ekwo-os 0.4.1

package/dist/profiles.js

@@ -0,0 +1,187 @@
+/**
+ * Profiles: which instance, as whom, for which company — kept between commands.
+ *
+ * `ekwo.json` is the file of an installation and it is safe to commit, which
+ * is why it may never hold a token. What is kept here is the file of a
+ * person: it lives in their own configuration directory, outside any
+ * repository, and the CLI refuses to write it anywhere else.
+ *
+ * Two files, because they are not the same kind of thing. `profiles.json`
+ * says where each profile points — the instance URL, its publishable key, the
+ * address that signed in, the company in use — and holds nothing a dashboard
+ * does not already show. `credentials.json` holds the session: an access
+ * token that lasts an hour and the refresh token that renews it. Both are
+ * written `0600` in a `0700` directory. The password is never written at all:
+ * it is sent once, to the instance, and forgotten.
+ *
+ * The environment is not read here. A CI job sets its variables and never
+ * touches this directory; see `identity.ts` for the order.
+ */
+import { chmod, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { UsageError } from './args.js';
+export const ENV_CONFIG_DIR = 'EKWO_CONFIG_DIR';
+export const ENV_PROFILE = 'EKWO_PROFILE';
+/** The name a first `ekwo login` gives its profile when none is asked for. */
+export const FIRST_PROFILE = 'default';
+const PROFILES_FILE = 'profiles.json';
+const CREDENTIALS_FILE = 'credentials.json';
+/** `EKWO_CONFIG_DIR`, else `$XDG_CONFIG_HOME/ekwo`, else `~/.config/ekwo`. */
+export function configDir(env = process.env) {
+    const given = env[ENV_CONFIG_DIR];
+    if (given !== undefined && given.trim().length > 0)
+        return resolve(given.trim());
+    const xdg = env['XDG_CONFIG_HOME'];
+    if (xdg !== undefined && xdg.trim().length > 0)
+        return join(resolve(xdg.trim()), 'ekwo');
+    return join(homedir(), '.config', 'ekwo');
+}
+export function assertProfileName(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name)) {
+        throw new UsageError(`bad_profile_name: "${name}" is not a profile name. Letters, digits, dot, dash and underscore, starting with a letter or a digit.`);
+    }
+    return name;
+}
+/**
+ * Refuses a directory that sits inside a repository.
+ *
+ * A token in a working tree is one `git add .` away from being published,
+ * and nothing about a file called `credentials.json` would stop it. The check
+ * is the plain one — a `.git` in the directory or above it — and the way out
+ * is named in the refusal.
+ */
+export function assertOutsideRepository(dir) {
+    let current = resolve(dir);
+    for (;;) {
+        if (existsSync(join(current, '.git'))) {
+            throw new UsageError(`config_dir_in_repository: ${dir} is inside the repository at ${current}, and a session token is never written where a commit could pick it up. Set ${ENV_CONFIG_DIR} to a directory outside any repository.`);
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return;
+        current = parent;
+    }
+}
+async function readJson(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw new Error(`unreadable_configuration: ${path} could not be read: ${error.message}`);
+    }
+}
+/** Written beside the file and moved over it: a rotated refresh token is never half there. */
+async function writePrivate(dir, file, value) {
+    assertOutsideRepository(dir);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const path = join(dir, file);
+    const temporary = `${path}.${process.pid}.tmp`;
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await chmod(temporary, 0o600);
+    await rename(temporary, path);
+}
+function text(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function asProfile(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const supabaseUrl = text(record['supabase_url']);
+    const anonKey = text(record['anon_key']);
+    if (supabaseUrl === undefined || anonKey === undefined)
+        return undefined;
+    const company = record['company'];
+    const companyId = text(company?.['id']);
+    const companyName = text(company?.['name']);
+    const email = text(record['email']);
+    const userId = text(record['user_id']);
+    return {
+        supabase_url: supabaseUrl,
+        anon_key: anonKey,
+        ...(email === undefined ? {} : { email }),
+        ...(userId === undefined ? {} : { user_id: userId }),
+        ...(companyId === undefined || companyName === undefined
+            ? {}
+            : { company: { id: companyId, name: companyName } }),
+    };
+}
+export async function readProfiles(dir) {
+    const raw = (await readJson(join(dir, PROFILES_FILE)));
+    const profiles = {};
+    const listed = raw?.['profiles'];
+    if (typeof listed === 'object' && listed !== null) {
+        for (const [name, value] of Object.entries(listed)) {
