only way back, and an
+ * operator who reads this after the fact has already not taken one.
+ */
+export function snapshotRecommendation() {
+    line();
+    warn(`Take a snapshot first. Migrations move forward only — there is no ${bold('down')} — so a ` +
+        'restore is the way back.');
+    note(dim('  Supabase: Database → Backups, or `supabase db dump -f before-upgrade.sql`.'));
+    note(dim('  Self-hosted: `pg_dump` the database this connection points at.'));
+    line();
+}
+export async function migrateCommand(args, deps = {}) {
+    rejectUnknownFlags(args, MIGRATE_FLAGS);
+    const interactive = !boolFlag(args, 'yes') && isInteractive();
+    const { db } = await openDatabase(args, { interactive, connect: deps.connect });
+    try {
+        const migrations = await listMigrations(migrationsDir());
+        const modules = boolFlag(args, 'no-modules') ? [] : await listModules();
+        // A module's versions live in the same history, so they are not "unknown"
+        // — they are simply not the socle's. The gap is computed against both.
+        const gap = await migrationGap(db, [...migrations, ...allModuleMigrations(modules)]);
+        heading('Migrations');
+        note(dim(`${gap.applied.length} applied, ${gap.pending.length} pending`));
+        if (gap.unknown.length > 0) {
+            warn(`${gap.unknown.length} migration(s) in this database are not in this release — ` +
+                'it was installed by a newer version. Upgrade the CLI before migrating.');
+            for (const version of gap.unknown)
+                note(dim(`  ${version}`));
+            setResult({ applied: [], pending: gap.pending.map((m) => m.file), unknown: gap.unknown });
+            return 1;
+        }
+        const applied = [];
+        const seeds = [];
+        let moduleMigrations = 0;
+        let schemaVersion;
+        if (gap.pending.length === 0) {
+            skipped('nothing to apply');
+        }
+        else {
+            for (const migration of gap.pending)
+                note(dim(`pending  ${migration.file}`));
+            snapshotRecommendation();
+            await applyMigrations(db, migrations, (migration) => {
+                applied.push(migration.file);
+                step(migration.file);
+            });
+        }
+        if (modules.length > 0) {
+            moduleMigrations = await applyModuleMigrations(db, modules, { heading: true });
+        }
+        if (!boolFlag(args, 'skip-seeds')) {
+            heading('Reference data');
+            await applySeeds(db, seedDir(), (seed) => {
+                seeds.push(seed.file);
+                step(seed.file);
+            });
+            note(dim('Seeds are idempotent; re-applying them adds what a new release added.'));
+        }
+        if (await schemaIsInstalled(db)) {
+            const version = await syncSchemaVersion(db);
+            schemaVersion = version;
+            if (version !== undefined) {
+                heading('Version');
+                step(`instance.schema_version is now ${version}`);
+            }
+        }
+        setResult({
+            alreadyApplied: gap.applied.length,
+            applied,
+            moduleMigrations,
+            seeds,
+            schemaVersion: schemaVersion ?? null,
+        });
+        line();
+        return 0;
+    }
+    finally {
+        await db.close();
+    }
+}
+//# sourceMappingURL=migrate.js.map

package/dist/commands/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAmB,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAoB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAE/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,CAAU,CAAC;AAE/F;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,EAAE,CAAC;IACP,IAAI,CACF,qEAAqE,IAAI,CAAC,MAAM,CAAC,UAAU;QACzF,0BAA0B,CAC7B,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;IAC9E,IAAI,EAAE,CAAC;AACT,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAgB,EAAE,OAAoB,EAAE;IAC3E,kBAAkB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;IAC9D,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAEhF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,EAAE,CAAC;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAErF,OAAO,CAAC,YAAY,CAAC,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC;QAE1E,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CACF,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,2DAA2D;gBAC9E,wEAAwE,CAC3E,CAAC;YACF,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7D,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1F,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAiC,CAAC;QAEtC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,YAAY,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7E,sBAAsB,EAAE,CAAC;YACzB,MAAM,eAAe,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE;gBAClD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC1B,MAAM,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBACvC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,MAAM,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC;YAC5C,aAAa,GAAG,OAAO,CAAC;YACxB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,IAAI,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,SAAS,CAAC;YACR,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;YAClC,OAAO;YACP,gBAAgB;YAChB,KAAK;YACL,aAAa,EAAE,aAAa,IAAI,IAAI;SACrC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/commands/module.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `ekwo module` — what is beside the socle, and which company holds it.
