ekwo-os 0.4.1

package/dist/rest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../src/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAmC,MAAM,eAAe,CAAC;AAE9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAsC,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAKnH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,kFAAkF;IAClF,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpE,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;CAM3H;AAMD,qBAAa,UAAU;IAKT,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,SAAS,CAAqB;gBAET,OAAO,EAAE,iBAAiB;IAMvD,IAAI,QAAQ,IAAI,QAAQ,CAEvB;IAED,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,OAAO;YAID,KAAK;IAiBnB,uEAAuE;YACzD,OAAO;YAyBP,MAAM;IAgBpB,2EAA2E;IACrE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAU1E,8DAA8D;IACxD,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IASpE,8FAA8F;IACxF,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC;IAQlC,KAAK,IAAI,MAAM;IAIf;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;CAwE/C"}

package/dist/rest.js

@@ -0,0 +1,245 @@
+/**
+ * Talking to an instance as a person: PostgREST, with that person's token.
+ *
+ * Everything a bookkeeping command does goes through here, and nothing here
+ * holds a privilege: the `apikey` is the publishable one, the bearer is the
+ * session of whoever signed in, and row level security decides the rest —
+ * exactly as it does for the MCP server, which calls the same functions.
+ *
+ * **A refusal keeps its SQLSTATE over this route.** PostgREST answers an error
+ * of the database with the fields Postgres gave it — `code`, `message`,
+ * `details`, `hint` — so the error thrown here carries `code`, `detail` and
+ * `hint` the way both SQL drivers do, and `output.ts` reads a locked period
+ * off it as exit code 3 without knowing which route it came over. An error of
+ * PostgREST's own is `PGRST…`, which is not an SQLSTATE and stays a failure.
+ *
+ * **A token that stopped working is renewed once, and the call is made
+ * again.** An access token lasts an hour and a terminal stays open for a day.
+ * It is renewed ahead of time when it is about to lapse, and after the fact
+ * when the instance answers 401 anyway — a clock that drifted, a session the
+ * instance ended early. The renewed session is handed to whoever keeps it;
+ * a session that cannot be renewed is `session_expired`, never a retry loop.
+ */
+import { UsageError } from './args.js';
+import { AuthError, baseUrl, refreshSession } from './session.js';
+/** Renew when this close to the end, in seconds. */
+const RENEW_BEFORE = 60;
+/** What the database, or PostgREST in front of it, answered. Shaped like a driver error. */
+export class RestError extends Error {
+    code;
+    detail;
+    hint;
+    constructor(message, fields) {
+        super(message);
+        this.code = fields.code;
+        this.detail = fields.detail;
+        this.hint = fields.hint;
+    }
+}
+function text(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+export class UserClient {
+    options;
+    accessToken;
+    refreshToken;
+    expiresAt;
+    constructor(options) {
+        this.options = options;
+        this.accessToken = options.accessToken;
+        this.refreshToken = options.refreshToken;
+        this.expiresAt = options.expiresAt;
+    }
+    get instance() {
+        return this.options.instance;
+    }
+    now() {
+        return this.options.now?.() ?? Math.floor(Date.now() / 1000);
+    }
+    expired() {
+        return new UsageError(`session_expired: the session is over and could not be renewed. ${this.options.signInAgain}`);
+    }
+    async renew() {
+        if (this.refreshToken === undefined)
+            throw this.expired();
+        let renewed;
+        try {
+            renewed = await refreshSession(this.options.fetchImpl, this.options.instance, this.refreshToken);
+        }
+        catch (error) {
+            // The instance declined the refresh token: revoked, used twice, too old.
+            // Anything else — no network — is a failure and says so itself.
+            if (error instanceof AuthError && error.status >= 400 && error.status < 500)
+                throw this.expired();
+            throw error;
+        }
+        this.accessToken = renewed.session.access_token;
+        this.refreshToken = renewed.session.refresh_token;
+        this.expiresAt = renewed.session.expires_at;
+        await this.options.onRenewed?.(renewed.session);
+    }
+    /** One request as the user; renewed and made again, once, on a 401. */
+    async request(path, init) {
+        if (this.refreshToken !== undefined &&
+            this.expiresAt !== undefined &&
+            this.expiresAt - this.now() <= RENEW_BEFORE) {
+            await this.renew();
+        }
+        const send = () => this.options.fetchImpl(`${baseUrl(this.options.instance.supabaseUrl)}${path}`, {
+            ...init,
+            headers: {
+                ...init.headers,
+                apikey: this.options.instance.anonKey,
+                Authorization: `Bearer ${this.accessToken}`,
