ekwo-os 0.4.1

package/dist/grants.js

@@ -0,0 +1,174 @@
+/**
+ * The privileges the schema declares, and how a live database is compared to
+ * them.
+ *
+ * Since `20260914151207` every table, view and function of Ekwo names the
+ * roles that may reach it, in the migration that creates it. Before that the
+ * privileges came from a Supabase project's default privileges on `public`,
+ * which gave `anon` — the role behind the publishable key — `all` on every
+ * table of the ledger, and which vanish the day somebody recreates the schema.
+ *
+ * The declaration travels in `packages/cli/assets/expected-objects.json`,
+ * under `grants` in each schema's section: the same inventory that carries the
+ * tables, the policies and the triggers a release defines, generated by
+ * `scripts/generate-expected-objects.mjs` from a freshly migrated database and
+ * committed. One file, because the privileges of an object and the object are
+ * the same release. This module reads the same catalogue out of a live
+ * installation and says where the two differ:
+ *
+ *   - a **missing** grant is a problem. It is the failure PostgREST reports as
+ *     "permission denied for table companies" to the first user, and it passes
+ *     every other check there is.
+ *   - an **extra** grant to `anon` is a problem. The anonymous role reaches
+ *     the policy helpers and nothing else; anything more is a surface somebody
+ *     opened by hand or a default privilege that was never taken away.
+ *   - an **extra** grant to `authenticated` or `service_role` is a warning. It
+ *     is usually a local customisation and it is never nothing: row level
+ *     security is then the only thing refusing a verb the schema meant to
+ *     withhold.
+ *
+ * The SQL that describes a schema lives here rather than in the generator, so
+ * that the file and the check can never read the catalogue two different ways.
+ * `inventory.ts` calls `describeGrants` to fill the section, and `doctor.ts`
+ * calls it again on the live database and hands both to `compareSection`.
+ */
+/** The three roles a Supabase project exposes to a client. */
+export const GRANT_ROLES = ['anon', 'authenticated', 'service_role'];
+const KINDS = `'r', 'p', 'v', 'm', 'S'`;
+/**
+ * Every privilege one schema hands to the three roles, object by object.
+ *
+ * `aclexplode` turns an `aclitem[]` into one row per grantee and privilege,
+ * which is the only shape worth comparing: the text form of an ACL depends on
+ * the owner's name and on the order the privileges happen to sit in. The
+ * owner's own grants are dropped — they are not a declaration, they are what
+ * owning a table means.
+ */
+export async function describeGrants(rows, schema) {
+    const q = (sql) => rows(sql, [schema]);
+    const relations = await q(`select c.relname as key,
+            pg_get_userbyid((aclexplode(c.relacl)).grantee) as grantee,
+            lower((aclexplode(c.relacl)).privilege_type) as privilege
+       from pg_class c
+       join pg_namespace n on n.oid = c.relnamespace
+      where n.nspname = $1 and c.relkind in (${KINDS})`);
+    const names = await q(`select c.relname as name, c.relkind as kind
+       from pg_class c
+       join pg_namespace n on n.oid = c.relnamespace
+      where n.nspname = $1 and c.relkind in (${KINDS})
+      order by c.relname`);
+    const functions = await q(`select p.proname as name,
+            pg_get_function_identity_arguments(p.oid) as arguments,
+            p.prorettype::regtype::text = 'trigger' as is_trigger
+       from pg_proc p
+       join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = $1
+      order by p.proname, pg_get_function_identity_arguments(p.oid)`);
+    const functionAcl = await q(`select p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')' as key,
+            pg_get_userbyid((aclexplode(p.proacl)).grantee) as grantee,
+            lower((aclexplode(p.proacl)).privilege_type) as privilege
+       from pg_proc p
+       join pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = $1`);
+    // `create` on the schema is not a client privilege and is not Ekwo's to
+    // declare: a Supabase project gives it to `postgres` and `service_role`, and
+    // a self-hosted one may give it to whoever runs the migrations.