+ *
+ *   ekwo module list                     what this release carries, and what the database holds
+ *   ekwo module migrate [<code>]         apply the migrations of the modules, and their pack seeds
+ *   ekwo module enable <code> --company  turn a module on for one company
+ *   ekwo module disable <code> --company turn it off, unless the module says it holds data
+ *
+ * `enable` and `disable` go through `enable_module()` / `disable_module()`
+ * rather than writing `company_modules`: the guard lives in the function
+ * because the table has no write policy, and a CLI that went round it would be
+ * a CLI whose rule applies only to clients that respect it. That is the same
+ * reason `ekwo register` sets the request claim and calls the function.
+ */
+import { type ParsedArgs } from '../args.js';
+import { type CommandDeps } from '../context.js';
+import { type EkwoModule } from '../module/read.js';
+import { type SqlClient } from '../sql.js';
+export declare const MODULE_FLAGS: readonly ["db-url", "db-password", "db-region", "project-ref", "supabase-url", "service-role-key", "company", "as-user", "settings", "yes"];
+export declare function moduleCommand(args: ParsedArgs, deps?: CommandDeps): Promise<number>;
+/**
+ * Applies every pending migration of the given modules, then their pack seeds.
+ *
+ * Shared with `ekwo migrate`, which runs it straight after the socle's — a
+ * module's tables existing is not the same as a company holding the module, so
+ * there is nothing to ask before creating them, and a schema whose migrations
+ * are half applied is the state nobody can reason about.
+ */
+export declare function applyModuleMigrations(db: SqlClient, modules: readonly EkwoModule[], options?: {
+    heading?: boolean;
+}): Promise<number>;
+//# sourceMappingURL=module.d.ts.map

package/dist/commands/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../src/commands/module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAA8C,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEzF,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjF,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAI1D,eAAO,MAAM,YAAY,6IAA0E,CAAC;AAEpG,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B7F;AAkID;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAClC,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/commands/module.js

@@ -0,0 +1,285 @@
+/**
+ * `ekwo module` — what is beside the socle, and which company holds it.
+ *
+ *   ekwo module list                     what this release carries, and what the database holds
+ *   ekwo module migrate [<code>]         apply the migrations of the modules, and their pack seeds
+ *   ekwo module enable <code> --company  turn a module on for one company
+ *   ekwo module disable <code> --company turn it off, unless the module says it holds data
+ *
+ * `enable` and `disable` go through `enable_module()` / `disable_module()`
+ * rather than writing `company_modules`: the guard lives in the function
+ * because the table has no write policy, and a CLI that went round it would be
+ * a CLI whose rule applies only to clients that respect it. That is the same
+ * reason `ekwo register` sets the request claim and calls the function.
+ */
+import { rejectUnknownFlags, stringFlag, UsageError } from '../args.js';
+import { seedDir } from '../bundle.js';
+import { CONNECTION_FLAGS, openDatabase } from '../context.js';
+import { applyMigrations, appliedVersions, ensureHistory } from '../migrations.js';
+import { allModuleMigrations, exposeSchemaNote, listModules, moduleSeeds, readModule, } from '../module/read.js';
+import { isInteractive } from '../prompt.js';
+import { applySeed } from '../seeds.js';
+import { asUser, first } from '../sql.js';
+import { setResult } from '../output.js';
+import { bold, cyan, dim, heading, line, note, skipped, step, table, warn } from '../ui.js';
+export const MODULE_FLAGS = [...CONNECTION_FLAGS, 'company', 'as-user', 'settings', 'yes'];
+export async function moduleCommand(args, deps = {}) {
+    rejectUnknownFlags(args, MODULE_FLAGS);
+    const action = args.positional[0];
+    if (action === undefined)
+        throw new UsageError(`name a subcommand\n${usage()}`);
+    if (action === 'help') {
+        line(usage());
+        return 0;
+    }
+    if (!['list', 'migrate', 'enable', 'disable'].includes(action)) {
+        throw new UsageError(`unknown subcommand: module ${action}\n${usage()}`);
+    }
+    const modules = await listModules();
+    const interactive = isInteractive();
+    const { db } = await openDatabase(args, { interactive, connect: deps.connect });
+    try {
+        switch (action) {
+            case 'list':