+            const profile = asProfile(value);
+            if (profile !== undefined)
+                profiles[name] = profile;
+        }
+    }
+    const current = text(raw?.['current']);
+    return { ...(current === undefined ? {} : { current }), profiles };
+}
+export async function writeProfiles(dir, file) {
+    await writePrivate(dir, PROFILES_FILE, {
+        $comment: 'Where each profile of the ekwo command line points. No token lives here; the session is in credentials.json, beside this file.',
+        ...(file.current === undefined ? {} : { current: file.current }),
+        profiles: file.profiles,
+    });
+}
+function asSession(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return undefined;
+    const record = raw;
+    const accessToken = text(record['access_token']);
+    const refreshToken = text(record['refresh_token']);
+    const expiresAt = record['expires_at'];
+    if (accessToken === undefined || refreshToken === undefined || typeof expiresAt !== 'number') {
+        return undefined;
+    }
+    return { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt };
+}
+async function readCredentials(dir) {
+    const raw = await readJson(join(dir, CREDENTIALS_FILE));
+    const sessions = {};
+    if (typeof raw === 'object' && raw !== null) {
+        for (const [name, value] of Object.entries(raw)) {
+            const session = asSession(value);
+            if (session !== undefined)
+                sessions[name] = session;
+        }
+    }
+    return sessions;
+}
+export async function readSession(dir, profile) {
+    return (await readCredentials(dir))[profile];
+}
+export async function writeSession(dir, profile, session) {
+    const sessions = await readCredentials(dir);
+    sessions[profile] = session;
+    await writePrivate(dir, CREDENTIALS_FILE, sessions);
+}
+/** True when there was a session to forget. */
+export async function forgetSession(dir, profile) {
+    const sessions = await readCredentials(dir);
+    if (sessions[profile] === undefined)
+        return false;
+    delete sessions[profile];
+    await writePrivate(dir, CREDENTIALS_FILE, sessions);
+    return true;
+}
+/** True when somebody other than the owner can read the session file. */
+export async function credentialsAreExposed(dir) {
+    if (process.platform === 'win32')
+        return false;
+    try {
+        const info = await stat(join(dir, CREDENTIALS_FILE));
+        return (info.mode & 0o077) !== 0;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=profiles.js.map

package/dist/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../src/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AA6B5C,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAClB,sBAAsB,IAAI,wGAAwG,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,6BAA6B,GAAG,gCAAgC,OAAO,+EAA+E,cAAc,yCAAyC,CAC9M,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO;QAC/B,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,uBAAwB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY,EAAE,KAAc;IACnE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC/C,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzC,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAwC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACvC,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,QAAQ,EAAE,OAAO;QACjB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACpD,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;YACtD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAwC,CAAC;IAC9F,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACvC,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,IAAkB;IACjE,MAAM,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE;QACrC,QAAQ,EACN,gIAAgI;QAClI,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAG,GAA8B,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,WAAW,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAkC,EAAE,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAe;IAC5D,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,OAAsB;IACrF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC5B,MAAM,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,OAAe;IAC9D,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/prompt.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Asking questions, on `node:readline` alone.
+ *
+ * A masked prompt is the reason this is written out rather than installed:
+ * the database password and the service_role key pass through it, and the
+ * fewer packages that can see them the better. Node has everything needed —
+ * the masking trick is a writable stream that drops what readline echoes.
+ */
+/**
+ * Whether there is somebody to ask.
+ *
+ * Both ends have to be a terminal, and `--json` means there is nobody: the
+ * standard output is promised to one JSON document, and the caller that asked
+ * for it is a program that would wait on a question for ever.
