ekwo-os 0.4.1

package/dist/company.js

@@ -0,0 +1,26 @@
+/**
+ * The company a name or an id refers to, among those a caller can see.
+ *
+ * A name is what a person types and a uuid is what a script passes, so both
+ * are accepted; an ambiguous name is refused rather than resolved to the first
+ * match, because working on the wrong company is not a mistake anybody
+ * notices the same day. The list is whatever the caller was allowed to read —
+ * every company for the installer's connection, the ones row level security
+ * lets through for a person — so a company somebody was never invited to is
+ * simply unknown, which is also all they should learn about it.
+ */
+import { UsageError } from './args.js';
+export function matchCompany(companies, wanted) {
+    const asked = wanted.toLowerCase();
+    const matches = companies.filter((c) => c.id === asked || c.name.toLowerCase() === asked);
+    if (matches.length === 0) {
+        throw new UsageError(`unknown_company: no company called ${wanted}. This installation has: ${companies.length === 0 ? 'none' : companies.map((c) => c.name).join(', ')}`);
+    }
+    if (matches.length > 1) {
+        throw new UsageError(`ambiguous_company: ${matches.length} companies are called ${wanted}. Name one by its id: ${matches
+            .map((c) => c.id)
+            .join(', ')}`);
+    }
+    return matches[0];
+}
+//# sourceMappingURL=company.js.map

package/dist/company.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.js","sourceRoot":"","sources":["../src/company.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,UAAU,YAAY,CAAyC,SAAuB,EAAE,MAAc;IAC1G,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,sCAAsC,MAAM,4BAC1C,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAC1E,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAClB,sBAAsB,OAAO,CAAC,MAAM,yBAAyB,MAAM,yBAAyB,OAAO;aAChG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAM,CAAC;AACzB,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `ekwo.json` — the one file the CLI writes, and what is deliberately not in it.
+ *
+ * It holds three things: which Supabase project this installation is on, which
+ * country's rules it was set up for, and which schema version it was at. That
+ * is enough for the next `ekwo status` or `ekwo migrate` to know where it is
+ * pointed without being told again.
+ *
+ * It holds no password, no service_role key and no connection string with
+ * credentials in it. Those are given per invocation, by flag, environment
+ * variable or prompt, and they are never written down here. A file that is
+ * safe to commit is a file that stays useful; a file with a key in it becomes
+ * a leak the first time somebody commits it.
+ */
+export declare const CONFIG_FILE = "ekwo.json";
+export interface EkwoConfig {
+    project_url?: string;
+    country?: string;
+    schema_version?: string;
+}
+export declare function configPath(cwd?: string): string;
+export declare function readConfig(cwd?: string): Promise<EkwoConfig | undefined>;
+export declare function writeConfig(config: EkwoConfig, cwd?: string): Promise<string>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,eAAO,MAAM,WAAW,cAAc,CAAC;AAEvC,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,wBAAgB,UAAU,CAAC,GAAG,SAAgB,GAAG,MAAM,CAEtD;AAED,wBAAsB,UAAU,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAcrF;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,SAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAU1F"}