+                return await listCommand(db, modules);
+            case 'migrate':
+                return await migrateCommand(db, modules, args.positional[1]);
+            default:
+                return await toggleCommand(db, modules, args, action === 'enable');
+        }
+    }
+    finally {
+        await db.close();
+    }
+}
+async function listCommand(db, modules) {
+    const installed = await registry(db);
+    const byCode = new Map(installed.map((row) => [row.code, row]));
+    const strangers = installed.filter((row) => !modules.some((m) => m.manifest.code === row.code));
+    setResult({
+        modules: modules.map(({ manifest, migrations }) => {
+            const row = byCode.get(manifest.code);
+            return {
+                code: manifest.code,
+                name: manifest.name,
+                version: manifest.version,
+                schema: manifest.schema,
+                description: manifest.description ?? null,
+                migrations: migrations.length,
+                installed: row !== undefined,
+                installedVersion: row?.version ?? null,
+                status: row?.status ?? null,
+                companies: row?.companies ?? 0,
+            };
+        }),
+        notInThisRelease: strangers.map((row) => ({
+            code: row.code,
+            name: row.name,
+            version: row.version,
+            schema: row.schema_name,
+        })),
+    });
+    heading(`Modules (${modules.length} in this release)`);
+    if (modules.length === 0) {
+        note(dim('none — the socle stands on its own'));
+        return 0;
+    }
+    table([
+        { title: 'code' },
+        { title: 'name' },
+        { title: 'version' },
+        { title: 'schema' },
+        { title: 'migrations', align: 'right' },
+        { title: 'state' },
+    ], modules.map(({ manifest, migrations }) => {
+        const row = byCode.get(manifest.code);
+        return [
+            bold(manifest.code),
+            manifest.name,
+            manifest.version,
+            cyan(manifest.schema),
+            String(migrations.length),
+            row === undefined
+                ? dim('not installed — run `ekwo module migrate`')
+                : `${row.status}, ${row.companies} compan${row.companies === 1 ? 'y' : 'ies'}`,
+        ];
+    }));
+    line();
+    for (const { manifest } of modules) {
+        if (manifest.description !== undefined)
+            note(dim(`${manifest.code} — ${manifest.description}`));
+    }
+    for (const { manifest } of modules) {
+        const row = byCode.get(manifest.code);
+        if (row !== undefined && row.version !== manifest.version) {
+            warn(`${manifest.code}: the database holds ${row.version}, this release carries ${manifest.version}`);
+        }
+    }
+    if (strangers.length > 0) {
+        heading('Installed here, not in this release');
+        for (const row of strangers)
+            note(`${bold(row.code)}  ${row.name} ${row.version} · schema ${row.schema_name}`);
+    }
+    line();
+    return 0;
+}
+async function registry(db) {
+    const exists = await first(db, `select to_regclass('public.modules') is not null as present`);
+    if (exists?.present !== true)
+        return [];
+    return db.query(`select m.code, m.name, m.schema_name, m.version, m.status::text as status,
+            (select count(*)::int from company_modules c where c.module_code = m.code) as companies
+       from modules m order by m.code`);
+}
+// ---------------------------------------------------------------- migrate
+async function migrateCommand(db, modules, only) {
+    const wanted = only === undefined ? modules : [await readModule(only)];
+    if (wanted.length === 0) {
+        heading('Modules');
+        skipped('this release carries none');
+        setResult({ modules: [], applied: 0 });
+        return 0;
+    }
+    const applied = await applyModuleMigrations(db, wanted, { heading: true });
+    if (applied === 0)
+        skipped('nothing to apply');
+    setResult({ modules: wanted.map((m) => m.manifest.code), applied });
+    for (const module of wanted) {
+        heading(`${module.manifest.name}`);
+        for (const sentence of exposeSchemaNote(module.manifest.schema))
+            note(dim(sentence));
+    }
+    line();
+    return 0;
+}
+/**
+ * Applies every pending migration of the given modules, then their pack seeds.
+ *
+ * Shared with `ekwo migrate`, which runs it straight after the socle's — a
+ * module's tables existing is not the same as a company holding the module, so
+ * there is nothing to ask before creating them, and a schema whose migrations
+ * are half applied is the state nobody can reason about.