+    const schemaAcl = (await q(`select n.nspname as key,
+              pg_get_userbyid((aclexplode(n.nspacl)).grantee) as grantee,
+              lower((aclexplode(n.nspacl)).privilege_type) as privilege
+         from pg_namespace n
+        where n.nspname = $1`)).filter((r) => r.privilege !== 'create');
+    const defaults = (await q(`select pg_get_userbyid(d.defaclrole) as owner,
+              d.defaclobjtype as object,
+              pg_get_userbyid((aclexplode(d.defaclacl)).grantee) as grantee,
+              lower((aclexplode(d.defaclacl)).privilege_type) as privilege
+         from pg_default_acl d
+         join pg_namespace n on n.oid = d.defaclnamespace
+        where n.nspname = $1`))
+        .filter((r) => GRANT_ROLES.includes(r.grantee))
+        .map((r) => `${r.owner}:${r.object}:${r.grantee}:${r.privilege}`)
+        .sort();
+    const held = (acl, key) => {
+        const out = {};
+        for (const role of GRANT_ROLES) {
+            out[role] = acl
+                .filter((r) => r.grantee === role && r.key === key)
+                .map((r) => r.privilege)
+                .sort();
+        }
+        return out;
+    };
+    const section = (kinds) => names
+        .filter((n) => kinds.includes(n.kind))
+        .map((n) => ({ name: n.name, ...held(relations, n.name) }));
+    return {
+        schema,
+        usage: held(schemaAcl, schema),
+        tables: section(['r', 'p']),
+        views: section(['v', 'm']),
+        sequences: section(['S']),
+        functions: functions.map((f) => ({
+            name: f.name,
+            arguments: f.arguments,
+            ...(f.is_trigger ? { trigger: true } : {}),
+            ...held(functionAcl, `${f.name}(${f.arguments})`),
+        })),
+        defaultPrivileges: defaults,
+    };
+}
+/** One object, expected against actual, for the three roles. */
+function compareObject(schema, label, expected, actual, found) {
+    for (const role of GRANT_ROLES) {
+        const want = new Set(expected?.[role] ?? []);
+        const have = new Set(actual?.[role] ?? []);
+        const missing = [...want].filter((p) => !have.has(p)).sort();
+        const extra = [...have].filter((p) => !want.has(p)).sort();
+        if (missing.length > 0) {
+            found.push({ schema, object: label, role, difference: 'missing', privileges: missing });
+        }
+        if (extra.length > 0) {
+            found.push({ schema, object: label, role, difference: 'extra', privileges: extra });
+        }
+    }
+}
+const label = (o, kind) => kind === 'function' ? `function ${o.name}(${o.arguments ?? ''})` : `${kind} ${o.name}`;
+/** Every difference between what a schema declares and what it holds. */
+export function compareSection(expected, actual) {
+    const found = [];
+    compareObject(expected.schema, `schema ${expected.schema}`, expected.usage, actual.usage, found);
+    for (const [kind, key] of [
+        ['table', 'tables'],
+        ['view', 'views'],
+        ['sequence', 'sequences'],
+        ['function', 'functions'],
+    ]) {
+        const wanted = expected[key];
+        const held = actual[key];
+        const byKey = new Map(held.map((o) => [label(o, kind), o]));
+        for (const object of wanted) {
+            const name = label(object, kind);
+            // An object that is not there at all is the inventory of objects'
+            // business — `ekwo doctor` reports a pending migration for that. Here it
+            // would only produce a second, noisier way of saying the same thing.
+            const counterpart = byKey.get(name);
+            if (counterpart === undefined)
+                continue;
+            compareObject(expected.schema, name, object, counterpart, found);
+            byKey.delete(name);
+        }
+        // What is left is an object this release never declared. Its grants are
+        // still worth reporting when they reach `anon`: a table somebody added by
+        // hand, readable without signing in, is the shape of the hole this whole
+        // change is about.