package/dist/config.js

@@ -0,0 +1,50 @@
+/**
+ * `ekwo.json` — the one file the CLI writes, and what is deliberately not in it.
+ *
+ * It holds three things: which Supabase project this installation is on, which
+ * country's rules it was set up for, and which schema version it was at. That
+ * is enough for the next `ekwo status` or `ekwo migrate` to know where it is
+ * pointed without being told again.
+ *
+ * It holds no password, no service_role key and no connection string with
+ * credentials in it. Those are given per invocation, by flag, environment
+ * variable or prompt, and they are never written down here. A file that is
+ * safe to commit is a file that stays useful; a file with a key in it becomes
+ * a leak the first time somebody commits it.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export const CONFIG_FILE = 'ekwo.json';
+const HEADER = 'No secrets live here. The database password and the service_role key are ' +
+    'given per command, through --flags, the environment or a prompt.';
+export function configPath(cwd = process.cwd()) {
+    return join(cwd, CONFIG_FILE);
+}
+export async function readConfig(cwd = process.cwd()) {
+    try {
+        const text = await readFile(configPath(cwd), 'utf8');
+        const parsed = JSON.parse(text);
+        return {
+            ...(typeof parsed['project_url'] === 'string' ? { project_url: parsed['project_url'] } : {}),
+            ...(typeof parsed['country'] === 'string' ? { country: parsed['country'] } : {}),
+            ...(typeof parsed['schema_version'] === 'string'
+                ? { schema_version: parsed['schema_version'] }
+                : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function writeConfig(config, cwd = process.cwd()) {
+    const path = configPath(cwd);
+    const body = {
+        $comment: HEADER,
+        ...(config.project_url !== undefined ? { project_url: config.project_url } : {}),
+        ...(config.country !== undefined ? { country: config.country } : {}),
+        ...(config.schema_version !== undefined ? { schema_version: config.schema_version } : {}),
+    };
+    await writeFile(path, `${JSON.stringify(body, null, 2)}\n`, 'utf8');
+    return path;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AAQvC,MAAM,MAAM,GACV,2EAA2E;IAC3E,kEAAkE,CAAC;AAErE,MAAM,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC5C,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC3D,OAAO;YACL,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ;gBAC9C,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAkB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACvE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,MAAM;QAChB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;IACF,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/connection.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Where the connection details come from, and where they do not go.
+ *
+ * Three sources, in this order: a flag, an environment variable, a prompt.
+ * Nothing else. In particular the CLI never reads a secret out of a file it
+ * wrote and never writes one into a file — not into `ekwo.json`, not into a
+ * dotfile in the home directory, not into a cache. A service_role key can do
+ * anything to the project it belongs to; leaving a copy of it on disk because
+ * it saved a paste is not a trade worth making. `.env.example` documents the
+ * variables so an operator can put them somewhere *they* chose.
+ *
+ * The reliable way to give the CLI a database is `--db-url`, copied from the
+ * Supabase dashboard under Connect → Session pooler. `--project-ref` with
+ * `--db-password` and `--db-region` is the convenience, and it no longer
+ * guesses: the pooler hostname carries a generation prefix as well as a
+ * region, so both `aws-0-<region>` and `aws-1-<region>` are tried and the one
+ * that answers is kept and printed. There is deliberately no helper that
+ * builds the direct host `db.<ref>.supabase.co`: it resolves to an IPv6
+ * address only on projects created since 2024, so deriving it on the
+ * operator's behalf produces a hang rather than an error. Someone who wants it
+ * passes it as `--db-url`.
+ */
+export interface Connection {
+    /** Postgres connection string. Always present once resolved. */
+    dbUrl: string;
+    /** `https://<ref>.supabase.co`, when known. Needed to create the first user. */
+    supabaseUrl?: string | undefined;
+    /** Needed to create the first user, and never stored. */
+    serviceRoleKey?: string | undefined;
+    projectRef?: string | undefined;
+}
+export declare const ENV_DB_URL = "EKWO_DB_URL";
+export declare const ENV_DB_URL_FALLBACK = "SUPABASE_DB_URL";
+export declare const ENV_SUPABASE_URL = "SUPABASE_URL";
+export declare const ENV_SERVICE_ROLE_KEY = "SUPABASE_SERVICE_ROLE_KEY";
+/** The project ref out of whatever we were given, or `undefined`. */
+export declare function projectRefFrom(value: string | undefined): string | undefined;
+export declare function supabaseUrlFor(projectRef: string): string;
+/**
+ * The two pooler generations Supabase issues today. Both are tried, so the
+ * order is only which one costs a round trip when it is the wrong one.
+ */
+export declare const POOLER_GENERATIONS: readonly ["aws-0", "aws-1"];
+/**
+ * The session pooler, on port 5432, for one generation prefix.
+ *
+ * Session mode — not the transaction pooler on 6543 — because a migration
+ * needs a session: advisory locks, `set local`, and a multi-statement file
+ * applied as one command.
+ */
+export declare function poolerUrl(projectRef: string, password: string, region: string, generation: string): string;
+/**
+ * Every pooler host worth trying for a ref and a region.
+ *
+ * The generation prefix is not derivable. A project created in `eu-west-3` in
+ * September 2026 answered on `aws-1-eu-west-3` and returned "Tenant or user
+ * not found" on `aws-0-eu-west-3`; older projects are the other way round.
+ * Building one of them and calling it the answer is the bug this replaces.
+ */
+export declare function poolerCandidates(projectRef: string, password: string, region: string): string[];
+/** The host of a connection string, for a message that names what answered. */
+export declare function hostOf(dbUrl: string): string;
+/** Answers whether a connection string reaches a database. */
+export type Probe = (dbUrl: string) => Promise<boolean>;
+export declare class NoPoolerHostError extends Error {
+    readonly tried: string[];
+    constructor(tried: string[]);
+}
+/**
+ * Picks the pooler host that answers, trying each generation in turn.
+ *
+ * Returns the string that worked, so the caller can print the host and the
+ * operator learns which one their project is on.
+ */
+export declare function pickPoolerUrl(projectRef: string, password: string, region: string, probe: Probe): Promise<string>;
+export declare function looksLikeConnectionString(value: string): boolean;
+/** A connection string with `sslmode=require` added when it says nothing. */
+export declare function withSsl(dbUrl: string): string;
+//# sourceMappingURL=connection.d.ts.map