+ */
+export async function applyModuleMigrations(db, modules, options = {}) {
+    const migrations = allModuleMigrations(modules);
+    if (migrations.length === 0)
+        return 0;
+    await ensureHistory(db);
+    const known = new Set(await appliedVersions(db));
+    const pending = migrations.filter((m) => !known.has(m.version));
+    if (options.heading === true) {
+        heading('Module migrations');
+        note(dim(`${migrations.length - pending.length} applied, ${pending.length} pending`));
+    }
+    const result = await applyMigrations(db, migrations, (migration) => {
+        step(`${migration.name} (${migration.file})`);
+    });
+    for (const module of modules) {
+        for (const path of await moduleSeeds(module.manifest.code, seedDir())) {
+            await applySeed(db, { file: path.split('/').at(-1), path });
+            step(dim(`${module.manifest.code}: ${path.split('/').at(-1)}`));
+        }
+    }
+    return result.applied.length;
+}
+// ------------------------------------------------------------ enable/disable
+async function toggleCommand(db, modules, args, on) {
+    const code = args.positional[1];
+    if (code === undefined)
+        throw new UsageError(`name a module: ekwo module ${on ? 'enable' : 'disable'} <code>`);
+    const module = modules.find((m) => m.manifest.code === code);
+    if (module === undefined) {
+        throw new UsageError(`unknown module: ${code}. This release carries: ${modules.map((m) => m.manifest.code).join(', ') || 'none'}`);
+    }
+    const companyId = await resolveCompany(db, stringFlag(args, 'company'));
+    const actor = await resolveActor(db, stringFlag(args, 'as-user'), companyId);
+    const settings = stringFlag(args, 'settings');
+    if (on) {
+        await pendingCheck(db, module);
+        await asUser(db, actor, async () => {
+            await db.query(`select enable_module($1, $2, $3::jsonb)`, [companyId, code, settings ?? null]);
+        });
+        heading(`${module.manifest.name} enabled`);
+        step(`${code} is on for company ${companyId}`);
+        line();
+        for (const sentence of exposeSchemaNote(module.manifest.schema))
+            note(dim(sentence));
+    }
+    else {
+        await asUser(db, actor, async () => {
+            await db.query(`select disable_module($1, $2)`, [companyId, code]);
+        });
+        heading(`${module.manifest.name} disabled`);
+        step(`${code} is off for company ${companyId}. Nothing it wrote was deleted.`);
+    }
+    setResult({ module: code, schema: module.manifest.schema, companyId, actingAs: actor, enabled: on });
+    line();
+    return 0;
+}
+/**
+ * The socle migration a module needs has to have run, and the module's own
+ * too. Both are questions about the history, which the CLI holds and the
+ * database function deliberately does not — a project restored from a dump has
+ * the schema and not necessarily the history, and refusing *that* installation
+ * would be refusing the wrong thing.
+ */
+async function pendingCheck(db, module) {
+    const known = new Set(await appliedVersions(db));
+    const min = module.manifest.requires_socle_min;
+    if (min !== undefined && known.size > 0 && !known.has(min)) {
+        throw new Error(`socle_too_old: ${module.manifest.code} needs socle migration ${min}, which this database has not run. ` +
+            'Run `ekwo migrate` first.');
+    }
+    const pending = module.migrations.filter((m) => !known.has(m.version));
+    if (pending.length > 0 && known.size > 0) {
+        throw new Error(`module_not_migrated: ${module.manifest.code} has ${pending.length} migration(s) still to apply. ` +
+            'Run `ekwo module migrate` first.');
+    }
+}
+async function resolveCompany(db, given) {
+    const companies = await db.query(`select id, name from companies order by name`);
+    if (given !== undefined) {
+        const match = companies.find((c) => c.id === given || c.name === given);
+        if (match === undefined) {
+            throw new UsageError(`unknown company: ${given}. This installation holds: ${companies.map((c) => c.name).join(', ') || 'none'}`);
+        }
+        return match.id;
+    }
+    const only = companies[0];
+    if (companies.length !== 1 || only === undefined) {
+        throw new UsageError(`--company is required: this installation holds ${companies.length} companies — ` +
+            companies.map((c) => `${c.name} (${c.id})`).join(', '));
+    }
+    return only.id;
+}
+/**
+ * Who the CLI acts for.
+ *
+ * `enable_module` refuses anyone who is not the owner of the company, and a
+ * superuser connection is nobody: `auth.uid()` is null and the guard would
+ * refuse the installer. So the claim is set the way PostgREST sets it, for an
+ * owner of that company — the rule is satisfied rather than circumvented.
+ */
+async function resolveActor(db, given, companyId) {
+    if (given !== undefined)
+        return given;
+    const owner = await first(db, `select user_id from company_members where company_id = $1 and role = 'owner' order by created_at limit 1`, [companyId]);
+    if (owner === undefined) {
+        throw new Error(`no_company_owner: company ${companyId} has no owner to act for. Pass --as-user <uuid>.`);
+    }
+    return owner.user_id;
+}
+function usage() {
+    return `${bold('ekwo module')} — the modules beside the socle.
+
+  ekwo module list                      What this release carries and what the database holds.