+ */
+export declare function isInteractive(): boolean;
+/** Thrown when a question has to be asked and there is nobody to answer it. */
+export declare class NotInteractiveError extends Error {
+    constructor(what: string, flag: string);
+}
+/** A free-text question. `defaultValue` is offered in brackets and accepted on Enter. */
+export declare function ask(question: string, defaultValue?: string): Promise<string>;
+/** Keeps asking until the answer is not empty. */
+export declare function askRequired(question: string, defaultValue?: string): Promise<string>;
+/** A question whose answer is not echoed. */
+export declare function askSecret(question: string): Promise<string>;
+/** A yes/no question. The default is what Enter means. */
+export declare function confirm(question: string, defaultValue?: boolean): Promise<boolean>;
+/**
+ * One of a short list. Returns the chosen value, not its index.
+ *
+ * `defaultValue` is optional on purpose: a question whose answer decides what
+ * the books are — the country — has no right answer to preselect, and Enter
+ * on it would be a choice nobody made.
+ */
+export declare function choose(question: string, options: {
+    value: string;
+    label: string;
+}[], defaultValue?: string): Promise<string>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;GAMG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAeD,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAMvC;AASD,yFAAyF;AACzF,wBAAsB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYlF;AAED,kDAAkD;AAClD,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM1F;AAgBD,6CAA6C;AAC7C,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAcjE;AAED,0DAA0D;AAC1D,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAKtF;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAC1B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,EAC3C,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/prompt.js

@@ -0,0 +1,120 @@
+/**
+ * Asking questions, on `node:readline` alone.
+ *
+ * A masked prompt is the reason this is written out rather than installed:
+ * the database password and the service_role key pass through it, and the
+ * fewer packages that can see them the better. Node has everything needed —
+ * the masking trick is a writable stream that drops what readline echoes.
+ */
+import { createInterface } from 'node:readline';
+import { Writable } from 'node:stream';
+import { cyan, dim, isJsonMode } from './ui.js';
+/**
+ * Whether there is somebody to ask.
+ *
+ * Both ends have to be a terminal, and `--json` means there is nobody: the
+ * standard output is promised to one JSON document, and the caller that asked
+ * for it is a program that would wait on a question for ever.
+ */
+export function isInteractive() {
+    return process.stdin.isTTY === true && process.stdout.isTTY === true && !isJsonMode();
+}
+/**
+ * The last line of defence, under every question this file can ask.
+ *
+ * Each command already decides whether it may ask and says which flag was
+ * missing when it may not. This is for the day one of them forgets: a question
+ * put to a pipe does not fail, it waits, and an agent driving a shell has no
+ * way to tell a wait from work. So a prompt that is reached with nobody to
+ * answer stops the command instead, with the exit code of a wrong call.