package/dist/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,eAAO,MAAM,UAAU,gBAAgB,CAAC;AACxC,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAC/C,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAmB5E;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,6BAA8B,CAAC;AAE9D;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,MAAM,EAAE,CAIV;AAED,+EAA+E;AAC/E,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAG5C;AAED,8DAA8D;AAC9D,MAAM,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAExD,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;gBAAf,KAAK,EAAE,MAAM,EAAE;CAOrC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7C"}

package/dist/connection.js

@@ -0,0 +1,116 @@
+/**
+ * Where the connection details come from, and where they do not go.
+ *
+ * Three sources, in this order: a flag, an environment variable, a prompt.
+ * Nothing else. In particular the CLI never reads a secret out of a file it
+ * wrote and never writes one into a file — not into `ekwo.json`, not into a
+ * dotfile in the home directory, not into a cache. A service_role key can do
+ * anything to the project it belongs to; leaving a copy of it on disk because
+ * it saved a paste is not a trade worth making. `.env.example` documents the
+ * variables so an operator can put them somewhere *they* chose.
+ *
+ * The reliable way to give the CLI a database is `--db-url`, copied from the
+ * Supabase dashboard under Connect → Session pooler. `--project-ref` with
+ * `--db-password` and `--db-region` is the convenience, and it no longer
+ * guesses: the pooler hostname carries a generation prefix as well as a
+ * region, so both `aws-0-<region>` and `aws-1-<region>` are tried and the one
+ * that answers is kept and printed. There is deliberately no helper that
+ * builds the direct host `db.<ref>.supabase.co`: it resolves to an IPv6
+ * address only on projects created since 2024, so deriving it on the
+ * operator's behalf produces a hang rather than an error. Someone who wants it
+ * passes it as `--db-url`.
+ */
+export const ENV_DB_URL = 'EKWO_DB_URL';
+export const ENV_DB_URL_FALLBACK = 'SUPABASE_DB_URL';
+export const ENV_SUPABASE_URL = 'SUPABASE_URL';
+export const ENV_SERVICE_ROLE_KEY = 'SUPABASE_SERVICE_ROLE_KEY';
+/** The project ref out of whatever we were given, or `undefined`. */
+export function projectRefFrom(value) {
+    if (value === undefined || value.length === 0)
+        return undefined;
+    // https://abcdefghijklmnopqrst.supabase.co
+    const host = /^https?:\/\/([a-z0-9-]+)\.supabase\.(co|in|red)/i.exec(value);
+    if (host !== null)
+        return host[1];
+    // postgresql://postgres.<ref>:password@aws-0-eu-central-1.pooler.supabase.com:5432/postgres
+    const pooler = /\/\/postgres\.([a-z0-9]+):/i.exec(value);
+    if (pooler !== null)
+        return pooler[1];
+    // postgresql://postgres:password@db.<ref>.supabase.co:5432/postgres
+    const direct = /@db\.([a-z0-9]+)\.supabase\./i.exec(value);
+    if (direct !== null)
+        return direct[1];
+    // A bare ref: twenty lowercase letters is what Supabase issues.
+    if (/^[a-z]{20}$/.test(value))
+        return value;
+    return undefined;
+}
+export function supabaseUrlFor(projectRef) {
+    return `https://${projectRef}.supabase.co`;
+}
+/**
+ * The two pooler generations Supabase issues today. Both are tried, so the
+ * order is only which one costs a round trip when it is the wrong one.
+ */
+export const POOLER_GENERATIONS = ['aws-0', 'aws-1'];
+/**
+ * The session pooler, on port 5432, for one generation prefix.
+ *
+ * Session mode — not the transaction pooler on 6543 — because a migration
+ * needs a session: advisory locks, `set local`, and a multi-statement file
+ * applied as one command.
+ */
+export function poolerUrl(projectRef, password, region, generation) {
+    return `postgresql://postgres.${projectRef}:${encodeURIComponent(password)}@${generation}-${region}.pooler.supabase.com:5432/postgres`;
+}
+/**
+ * Every pooler host worth trying for a ref and a region.
+ *
+ * The generation prefix is not derivable. A project created in `eu-west-3` in
+ * September 2026 answered on `aws-1-eu-west-3` and returned "Tenant or user
+ * not found" on `aws-0-eu-west-3`; older projects are the other way round.
+ * Building one of them and calling it the answer is the bug this replaces.
+ */
+export function poolerCandidates(projectRef, password, region) {
+    return POOLER_GENERATIONS.map((generation) => poolerUrl(projectRef, password, region, generation));
+}
+/** The host of a connection string, for a message that names what answered. */
+export function hostOf(dbUrl) {
+    const match = /@([^/:?]+)/.exec(dbUrl);
+    return match?.[1] ?? dbUrl;
+}
+export class NoPoolerHostError extends Error {
+    tried;
+    constructor(tried) {
+        super(`no_pooler_host: none of ${tried.join(', ')} answered. ` +
+            'Copy the connection string from your Supabase dashboard — Connect → Session pooler — ' +
+            'and pass it as --db-url. That string is the only form that is not derived.');
+        this.tried = tried;
+    }
+}
+/**
+ * Picks the pooler host that answers, trying each generation in turn.
+ *
+ * Returns the string that worked, so the caller can print the host and the
+ * operator learns which one their project is on.
+ */
+export async function pickPoolerUrl(projectRef, password, region, probe) {
+    const candidates = poolerCandidates(projectRef, password, region);
+    for (const candidate of candidates) {
+        if (await probe(withSsl(candidate)))
+            return candidate;
+    }
+    throw new NoPoolerHostError(candidates.map(hostOf));
+}
+export function looksLikeConnectionString(value) {
+    return /^postgres(ql)?:\/\//i.test(value);
+}
+/** A connection string with `sslmode=require` added when it says nothing. */
+export function withSsl(dbUrl) {
+    if (/[?&]sslmode=/i.test(dbUrl))
+        return dbUrl;
+    if (/localhost|127\.0\.0\.1/.test(dbUrl))
+        return dbUrl;
+    return `${dbUrl}${dbUrl.includes('?') ? '&' : '?'}sslmode=require`;
+}
+//# sourceMappingURL=connection.js.map