+  ekwo module migrate [<code>]          Apply module migrations and their country seeds.
+  ekwo module enable <code> --company X Turn a module on for one company.
+  ekwo module disable <code> --company X Turn it off. Nothing it wrote is deleted.
+
+  --company <id|name>   Which company. Required unless the installation holds one.
+  --as-user <uuid>      Act for this user. Defaults to an owner of the company.
+  --settings <json>     Settings to store on the company, in the module's own vocabulary.
+`;
+}
+//# sourceMappingURL=module.js.map

package/dist/commands/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../src/commands/module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,YAAY,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAoB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,UAAU,GAEX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAE5F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAU,CAAC;AAEpG,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB,EAAE,OAAoB,EAAE;IAC1E,kBAAkB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAElC,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,UAAU,CAAC,8BAA8B,MAAM,KAAK,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,aAAa,EAAE,CAAC;IACpC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAEhF,IAAI,CAAC;QACH,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,MAAM;gBACT,OAAO,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACxC,KAAK,SAAS;gBACZ,OAAO,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D;gBACE,OAAO,MAAM,aAAa,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAaD,KAAK,UAAU,WAAW,CAAC,EAAa,EAAE,OAAqB;IAC7D,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAEhE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,SAAS,CAAC;QACR,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;gBACzC,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,SAAS,EAAE,GAAG,KAAK,SAAS;gBAC5B,gBAAgB,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;gBACtC,MAAM,EAAE,GAAG,EAAE,MAAM,IAAI,IAAI;gBAC3B,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC;aAC/B,CAAC;QACJ,CAAC,CAAC;QACF,gBAAgB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,WAAW;SACxB,CAAC,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,CAAC,YAAY,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CACH;QACE,EAAE,KAAK,EAAE,MAAM,EAAE;QACjB,EAAE,KAAK,EAAE,MAAM,EAAE;QACjB,EAAE,KAAK,EAAE,SAAS,EAAE;QACpB,EAAE,KAAK,EAAE,QAAQ,EAAE;QACnB,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE;QACvC,EAAE,KAAK,EAAE,OAAO,EAAE;KACnB,EACD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO;YACL,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnB,QAAQ,CAAC,IAAI;YACb,QAAQ,CAAC,OAAO;YAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YACzB,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,GAAG,CAAC,2CAA2C,CAAC;gBAClD,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,UAAU,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;SACjF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,IAAI,EAAE,CAAC;IACP,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,wBAAwB,GAAG,CAAC,OAAO,0BAA0B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,SAAS;YAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,aAAa,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,EAAE,CAAC;IACP,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,EAAa;IACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,EAAE,EACF,6DAA6D,CAC9D,CAAC;IACF,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACxC,OAAO,EAAE,CAAC,KAAK,CACb;;sCAEkC,CACnC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAE3E,KAAK,UAAU,cAAc,CAC3B,EAAa,EACb,OAAqB,EACrB,IAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,SAAS,CAAC,CAAC;QACnB,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACrC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAEpE,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,EAAE,CAAC;IACP,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAa,EACb,OAA8B,EAC9B,UAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEtC,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE;QACjE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACtE,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAC1B,EAAa,EACb,OAAqB,EACrB,IAAgB,EAChB,EAAW;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,8BAA8B,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC;IAE/G,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,mBAAmB,IAAI,2BAA2B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAC7G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAE9C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,yCAAyC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,IAAI,sBAAsB,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC;QACP,KAAK,MAAM,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,uBAAuB,SAAS,iCAAiC,CAAC,CAAC;IACjF,CAAC;IACD,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACrG,IAAI,EAAE,CAAC;IACP,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,MAAkB;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,CAAC,QAAQ,CAAC,IAAI,0BAA0B,GAAG,qCAAqC;YACtG,2BAA2B,CAC9B,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,OAAO,CAAC,MAAM,gCAAgC;YAChG,kCAAkC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,EAAa,EAAE,KAAyB;IACpE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,KAAK,CAC9B,8CAA8C,CAC/C,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QACxE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,UAAU,CAClB,oBAAoB,KAAK,8BAA8B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAC3G,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,EAAE,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,UAAU,CAClB,kDAAkD,SAAS,CAAC,MAAM,eAAe;YAC/E,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CACzB,EAAa,EACb,KAAyB,EACzB,SAAiB;IAEjB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,KAAK,CACvB,EAAE,EACF,0GAA0G,EAC1G,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,kDAAkD,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;;;;;;;;;;CAU9B,CAAC;AACF,CAAC"}