+ */
+function refuseToBlock(question) {
+    if (!isInteractive())
+        throw new NotInteractiveError(`an answer to "${question}"`, 'the matching flag');
+}
+/** Thrown when a question has to be asked and there is nobody to answer it. */
+export class NotInteractiveError extends Error {
+    constructor(what, flag) {
+        super(`missing_input: ${what} was not given and this is not a terminal. ` +
+            `Pass ${flag}, or set the matching environment variable.`);
+    }
+}
+function withInterface(fn) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return fn(rl).finally(() => {
+        rl.close();
+    });
+}
+/** A free-text question. `defaultValue` is offered in brackets and accepted on Enter. */
+export async function ask(question, defaultValue) {
+    refuseToBlock(question);
+    const suffix = defaultValue !== undefined ? dim(` [${defaultValue}]`) : '';
+    const answer = await withInterface((rl) => new Promise((resolve) => {
+        rl.question(`${cyan('?')} ${question}${suffix} `, resolve);
+    }));
+    const trimmed = answer.trim();
+    if (trimmed.length > 0)
+        return trimmed;
+    return defaultValue ?? '';
+}
+/** Keeps asking until the answer is not empty. */
+export async function askRequired(question, defaultValue) {
+    for (;;) {
+        const answer = await ask(question, defaultValue);
+        if (answer.length > 0)
+            return answer;
+        process.stdout.write(`  ${dim('An answer is needed.')}\n`);
+    }
+}
+/** A stream that forwards to stdout until it is muted, then swallows. */
+class MutableOutput extends Writable {
+    muted = false;
+    _write(chunk, _encoding, callback) {
+        if (!this.muted)
+            process.stdout.write(chunk);
+        callback();
+    }
+}
+/** A question whose answer is not echoed. */
+export async function askSecret(question) {
+    refuseToBlock(question);
+    const output = new MutableOutput();
+    const rl = createInterface({ input: process.stdin, output, terminal: true });
+    try {
+        const answer = await new Promise((resolve) => {
+            rl.question(`${cyan('?')} ${question} `, resolve);
+            output.muted = true;
+        });
+        process.stdout.write('\n');
+        return answer.trim();
+    }
+    finally {
+        rl.close();
+    }
+}
+/** A yes/no question. The default is what Enter means. */
+export async function confirm(question, defaultValue = false) {
+    const hint = defaultValue ? 'Y/n' : 'y/N';
+    const answer = (await ask(`${question} ${dim(`(${hint})`)}`)).toLowerCase();
+    if (answer.length === 0)
+        return defaultValue;
+    return answer === 'y' || answer === 'yes';
+}
+/**
+ * One of a short list. Returns the chosen value, not its index.
+ *
+ * `defaultValue` is optional on purpose: a question whose answer decides what
+ * the books are — the country — has no right answer to preselect, and Enter
+ * on it would be a choice nobody made.
+ */
+export async function choose(question, options, defaultValue) {
+    const labels = options.map((o) => `${o.value} (${o.label})`).join(', ');
+    for (;;) {
+        const answer = (await ask(`${question} ${dim(labels)}`, defaultValue)).toUpperCase();
+        const match = options.find((o) => o.value.toUpperCase() === answer);
+        if (match !== undefined)
+            return match.value;
+        process.stdout.write(`  ${dim(`Choose one of: ${options.map((o) => o.value).join(', ')}`)}\n`);
+    }
+}
+//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAkB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC,aAAa,EAAE;QAAE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,QAAQ,GAAG,EAAE,mBAAmB,CAAC,CAAC;AACzG,CAAC;AAED,+EAA+E;AAC/E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY,EAAE,IAAY;QACpC,KAAK,CACH,kBAAkB,IAAI,6CAA6C;YACjE,QAAQ,IAAI,6CAA6C,CAC5D,CAAC;IACJ,CAAC;CACF;AAED,SAAS,aAAa,CAAI,EAAiC;IACzD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACzB,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,QAAgB,EAAE,YAAqB;IAC/D,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,CAAC,EAAE,EAAE,EAAE,CACL,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC9B,EAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,GAAG,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC,CAAC,CACL,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,YAAY,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,YAAqB;IACvE,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,aAAc,SAAQ,QAAQ;IAClC,KAAK,GAAG,KAAK,CAAC;IAEL,MAAM,CACb,KAAsB,EACtB,SAAyB,EACzB,QAAwC;QAExC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,QAAQ,EAAE,CAAC;IACb,CAAC;CACF;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB;IAC9C,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;IACnC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACnD,EAAE,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,GAAG,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,QAAgB,EAAE,YAAY,GAAG,KAAK;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,QAAgB,EAChB,OAA2C,EAC3C,YAAqB;IAErB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACpE,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,kBAAkB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Registering an installation with Ekwo.
+ *
+ * This is an opt-in, asked once at the end of `ekwo init`, and the default
+ * answer is no. Community works unregistered, forever: nothing in the schema
+ * and nothing in this CLI reads `contact_email` or `registered_at` to decide
+ * what you may do. The only thing registration buys is that somebody can tell
+ * you a security advisory concerns your version.