+        for (const [name, object] of byKey) {
+            compareObject(expected.schema, name, undefined, object, found);
+        }
+    }
+    return found;
+}
+/** A finding as one line of the doctor's output. */
+export function describeFinding(finding) {
+    const verb = finding.difference === 'missing' ? 'is missing' : 'holds an extra';
+    return `${finding.schema}.${finding.object}: ${finding.role} ${verb} ${finding.privileges.join(', ')}`;
+}
+//# sourceMappingURL=grants.js.map

package/dist/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,CAAU,CAAC;AAiC9E,MAAM,KAAK,GAAG,yBAAyB,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,MAAc;IAClE,MAAM,CAAC,GAAG,CAAI,GAAW,EAAE,EAAE,CAAC,IAAI,CAAI,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAErD,MAAM,SAAS,GAAG,MAAM,CAAC,CACvB;;;;;+CAK2C,KAAK,GAAG,CACpD,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,CACnB;;;+CAG2C,KAAK;yBAC3B,CACtB,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,CACvB;;;;;;oEAMgE,CACjE,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,CACzB;;;;;2BAKuB,CACxB,CAAC;IAEF,wEAAwE;IACxE,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,SAAS,GAAG,CAChB,MAAM,CAAC,CACL;;;;6BAIuB,CACxB,CACF,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,CACf,MAAM,CAAC,CACL;;;;;;6BAMuB,CACxB,CACF;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,WAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;SAChE,IAAI,EAAE,CAAC;IAEV,MAAM,IAAI,GAAG,CAAC,GAA0D,EAAE,GAAW,EAAU,EAAE;QAC/F,MAAM,GAAG,GAAG,EAAY,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;iBACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;iBAClD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;iBACvB,IAAI,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,KAAe,EAAmB,EAAE,CACnD,KAAK;SACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhE,OAAO;QACL,MAAM;QACN,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9B,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC;SAClD,CAAC,CAAC;QACH,iBAAiB,EAAE,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAcD,gEAAgE;AAChE,SAAS,aAAa,CACpB,MAAc,EACd,KAAa,EACb,QAA4B,EAC5B,MAA0B,EAC1B,KAAqB;IAErB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,IAAY,EAAU,EAAE,CACvD,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAEzF,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,QAAuB,EAAE,MAAqB;IAC3E,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEjG,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI;QACxB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACnB,CAAC,MAAM,EAAE,OAAO,CAAC;QACjB,CAAC,UAAU,EAAE,WAAW,CAAC;QACzB,CAAC,UAAU,EAAE,WAAW,CAAC;KACjB,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACjC,kEAAkE;YAClE,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,WAAW,KAAK,SAAS;gBAAE,SAAS;YACxC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACjE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,mBAAmB;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACnC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,OAAqB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAChF,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzG,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Who a bookkeeping command acts as, on which instance, for which company.
+ *
+ * Three places can say, and the order is the card's: **the environment first**
+ * — a CI job sets `SUPABASE_URL`, `SUPABASE_ANON_KEY` and either
+ * `EKWO_ACCESS_TOKEN` or `EKWO_EMAIL` with `EKWO_PASSWORD`, the variables the
+ * MCP server reads, and then nothing is read from or written to the disk —
+ * and otherwise **a profile**: `--profile`, else `EKWO_PROFILE`, else the one
+ * the last `ekwo login` made current.
+ *
+ * The environment is taken whole or not at all. Credentials in the
+ * environment with the instance in a profile would send a token to a host
+ * nobody named next to it, so that is a wrong call and not a fallback.
+ *
+ * A `service_role` key is refused at every door it can arrive by: the
+ * publishable-key slot, the token slot, a session file somebody edited, and
+ * the `--service-role-key` flag that `ekwo init` takes — typed out of habit
+ * on a command that keeps books. `init` and `migrate` remain the exception,
+ * and say so when they connect.
+ */
+import { type KeySlot } from '@ekwo-ai/core';
+import { type ParsedArgs } from './args.js';
+import { type CompanyRef } from './profiles.js';
+import { UserClient } from './rest.js';
+import { type FetchLike } from './session.js';
+/** The flags every command that acts as a person accepts. */
+export declare const IDENTITY_FLAGS: readonly ["profile", "company", "supabase-url", "anon-key"];
+export interface UserDeps {
+    fetchImpl?: FetchLike | undefined;
+    env?: NodeJS.ProcessEnv | undefined;
+}
+export interface Acting {
+    client: UserClient;
+    /** Absent when the environment said who: no profile was read. */
+    profile: string | undefined;
+    source: 'environment' | 'profile';
+    /** The company the profile holds. `--company` is resolved by the caller, against the instance. */
+    storedCompany: CompanyRef | undefined;
+    configDir: string;
+}
+export declare function refuseServiceRole(key: string | undefined, where: string, slot: KeySlot): void;
+/** `--service-role-key` on a command that keeps books: refused by name, not as an unknown option. */
+export declare function refuseInstallerKey(args: ParsedArgs): void;
+export declare function profileName(args: ParsedArgs, env: NodeJS.ProcessEnv): string | undefined;
+/**
+ * `fetch`, saying where it could not get to.
+ *
+ * Node's own failure is "fetch failed" and the reason is in `cause`; a caller
+ * with a shell deserves the host and the reason in the one line it reads.