package/dist/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../src/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAYH,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAC/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhE,2CAA2C;IAC3C,MAAM,IAAI,GAAG,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;IAElC,4FAA4F;IAC5F,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAEtC,oEAAoE;IACpE,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAEtC,gEAAgE;IAChE,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,WAAW,UAAU,cAAc,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,UAAkB;IAElB,OAAO,yBAAyB,UAAU,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,UAAU,IAAI,MAAM,oCAAoC,CAAC;AACzI,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,QAAgB,EAChB,MAAc;IAEd,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC3C,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;AAC7B,CAAC;AAKD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,KAAe;QAClC,KAAK,CACH,2BAA2B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;YACtD,uFAAuF;YACvF,4EAA4E,CAC/E,CAAC;QALiB,UAAK,GAAL,KAAK,CAAU;IAMpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,QAAgB,EAChB,MAAc,EACd,KAAY;IAEZ,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;AACrE,CAAC"}

package/dist/context.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Turning flags, environment variables and questions into a connection.
+ *
+ * Every command starts here, so the rules about where a secret may come from
+ * are written once. See `connection.ts` for why none of them is a file.
+ */
+import type { ParsedArgs } from './args.js';
+import { type Connection, type Probe } from './connection.js';
+import { type SqlClient } from './sql.js';
+export declare const CONNECTION_FLAGS: readonly ["db-url", "db-password", "db-region", "project-ref", "supabase-url", "service-role-key"];
+export interface ResolveOptions {
+    /** Ask for what is missing. False in `--yes` runs and when stdin is not a terminal. */
+    interactive: boolean;
+    env?: NodeJS.ProcessEnv;
+    /**
+     * How a candidate pooler host is tried. Injected so the resolution can be
+     * tested without a network, and so nothing else in this file knows a driver
+     * exists.
+     */
+    probe?: Probe;
+    /** How the database is opened. See `CommandDeps`. */
+    connect?: Connector | undefined;
+}
+/** Opens a connection string. The network driver, unless a test says otherwise. */
+export type Connector = (dbUrl: string) => Promise<SqlClient>;
+/**
+ * What a command may be handed instead of reaching for it.
+ *
+ * One thing: the way a database is opened. The tests plug PGlite in here and
+ * then run the commands themselves — flags, output, exit code — rather than
+ * the functions underneath them, which is the only way to hold every command
+ * to the same output contract.
+ */
+export interface CommandDeps {
+    connect?: Connector | undefined;
+}
+/** Opens the connection, closes it, and answers whether that worked. */
+export declare const connectProbe: Probe;
+/** Works out how to reach the database, without connecting yet. */
+export declare function resolveConnection(args: ParsedArgs, options: ResolveOptions): Promise<Connection>;
+export interface Context {
+    db: SqlClient;
+    connection: Connection;
+}
+/** Resolves and opens. The caller closes. */
+export declare function openDatabase(args: ParsedArgs, options: ResolveOptions): Promise<Context>;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAWL,KAAK,UAAU,EACf,KAAK,KAAK,EACX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAW,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAGnD,eAAO,MAAM,gBAAgB,oGAOnB,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,uFAAuF;IACvF,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACjC;AAED,mFAAmF;AACnF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;AAE9D;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACjC;AAED,wEAAwE;AACxE,eAAO,MAAM,YAAY,EAAE,KAQ1B,CAAC;AAEF,mEAAmE;AACnE,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,UAAU,CAAC,CAmErB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,SAAS,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;CACxB;AAED,6CAA6C;AAC7C,wBAAsB,YAAY,CAChC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,OAAO,CAAC,CASlB"}