+ *
+ * Two halves, deliberately independent:
+ *
+ *   - **In your database.** `register_instance(email)` writes the address and
+ *     a date onto the instance row. `unregister_instance()` clears both.
+ *   - **At Ekwo.** A POST to `EKWO_REGISTRY_URL`. The endpoint does not exist
+ *     yet, and that is fine: the local half stands on its own, a failed POST
+ *     is a soft message rather than an error, and `ekwo register` retries.
+ *
+ * The payload carries what an advisory needs to be addressed — the locally
+ * generated `instance_id`, the organisation, the country, the edition, the
+ * schema version, and the address given. No ledger data, no user list, no
+ * connection string, ever.
+ */
+import type { FetchLike } from './auth.js';
+import type { SqlClient } from './sql.js';
+export declare const DEFAULT_REGISTRY_URL = "https://api.ekwo.ai/v1/registrations";
+export declare function registryUrl(env?: NodeJS.ProcessEnv): string;
+export interface InstanceRow {
+    instance_id: string;
+    organization_name: string;
+    country: string;
+    edition: string;
+    schema_version: string;
+    contact_email: string | null;
+    registered_at: string | null;
+}
+export declare function readInstance(db: SqlClient): Promise<InstanceRow | undefined>;
+export interface RegistrationPayload {
+    instance_id: string;
+    organization: string;
+    country: string;
+    edition: string;
+    schema_version: string;
+    contact_email: string;
+}
+export declare function payloadFor(instance: InstanceRow, email: string): RegistrationPayload;
+export interface RegisterResult {
+    /** The instance row was written: this always happens. */
+    recordedLocally: boolean;
+    /** The POST reached Ekwo. False is a supported, non-fatal state. */
+    announced: boolean;
+    /** Why the POST did not land, when it did not. */
+    reason?: string;
+    payload: RegistrationPayload;
+}
+export interface RegisterOptions {
+    /** The administrator whose authority `register_instance()` checks. */
+    adminUserId: string;
+    email: string;
+    organization?: string | undefined;
+    country?: string | undefined;
+    url?: string;
+    fetchImpl?: FetchLike;
+}
+/**
+ * Records the registration locally, then tries to announce it.
+ *
+ * The local write comes first on purpose. If the network is down, or the
+ * endpoint is not live yet, the installation still knows it opted in and
+ * `ekwo register` can send it later.
+ */
+export declare function register(db: SqlClient, options: RegisterOptions): Promise<RegisterResult>;
+/** POSTs the payload. Never throws: a failure here is not a failed install. */
+export declare function announce(payload: RegistrationPayload, options?: {
+    url?: string;
+    fetchImpl?: FetchLike;
+}): Promise<{
+    announced: boolean;
+    reason?: string;
+}>;
+/** Clears the address and the date. The local row is the only thing we hold. */
+export declare function unregister(db: SqlClient, adminUserId: string): Promise<InstanceRow | undefined>;
+/** The administrator this CLI acts for: the first one on the installation. */
+export declare function anyAdminId(db: SqlClient): Promise<string | undefined>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,eAAO,MAAM,oBAAoB,yCAAyC,CAAC;AAE3E,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGxE;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlF;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,mBAAmB,CASpF;AAED,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;IACnB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,cAAc,CAAC,CAyBzB;AAED,+EAA+E;AAC/E,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAO,GACpD,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAclD;AAED,gFAAgF;AAChF,wBAAsB,UAAU,CAC9B,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAKlC;AAED,8EAA8E;AAC9E,wBAAsB,UAAU,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM3E"}

package/dist/registry.js

@@ -0,0 +1,104 @@
+/**
+ * Registering an installation with Ekwo.
+ *
+ * This is an opt-in, asked once at the end of `ekwo init`, and the default
+ * answer is no. Community works unregistered, forever: nothing in the schema
+ * and nothing in this CLI reads `contact_email` or `registered_at` to decide
+ * what you may do. The only thing registration buys is that somebody can tell
+ * you a security advisory concerns your version.