+ */
+export declare function fetchOf(deps: UserDeps): FetchLike;
+/** Opens the instance as whoever the environment or the profile says. */
+export declare function actAsUser(args: ParsedArgs, deps?: UserDeps): Promise<Acting>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAsD,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AACjG,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAQL,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAU,KAAK,SAAS,EAAiB,MAAM,cAAc,CAAC;AAGrE,6DAA6D;AAC7D,eAAO,MAAM,cAAc,6DAA8D,CAAC;AAK1F,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,UAAU,CAAC;IACnB,iEAAiE;IACjE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC;IAClC,kGAAkG;IAClG,aAAa,EAAE,UAAU,GAAG,SAAS,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAI7F;AAED,qGAAqG;AACrG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAMzD;AAOD,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAWjD;AAED,yEAAyE;AACzE,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAsEtF"}

package/dist/identity.js

@@ -0,0 +1,132 @@
+/**
+ * Who a bookkeeping command acts as, on which instance, for which company.
+ *
+ * Three places can say, and the order is the card's: **the environment first**
+ * — a CI job sets `SUPABASE_URL`, `SUPABASE_ANON_KEY` and either
+ * `EKWO_ACCESS_TOKEN` or `EKWO_EMAIL` with `EKWO_PASSWORD`, the variables the
+ * MCP server reads, and then nothing is read from or written to the disk —
+ * and otherwise **a profile**: `--profile`, else `EKWO_PROFILE`, else the one
+ * the last `ekwo login` made current.
+ *
+ * The environment is taken whole or not at all. Credentials in the
+ * environment with the instance in a profile would send a token to a host
+ * nobody named next to it, so that is a wrong call and not a fallback.
+ *
+ * A `service_role` key is refused at every door it can arrive by: the
+ * publishable-key slot, the token slot, a session file somebody edited, and
+ * the `--service-role-key` flag that `ekwo init` takes — typed out of habit
+ * on a command that keeps books. `init` and `migrate` remain the exception,
+ * and say so when they connect.
+ */
+import { IDENTITY_ENV, isServiceRoleKey, serviceRoleRefusal } from '@ekwo-ai/core';
+import { UsageError, stringFlag } from './args.js';
+import { ENV_PROFILE, assertProfileName, configDir, credentialsAreExposed, readProfiles, readSession, writeSession, } from './profiles.js';
+import { UserClient } from './rest.js';
+import { signIn } from './session.js';
+import { warn } from './ui.js';
+/** The flags every command that acts as a person accepts. */
+export const IDENTITY_FLAGS = ['profile', 'company', 'supabase-url', 'anon-key'];
+const SURFACE = 'this command line';
+const SIGN_IN = 'run `ekwo login`';
+export function refuseServiceRole(key, where, slot) {
+    if (key !== undefined && isServiceRoleKey(key)) {
+        throw new UsageError(serviceRoleRefusal(where, slot, SURFACE, SIGN_IN));
+    }
+}
+/** `--service-role-key` on a command that keeps books: refused by name, not as an unknown option. */
+export function refuseInstallerKey(args) {
+    if (args.flags.has('service-role-key')) {
+        throw new UsageError(`service_role_refused: --service-role-key is for \`ekwo init\`, which installs. A command that keeps books acts as a person, under row level security, and never takes that key. Run \`ekwo login\` instead.`);
+    }
+}
+function trimmed(env, name) {
+    const value = env[name]?.trim();
+    return value === undefined || value.length === 0 ? undefined : value;
+}
+export function profileName(args, env) {
+    const named = stringFlag(args, 'profile') ?? trimmed(env, ENV_PROFILE);
+    return named === undefined ? undefined : assertProfileName(named);
+}
+/**
+ * `fetch`, saying where it could not get to.
+ *
+ * Node's own failure is "fetch failed" and the reason is in `cause`; a caller
+ * with a shell deserves the host and the reason in the one line it reads.