package/dist/context.js

@@ -0,0 +1,93 @@
+/**
+ * Turning flags, environment variables and questions into a connection.
+ *
+ * Every command starts here, so the rules about where a secret may come from
+ * are written once. See `connection.ts` for why none of them is a file.
+ */
+import { UsageError, stringFlag } from './args.js';
+import { ENV_DB_URL, ENV_DB_URL_FALLBACK, ENV_SERVICE_ROLE_KEY, ENV_SUPABASE_URL, hostOf, looksLikeConnectionString, pickPoolerUrl, projectRefFrom, supabaseUrlFor, withSsl, } from './connection.js';
+import { NotInteractiveError, askSecret, isInteractive } from './prompt.js';
+import { connect } from './sql.js';
+import { dim, note } from './ui.js';
+export const CONNECTION_FLAGS = [
+    'db-url',
+    'db-password',
+    'db-region',
+    'project-ref',
+    'supabase-url',
+    'service-role-key',
+];
+/** Opens the connection, closes it, and answers whether that worked. */
+export const connectProbe = async (dbUrl) => {
+    try {
+        const db = await connect(dbUrl);
+        await db.close();
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/** Works out how to reach the database, without connecting yet. */
+export async function resolveConnection(args, options) {
+    const env = options.env ?? process.env;
+    const interactive = options.interactive && isInteractive();
+    const supabaseUrlGiven = stringFlag(args, 'supabase-url') ?? env[ENV_SUPABASE_URL];
+    const serviceRoleKey = stringFlag(args, 'service-role-key') ?? env[ENV_SERVICE_ROLE_KEY];
+    let dbUrl = stringFlag(args, 'db-url') ?? env[ENV_DB_URL] ?? env[ENV_DB_URL_FALLBACK];
+    let projectRef = projectRefFrom(stringFlag(args, 'project-ref')) ??
+        projectRefFrom(supabaseUrlGiven) ??
+        projectRefFrom(dbUrl);
+    const region = stringFlag(args, 'db-region');
+    if (dbUrl === undefined && projectRef !== undefined && region !== undefined) {
+        const password = stringFlag(args, 'db-password') ??
+            env['EKWO_DB_PASSWORD'] ??
+            (interactive
+                ? await askSecret(`Database password for project ${projectRef}:`)
+                : undefined);
+        if (password === undefined || password.length === 0) {
+            throw new NotInteractiveError('the database password', '--db-password or --db-url');
+        }
+        // Both pooler generations are tried and the one that answers is kept. The
+        // prefix is not derivable from the region, and building one of the two and
+        // calling it the host is how `--db-region` used to fail: the connection
+        // was refused with "Tenant or user not found", which reads like a wrong
+        // password rather than a wrong hostname.
+        dbUrl = await pickPoolerUrl(projectRef, password, region, options.probe ?? connectProbe);
+        note(dim(`Session pooler: ${hostOf(dbUrl)}`));
+    }
+    // No `--db-region`, or no ref at all: ask for the string the dashboard
+    // prints. The direct host `db.<ref>.supabase.co` is not built here on the
+    // operator's behalf — it resolves to IPv6 only on any recent project, so
+    // deriving it silently produces a hang rather than an answer.
+    if (dbUrl === undefined) {
+        if (!interactive) {
+            throw new NotInteractiveError('the database connection string', '--db-url (or --project-ref with --db-password and --db-region)');
+        }
+        const answer = await askSecret('Postgres connection string (Supabase dashboard → Connect → Session pooler):');
+        if (!looksLikeConnectionString(answer)) {