+ *
+ * Two halves, deliberately independent:
+ *
+ *   - **In your database.** `register_instance(email)` writes the address and
+ *     a date onto the instance row. `unregister_instance()` clears both.
+ *   - **At Ekwo.** A POST to `EKWO_REGISTRY_URL`. The endpoint does not exist
+ *     yet, and that is fine: the local half stands on its own, a failed POST
+ *     is a soft message rather than an error, and `ekwo register` retries.
+ *
+ * The payload carries what an advisory needs to be addressed — the locally
+ * generated `instance_id`, the organisation, the country, the edition, the
+ * schema version, and the address given. No ledger data, no user list, no
+ * connection string, ever.
+ */
+import { asUser, first } from './sql.js';
+export const DEFAULT_REGISTRY_URL = 'https://api.ekwo.ai/v1/registrations';
+export function registryUrl(env = process.env) {
+    const configured = env['EKWO_REGISTRY_URL'];
+    return configured !== undefined && configured.length > 0 ? configured : DEFAULT_REGISTRY_URL;
+}
+export async function readInstance(db) {
+    return first(db, `select instance_id, organization_name, country, edition, schema_version,
+            contact_email, registered_at
+       from instance where id = 1`);
+}
+export function payloadFor(instance, email) {
+    return {
+        instance_id: instance.instance_id,
+        organization: instance.organization_name,
+        country: instance.country,
+        edition: instance.edition,
+        schema_version: instance.schema_version,
+        contact_email: email,
+    };
+}
+/**
+ * Records the registration locally, then tries to announce it.
+ *
+ * The local write comes first on purpose. If the network is down, or the
+ * endpoint is not live yet, the installation still knows it opted in and
+ * `ekwo register` can send it later.
+ */
+export async function register(db, options) {
+    const { adminUserId, email } = options;
+    // Optional corrections collected at the same prompt.
+    if (options.organization !== undefined && options.organization.length > 0) {
+        await db.query('update instance set organization_name = $1 where id = 1', [
+            options.organization,
+        ]);
+    }
+    if (options.country !== undefined && options.country.length === 2) {
+        await db.query('update instance set country = $1 where id = 1', [
+            options.country.toUpperCase(),
+        ]);
+    }
+    await asUser(db, adminUserId, async () => {
+        await db.query('select register_instance($1)', [email]);
+    });
+    const instance = await readInstance(db);
+    if (instance === undefined)
+        throw new Error('instance_not_initialised: call ekwo init first');
+    const payload = payloadFor(instance, email);
+    const announced = await announce(payload, options);
+    return { recordedLocally: true, payload, ...announced };
+}
+/** POSTs the payload. Never throws: a failure here is not a failed install. */
+export async function announce(payload, options = {}) {
+    const url = options.url ?? registryUrl();
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    try {
+        const response = await fetchImpl(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(payload),
+        });
+        if (response.ok)
+            return { announced: true };
+        return { announced: false, reason: `the registry answered HTTP ${response.status}` };
+    }
+    catch (error) {
+        return { announced: false, reason: error.message };
+    }
+}
+/** Clears the address and the date. The local row is the only thing we hold. */
+export async function unregister(db, adminUserId) {
+    await asUser(db, adminUserId, async () => {
+        await db.query('select unregister_instance()');
+    });
+    return readInstance(db);
+}
+/** The administrator this CLI acts for: the first one on the installation. */
+export async function anyAdminId(db) {
+    const row = await first(db, 'select user_id from instance_admins order by created_at limit 1');
+    return row?.user_id;
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sCAAsC,CAAC;AAE3E,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5C,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC/F,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa;IAC9C,OAAO,KAAK,CACV,EAAE,EACF;;kCAE8B,CAC/B,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,QAAqB,EAAE,KAAa;IAC7D,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,YAAY,EAAE,QAAQ,CAAC,iBAAiB;QACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC;AAsBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,EAAa,EACb,OAAwB;IAExB,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAEvC,qDAAqD;IACrD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,CAAC,yDAAyD,EAAE;YACxE,OAAO,CAAC,YAAY;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,EAAE,CAAC,KAAK,CAAC,+CAA+C,EAAE;YAC9D,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE5C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAA4B,EAC5B,UAAmD,EAAE;IAErD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAa,EACb,WAAmB;IAEnB,MAAM,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAa;IAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,EAAE,EACF,iEAAiE,CAClE,CAAC;IACF,OAAO,GAAG,EAAE,OAAO,CAAC;AACtB,CAAC"}

package/dist/rest.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Talking to an instance as a person: PostgREST, with that person's token.