+ */
+export function fetchOf(deps) {
+    const fetchImpl = deps.fetchImpl ?? ((url, init) => globalThis.fetch(url, init));
+    return async (url, init) => {
+        try {
+            return await fetchImpl(url, init);
+        }
+        catch (error) {
+            const cause = error.cause;
+            const why = cause?.code ?? cause?.message ?? error.message;
+            throw new Error(`instance_unreachable: ${new URL(url).origin} did not answer (${why})`);
+        }
+    };
+}
+/** Opens the instance as whoever the environment or the profile says. */
+export async function actAsUser(args, deps = {}) {
+    refuseInstallerKey(args);
+    const env = deps.env ?? process.env;
+    const fetchImpl = fetchOf(deps);
+    const dir = configDir(env);
+    const accessToken = trimmed(env, IDENTITY_ENV.accessToken);
+    const email = trimmed(env, IDENTITY_ENV.email);
+    const password = trimmed(env, IDENTITY_ENV.password);
+    if (accessToken !== undefined || (email !== undefined && password !== undefined)) {
+        const supabaseUrl = stringFlag(args, 'supabase-url') ?? trimmed(env, IDENTITY_ENV.supabaseUrl);
+        const anonKey = stringFlag(args, 'anon-key') ?? trimmed(env, IDENTITY_ENV.anonKey);
+        if (supabaseUrl === undefined || anonKey === undefined) {
+            throw new UsageError(`missing_configuration: the environment names a user and not the instance. Set ${IDENTITY_ENV.supabaseUrl} and ${IDENTITY_ENV.anonKey} beside it, or unset ${IDENTITY_ENV.accessToken}, ${IDENTITY_ENV.email} and ${IDENTITY_ENV.password} to use a profile.`);
+        }
+        refuseServiceRole(anonKey, IDENTITY_ENV.anonKey, 'apikey');
+        refuseServiceRole(accessToken, IDENTITY_ENV.accessToken, 'authorization');
+        const instance = { supabaseUrl, anonKey };
+        const signInAgain = `Set a fresh ${IDENTITY_ENV.accessToken}.`;
+        if (accessToken !== undefined) {
+            const client = new UserClient({ instance, fetchImpl, accessToken, signInAgain });
+            return { client, profile: undefined, source: 'environment', storedCompany: undefined, configDir: dir };
+        }
+        // Signed in for this one command, in memory. Nothing is written.
+        const { session } = await signIn(fetchImpl, instance, email, password);
+        const client = new UserClient({
+            instance,
+            fetchImpl,
+            accessToken: session.access_token,
+            refreshToken: session.refresh_token,
+            expiresAt: session.expires_at,
+            signInAgain,
+        });
+        return { client, profile: undefined, source: 'environment', storedCompany: undefined, configDir: dir };
+    }
+    const file = await readProfiles(dir);
+    const name = profileName(args, env) ?? file.current;
+    const profile = name === undefined ? undefined : file.profiles[name];
+    if (name === undefined || profile === undefined) {
+        throw new UsageError(name === undefined
+            ? 'not_signed_in: nobody is signed in. Run `ekwo login`, or set the environment variables `ekwo --help` lists under "Acting as a person".'
+            : `unknown_profile: there is no profile called ${name}. Run \`ekwo login --profile ${name}\`. Known: ${Object.keys(file.profiles).sort().join(', ') || 'none'}.`);
+    }
+    const session = await readSession(dir, name);
+    if (session === undefined) {
+        throw new UsageError(`not_signed_in: the profile ${name} holds no session. Run \`ekwo login --profile ${name}\`.`);
+    }
+    refuseServiceRole(profile.anon_key, `the profile ${name}`, 'apikey');
+    refuseServiceRole(session.access_token, `the session of the profile ${name}`, 'authorization');