+            throw new UsageError(`bad_connection_string: expected something starting with postgresql://, got "${answer.slice(0, 24)}…"`);
+        }
+        dbUrl = answer;
+        projectRef = projectRef ?? projectRefFrom(dbUrl);
+    }
+    const supabaseUrl = supabaseUrlGiven ?? (projectRef !== undefined ? supabaseUrlFor(projectRef) : undefined);
+    return {
+        dbUrl: withSsl(dbUrl),
+        ...(supabaseUrl !== undefined ? { supabaseUrl } : {}),
+        ...(serviceRoleKey !== undefined ? { serviceRoleKey } : {}),
+        ...(projectRef !== undefined ? { projectRef } : {}),
+    };
+}
+/** Resolves and opens. The caller closes. */
+export async function openDatabase(args, options) {
+    const connection = await resolveConnection(args, options);
+    const db = await (options.connect ?? connect)(connection.dbUrl);
+    // The exception, announced. Everything that keeps books signs in as a
+    // person; what installs and operates connects as the owner of the database,
+    // to whom no policy applies, and a reader of the log should not have to
+    // know which commands are which.
+    note(dim('Connected as the owner of the database: installing and operating, not keeping books. Row level security does not apply to this connection.'));
+    return { db, connection };
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,MAAM,EACN,yBAAyB,EACzB,aAAa,EACb,cAAc,EACd,cAAc,EACd,OAAO,GAGR,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAkB,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ;IACR,aAAa;IACb,WAAW;IACX,aAAa;IACb,cAAc;IACd,kBAAkB;CACV,CAAC;AA+BX,wEAAwE;AACxE,MAAM,CAAC,MAAM,YAAY,GAAU,KAAK,EAAE,KAAK,EAAE,EAAE;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAgB,EAChB,OAAuB;IAEvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,aAAa,EAAE,CAAC;IAE3D,MAAM,gBAAgB,GAAG,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnF,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEzF,IAAI,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAEtF,IAAI,UAAU,GACZ,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC/C,cAAc,CAAC,gBAAgB,CAAC;QAChC,cAAc,CAAC,KAAK,CAAC,CAAC;IAExB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAE7C,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,QAAQ,GACZ,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC;YAC/B,GAAG,CAAC,kBAAkB,CAAC;YACvB,CAAC,WAAW;gBACV,CAAC,CAAC,MAAM,SAAS,CAAC,iCAAiC,UAAU,GAAG,CAAC;gBACjE,CAAC,CAAC,SAAS,CAAC,CAAC;QACjB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,2BAA2B,CAAC,CAAC;QACtF,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,yCAAyC;QACzC,KAAK,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC;QACzF,IAAI,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,EAChC,gEAAgE,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,6EAA6E,CAC9E,CAAC;QACF,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,UAAU,CAClB,+EAA+E,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CACvG,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,MAAM,CAAC;QACf,UAAU,GAAG,UAAU,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,WAAW,GACf,gBAAgB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE1F,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QACrB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAOD,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAgB,EAChB,OAAuB;IAEvB,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAChE,sEAAsE;IACtE,4EAA4E;IAC5E,wEAAwE;IACxE,iCAAiC;IACjC,IAAI,CAAC,GAAG,CAAC,4IAA4I,CAAC,CAAC,CAAC;IACxJ,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;AAC5B,CAAC"}