+ *
+ * Everything a bookkeeping command does goes through here, and nothing here
+ * holds a privilege: the `apikey` is the publishable one, the bearer is the
+ * session of whoever signed in, and row level security decides the rest —
+ * exactly as it does for the MCP server, which calls the same functions.
+ *
+ * **A refusal keeps its SQLSTATE over this route.** PostgREST answers an error
+ * of the database with the fields Postgres gave it — `code`, `message`,
+ * `details`, `hint` — so the error thrown here carries `code`, `detail` and
+ * `hint` the way both SQL drivers do, and `output.ts` reads a locked period
+ * off it as exit code 3 without knowing which route it came over. An error of
+ * PostgREST's own is `PGRST…`, which is not an SQLSTATE and stays a failure.
+ *
+ * **A token that stopped working is renewed once, and the call is made
+ * again.** An access token lasts an hour and a terminal stays open for a day.
+ * It is renewed ahead of time when it is about to lapse, and after the fact
+ * when the instance answers 401 anyway — a clock that drifted, a session the
+ * instance ended early. The renewed session is handed to whoever keeps it;
+ * a session that cannot be renewed is `session_expired`, never a retry loop.
+ */
+import type { Backend } from '@ekwo-ai/core';
+import type { StoredSession } from './profiles.js';
+import { type FetchLike, type Instance, type SessionUser } from './session.js';
+export interface UserClientOptions {
+    instance: Instance;
+    fetchImpl: FetchLike;
+    accessToken: string;
+    /** Absent when the token was handed over by the environment: nothing to renew it with. */
+    refreshToken?: string | undefined;
+    expiresAt?: number | undefined;
+    /** Called with the rotated session, before the call that needed it is retried. */
+    onRenewed?: ((session: StoredSession) => Promise<void>) | undefined;
+    /** What to tell somebody whose session is over. */
+    signInAgain: string;
+    now?: (() => number) | undefined;
+}
+export interface SelectOptions {
+    columns: readonly string[];
+    order?: string;
+}
+/** What the database, or PostgREST in front of it, answered. Shaped like a driver error. */
+export declare class RestError extends Error {
+    code: string | undefined;
+    detail: string | undefined;
+    hint: string | undefined;
+    constructor(message: string, fields: {
+        code?: string | undefined;
+        detail?: string | undefined;
+        hint?: string | undefined;
+    });
+}
+export declare class UserClient {
+    private readonly options;
+    private accessToken;
+    private refreshToken;
+    private expiresAt;
+    constructor(options: UserClientOptions);
+    get instance(): Instance;
+    private now;
+    private expired;
+    private renew;
+    /** One request as the user; renewed and made again, once, on a 401. */
+    private request;
+    private answer;
+    /** Calls a function of the schema. Rows, whatever the function returns. */
+    rpc<T>(fn: string, args?: Record<string, unknown>): Promise<T[]>;
+    /** Reads what the policies let this person see of a table. */
+    select<T>(table: string, options: SelectOptions): Promise<T[]>;
+    /** Who the instance says this token is. Also the cheapest way to learn it stopped working. */
+    user(): Promise<SessionUser>;
+    token(): string;
+    /**
+     * This client as the `Backend` the bookkeeping functions of the core are
+     * written against — the interface the MCP server implements over
+     * `@supabase/supabase-js`. Same five operations, same functions on top.
+     */
+    backend(actingAs: string | undefined): Backend;
+}
+//# sourceMappingURL=rest.d.ts.map