+    if (await credentialsAreExposed(dir)) {
+        warn(`the session file in ${dir} can be read by other users of this machine. \`chmod 600\` it.`);
+    }
+    const client = new UserClient({
+        instance: { supabaseUrl: profile.supabase_url, anonKey: profile.anon_key },
+        fetchImpl,
+        accessToken: session.access_token,
+        refreshToken: session.refresh_token,
+        expiresAt: session.expires_at,
+        onRenewed: (renewed) => writeSession(dir, name, renewed),
+        signInAgain: `Run \`ekwo login --profile ${name}\`.`,
+    });
+    return { client, profile: name, source: 'profile', storedCompany: profile.company, configDir: dir };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAgB,MAAM,eAAe,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAC;AACpE,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,SAAS,EACT,qBAAqB,EACrB,YAAY,EACZ,WAAW,EACX,YAAY,GAEb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,MAAM,EAAiC,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,CAAU,CAAC;AAE1F,MAAM,OAAO,GAAG,mBAAmB,CAAC;AACpC,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAiBnC,MAAM,UAAU,iBAAiB,CAAC,GAAuB,EAAE,KAAa,EAAE,IAAa;IACrF,IAAI,GAAG,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,kBAAkB,CAAC,IAAgB;IACjD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,UAAU,CAClB,6MAA6M,CAC9M,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAsB,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,GAAsB;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACvE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAc;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACjF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAI,KAAyD,CAAC,KAAK,CAAC;YAC/E,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,OAAO,IAAK,KAAe,CAAC,OAAO,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,OAAiB,EAAE;IACnE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;IAErD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QACjF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACnF,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CAClB,iFAAiF,YAAY,CAAC,WAAW,QAAQ,YAAY,CAAC,OAAO,wBAAwB,YAAY,CAAC,WAAW,KAAK,YAAY,CAAC,KAAK,QAAQ,YAAY,CAAC,QAAQ,oBAAoB,CAC9P,CAAC;QACJ,CAAC;QACD,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3D,iBAAiB,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,eAAe,YAAY,CAAC,WAAW,GAAG,CAAC;QAE/D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACzG,CAAC;QACD,iEAAiE;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAe,EAAE,QAAkB,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;YAC5B,QAAQ;YACR,SAAS;YACT,WAAW,EAAE,OAAO,CAAC,YAAY;YACjC,YAAY,EAAE,OAAO,CAAC,aAAa;YACnC,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACzG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,UAAU,CAClB,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,wIAAwI;YAC1I,CAAC,CAAC,+CAA+C,IAAI,gCAAgC,IAAI,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CACnK,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,8BAA8B,IAAI,iDAAiD,IAAI,KAAK,CAAC,CAAC;IACrH,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,8BAA8B,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;IAC/F,IAAI,MAAM,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,uBAAuB,GAAG,gEAAgE,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC1E,SAAS;QACT,WAAW,EAAE,OAAO,CAAC,YAAY;QACjC,YAAY,EAAE,OAAO,CAAC,aAAa;QACnC,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC;QACxD,WAAW,EAAE,8BAA8B,IAAI,KAAK;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACtG,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The CLI as a library.