package/dist/doctor.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `ekwo doctor` — the checks worth running on a live installation.
+ *
+ * Each one is something that is true of a healthy database and that nothing
+ * in the schema can enforce on its own: a table someone added without row
+ * level security, a migration that never landed, a membership row pointing at
+ * a user who has since been deleted, a bank statement whose declared closing
+ * balance does not match its lines.
+ *
+ * The doctor reads and reports. It never repairs: the fix for a missing
+ * policy is a migration, and the fix for an orphaned membership is a decision
+ * about who should have access, not a delete the installer guesses at.
+ */
+import { type ExpectedObjects } from './inventory.js';
+import type { Migration } from './migrations.js';
+import type { SqlClient } from './sql.js';
+export type Severity = 'ok' | 'warning' | 'problem';
+export interface Check {
+    name: string;
+    severity: Severity;
+    summary: string;
+    /** Lines of evidence, printed under the summary. */
+    details?: string[];
+    /**
+     * The check's own findings, whole, for `--json`. The printed form is a
+     * summary of this and a machine reading the report should not have to parse
+     * English back into a list.
+     */
+    data?: Record<string, unknown>;
+}
+export interface DoctorReport {
+    checks: Check[];
+    problems: number;
+    warnings: number;
+}
+export interface DoctorOptions {
+    /**
+     * The inventory to compare the catalogue against. Defaults to the one this
+     * CLI ships; a test passes its own to describe a schema that is not this
+     * release's.
+     */
+    expected?: ExpectedObjects;
+}
+export declare function doctor(db: SqlClient, migrations: Migration[], options?: DoctorOptions): Promise<DoctorReport>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,wBAAsB,MAAM,CAC1B,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,SAAS,EAAE,EACvB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CA0BvB"}