+ *
+ * Exported so the tests can drive the same code paths a terminal would, and
+ * so another tool can reuse the migration runner and the installation
+ * sequence without shelling out.
+ */
+export { parseArgs, UsageError, type ParsedArgs } from './args.js';
+export { createAuthUser, findAuthUserByEmail, type AuthUser, type CreateAuthUser, type CreateAuthUserOptions, type FetchLike, } from './auth.js';
+export { availableCountries, bootstrap, countryCharts, countryLanguage, countryPack, installedPacks, schemaIsInstalled, type ChartChoice, type InstalledPack, type PackSummary, type BootstrapOptions, type BootstrapResult, type Step, } from './bootstrap.js';
+export { DEMO_SEED, migrationsDir, resolveBundleDir, seedDir } from './bundle.js';
+export { OPERATOR_CHECKLIST, printOperatorChecklist, type OperatorInstruction, } from './checklist.js';
+export { describeCertification, needsWarning, type Certification, type CertificationFacts } from './pack/certification.js';
+export { describeFiling, filingReadiness, type FilingReadiness } from './pack/filing.js';
+export { compileAssetsSeed, compileFrameworkPack, compileModuleSeeds, compilePack, frameworkSeedFileName, moduleSeedFileName, seedFileName, seedFileNames, } from './pack/compile.js';
+export { DEFAULT_CHART, GENERIC_PACK, declaredSeedSequences, listPacks, packsDir, parseCsv, readFrameworkPack, readPack, readSchema, repoRootDir, resolveBoxRef, seedOutputDir, sourcesOf, vatRegime, PackError, type FrameworkManifest, type FrameworkPack, type Manifest, type Pack, type PackAccount, type PackChart, type PackPosting, type PackReport, type PackReportBox, type PackStatement, type PackStatementLine, type PackStatementRule, type PackTax, type PackCertification, type PackSource, type PackAssets, type PackAssetCategory, type PackGolden, type PackGoldenContact, type PackGoldenDocument, type PackGoldenPayment, } from './pack/read.js';
+export { CATEGORY_CODES, COMMON_SYSTEM, TREATMENT_CODES, taxCodes, type CodeIssue, type TaxCodes, type TreatmentCodes, type VatRegime, } from './pack/vat-codes.js';
+export { euVatScopeOf, parseTerritorySeed, readTerritories, territoryOf, territoryWithin, TerritoryError, type EuVatScope, type Territory, } from './pack/territories.js';
+export { validate, type Issue } from './pack/schema.js';
+export { packDiff, packStatus, packUpgrade, resolveCompany, type CompanyPackStatus, type PackChange, type PackStatusReport, type PackUpgradeResult, type UpgradeOptions, } from './pack/upgrade.js';
+export { allModuleMigrations, exposeSchemaNote, listModules, moduleMigrations, moduleSeeds, readModule, readModuleSchema, resolveModulesDir, ModuleError, type EkwoModule, type ModuleManifest, } from './module/read.js';
+export { applyModuleMigrations, moduleCommand, MODULE_FLAGS } from './commands/module.js';
+export { companyCommand, COMPANY_FLAGS, readArchive, type ArchiveManifest, type ArchiveTable, } from './commands/company.js';
+export { snapshotRecommendation } from './commands/migrate.js';
+export { SCHEMA_MIN } from './schema.js';
+export { COMMANDS, help, run, version, type RunDeps } from './cli.js';
+export { EXIT_ERROR, EXIT_OK, EXIT_REFUSED, EXIT_USAGE, classify, commandLabel, execute, setContext, setResult, type ErrorKind, type OutputContext, type OutputDocument, type OutputError, } from './output.js';
+export type { CommandDeps, Connector } from './context.js';
+export { matchCompany } from './company.js';
+export { IDENTITY_FLAGS, actAsUser, type Acting, type UserDeps } from './identity.js';
+export { ENV_CONFIG_DIR, ENV_PROFILE, assertOutsideRepository, configDir, readProfiles, readSession, type Profile, type ProfilesFile, type StoredSession, } from './profiles.js';
+export { RestError, UserClient } from './rest.js';
+export { AuthError, refreshSession, signIn } from './session.js';
+export { CONFIG_FILE, readConfig, writeConfig, type EkwoConfig } from './config.js';
+export { NoPoolerHostError, POOLER_GENERATIONS, hostOf, pickPoolerUrl, poolerCandidates, poolerUrl, projectRefFrom, supabaseUrlFor, withSsl, type Connection, type Probe, } from './connection.js';
+export { doctor, type Check, type DoctorOptions, type DoctorReport, type Severity } from './doctor.js';
+export { compareCatalogue, describeDifferences, installedSections, readExpectedObjects, readGrants, resolveInventoryPath, InventoryError, type CatalogueComparison, type CategoryDiff, type ExpectedObjects, type ExpectedSchema, type ExpectedModule, type SectionComparison, } from './inventory.js';
+export { GRANT_ROLES, compareSection, describeFinding, describeGrants, type Difference, type GrantFinding, type GrantRole, type GrantedObject, type GrantsSection, type HeldBy, type QueryRows, } from './grants.js';
+export { applyMigration, applyMigrations, appliedVersions, ensureHistory, listMigrations, migrationGap, parseMigrationFile, splitStatements, type Gap, type Migration, } from './migrations.js';
+export { DEFAULT_REGISTRY_URL, anyAdminId, announce, payloadFor, readInstance, register, registryUrl, unregister, type InstanceRow, type RegisterResult, type RegistrationPayload, } from './registry.js';
+export { applyDemoSeed, applySeed, applySeeds, listSeeds, type Seed } from './seeds.js';
+export { asUser, connect, first, scalar, type SqlClient } from './sql.js';
+export { status, syncSchemaVersion, type Status } from './status.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACnE,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,eAAe,EACf,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,IAAI,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,EACb,SAAS,EACT,SAAS,EACT,SAAS,EACT,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,QAAQ,EACR,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,eAAe,EACf,cAAc,EACd,KAAK,UAAU,EACf,KAAK,SAAS,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,QAAQ,EACR,UAAU,EACV,WAAW,EACX,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,KAAK,UAAU,EACf,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,EACL,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,UAAU,EACV,SAAS,EACT,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,MAAM,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,SAAS,EACT,YAAY,EACZ,WAAW,EACX,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EACN,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,KAAK,GACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvG,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,cAAc,EACd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,eAAe,EACf,eAAe,EACf,aAAa,EACb,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,KAAK,GAAG,EACR,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,43 @@
+/**
+ * The CLI as a library.
+ *
+ * Exported so the tests can drive the same code paths a terminal would, and
+ * so another tool can reuse the migration runner and the installation
+ * sequence without shelling out.
+ */
+export { parseArgs, UsageError } from './args.js';
+export { createAuthUser, findAuthUserByEmail, } from './auth.js';
+export { availableCountries, bootstrap, countryCharts, countryLanguage, countryPack, installedPacks, schemaIsInstalled, } from './bootstrap.js';
+export { DEMO_SEED, migrationsDir, resolveBundleDir, seedDir } from './bundle.js';
+export { OPERATOR_CHECKLIST, printOperatorChecklist, } from './checklist.js';
+export { describeCertification, needsWarning } from './pack/certification.js';
+export { describeFiling, filingReadiness } from './pack/filing.js';
+export { compileAssetsSeed, compileFrameworkPack, compileModuleSeeds, compilePack, frameworkSeedFileName, moduleSeedFileName, seedFileName, seedFileNames, } from './pack/compile.js';
+export { DEFAULT_CHART, GENERIC_PACK, declaredSeedSequences, listPacks, packsDir, parseCsv, readFrameworkPack, readPack, readSchema, repoRootDir, resolveBoxRef, seedOutputDir, sourcesOf, vatRegime, PackError, } from './pack/read.js';
+export { CATEGORY_CODES, COMMON_SYSTEM, TREATMENT_CODES, taxCodes, } from './pack/vat-codes.js';
+export { euVatScopeOf, parseTerritorySeed, readTerritories, territoryOf, territoryWithin, TerritoryError, } from './pack/territories.js';
+export { validate } from './pack/schema.js';
+export { packDiff, packStatus, packUpgrade, resolveCompany, } from './pack/upgrade.js';
+export { allModuleMigrations, exposeSchemaNote, listModules, moduleMigrations, moduleSeeds, readModule, readModuleSchema, resolveModulesDir, ModuleError, } from './module/read.js';
+export { applyModuleMigrations, moduleCommand, MODULE_FLAGS } from './commands/module.js';
+export { companyCommand, COMPANY_FLAGS, readArchive, } from './commands/company.js';
+export { snapshotRecommendation } from './commands/migrate.js';
+export { SCHEMA_MIN } from './schema.js';
+export { COMMANDS, help, run, version } from './cli.js';
+export { EXIT_ERROR, EXIT_OK, EXIT_REFUSED, EXIT_USAGE, classify, commandLabel, execute, setContext, setResult, } from './output.js';
+export { matchCompany } from './company.js';
+export { IDENTITY_FLAGS, actAsUser } from './identity.js';
+export { ENV_CONFIG_DIR, ENV_PROFILE, assertOutsideRepository, configDir, readProfiles, readSession, } from './profiles.js';
+export { RestError, UserClient } from './rest.js';
+export { AuthError, refreshSession, signIn } from './session.js';
+export { CONFIG_FILE, readConfig, writeConfig } from './config.js';
+export { NoPoolerHostError, POOLER_GENERATIONS, hostOf, pickPoolerUrl, poolerCandidates, poolerUrl, projectRefFrom, supabaseUrlFor, withSsl, } from './connection.js';
+export { doctor } from './doctor.js';
+export { compareCatalogue, describeDifferences, installedSections, readExpectedObjects, readGrants, resolveInventoryPath, InventoryError, } from './inventory.js';
+export { GRANT_ROLES, compareSection, describeFinding, describeGrants, } from './grants.js';
+export { applyMigration, applyMigrations, appliedVersions, ensureHistory, listMigrations, migrationGap, parseMigrationFile, splitStatements, } from './migrations.js';
+export { DEFAULT_REGISTRY_URL, anyAdminId, announce, payloadFor, readInstance, register, registryUrl, unregister, } from './registry.js';
+export { applyDemoSeed, applySeed, applySeeds, listSeeds } from './seeds.js';
+export { asUser, connect, first, scalar } from './sql.js';
+export { status, syncSchemaVersion } from './status.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAC;AACnE,OAAO,EACL,cAAc,EACd,mBAAmB,GAKpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,eAAe,EACf,WAAW,EACX,cAAc,EACd,iBAAiB,GAOlB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAA+C,MAAM,yBAAyB,CAAC;AAC3H,OAAO,EAAE,cAAc,EAAE,eAAe,EAAwB,MAAM,kBAAkB,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,iBAAiB,EACjB,QAAQ,EACR,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,EACb,SAAS,EACT,SAAS,EACT,SAAS,GAsBV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,EACf,QAAQ,GAKT,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,eAAe,EACf,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAc,MAAM,kBAAkB,CAAC;AACxD,OAAO,EACL,QAAQ,EACR,UAAU,EACV,WAAW,EACX,cAAc,GAMf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,GAGZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,GAGZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAgB,MAAM,UAAU,CAAC;AACtE,OAAO,EACL,UAAU,EACV,OAAO,EACP,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,UAAU,EACV,SAAS,GAKV,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,SAAS,EAA8B,MAAM,eAAe,CAAC;AACtF,OAAO,EACL,cAAc,EACd,WAAW,EACX,uBAAuB,EACvB,SAAS,EACT,YAAY,EACZ,WAAW,GAIZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAmB,MAAM,aAAa,CAAC;AACpF,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,EACN,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,cAAc,EACd,cAAc,EACd,OAAO,GAGR,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAoE,MAAM,aAAa,CAAC;AACvG,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,oBAAoB,EACpB,cAAc,GAOf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,cAAc,GAQf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,eAAe,EACf,eAAe,EACf,aAAa,EACb,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAGhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,GAIX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAa,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAkB,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAe,MAAM,aAAa,CAAC"}