+            },
+        });
+        const first = await send();
+        if (first.status !== 401)
+            return first;
+        await this.renew();
+        const second = await send();
+        if (second.status === 401)
+            throw this.expired();
+        return second;
+    }
+    async answer(response, what) {
+        let body;
+        try {
+            body = (await response.json());
+        }
+        catch {
+            body = undefined;
+        }
+        if (response.ok)
+            return body;
+        const record = (typeof body === 'object' && body !== null ? body : {});
+        throw new RestError(text(record['message']) ?? `${what}: the instance answered ${response.status}`, {
+            code: text(record['code']),
+            detail: text(record['details']),
+            hint: text(record['hint']),
+        });
+    }
+    /** Calls a function of the schema. Rows, whatever the function returns. */
+    async rpc(fn, args = {}) {
+        const response = await this.request(`/rest/v1/rpc/${encodeURIComponent(fn)}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(args),
+        });
+        const data = await this.answer(response, fn);
+        return (Array.isArray(data) ? data : [data]);
+    }
+    /** Reads what the policies let this person see of a table. */
+    async select(table, options) {
+        const query = new URLSearchParams({ select: options.columns.join(',') });
+        if (options.order !== undefined)
+            query.set('order', options.order);
+        const response = await this.request(`/rest/v1/${encodeURIComponent(table)}?${query.toString()}`, {
+            method: 'GET',
+        });
+        return this.answer(response, `select from ${table}`);
+    }
+    /** Who the instance says this token is. Also the cheapest way to learn it stopped working. */
+    async user() {
+        const response = await this.request('/auth/v1/user', { method: 'GET' });
+        const body = await this.answer(response, 'reading the user');
+        const id = text(body['id']);
+        if (id === undefined)
+            throw new Error('unknown_user: the instance answered without a user');
+        return { id, email: text(body['email']) };
+    }
+    token() {
+        return this.accessToken;
+    }
+    /**
+     * This client as the `Backend` the bookkeeping functions of the core are
+     * written against — the interface the MCP server implements over
+     * `@supabase/supabase-js`. Same five operations, same functions on top.
+     */
+    backend(actingAs) {
+        const profile = (schema, write) => schema === undefined ? {} : { [write ? 'Content-Profile' : 'Accept-Profile']: schema };
+        const call = async (fn, args, schema) => {
+            const response = await this.request(`/rest/v1/rpc/${encodeURIComponent(fn)}`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', ...profile(schema, true) },
+                body: JSON.stringify(args),
+            });
+            return this.answer(response, fn);
+        };
+        return {
+            mode: 'postgrest',
+            actingAs,
+            rpc: async (fn, args = {}, schema) => {
+                const data = await call(fn, args, schema);
+                return (Array.isArray(data) ? data : [data]);
+            },
+            rpcVoid: async (fn, args = {}, schema) => {
+                await call(fn, args, schema);
+            },
+            select: async (query) => {
+                const params = filterParams(query.where);
+                params.set('select', query.columns.join(','));
+                if (query.order !== undefined && query.order.length > 0) {
+                    params.set('order', query.order.map((o) => `${o.column}.${o.ascending === false ? 'desc' : 'asc'}`).join(','));
+                }
+                if (query.limit !== undefined)
+                    params.set('limit', String(query.limit));
+                const response = await this.request(`/rest/v1/${encodeURIComponent(query.table)}?${params.toString()}`, {
+                    method: 'GET',
+                    headers: profile(query.schema, false),
+                });
+                return this.answer(response, `select from ${query.table}`);
+            },
+            insert: async (table, rows, returning = ['*'], schema) => {
+                const params = new URLSearchParams({ select: returning.join(',') });
+                const response = await this.request(`/rest/v1/${encodeURIComponent(table)}?${params.toString()}`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json', Prefer: 'return=representation', ...profile(schema, true) },
+                    body: JSON.stringify(rows),
+                });
+                return this.answer(response, `insert into ${table}`);
+            },
+            update: async (table, patch, where, returning = ['*'], schema) => {
+                const params = filterParams(where);
+                params.set('select', returning.join(','));
+                const response = await this.request(`/rest/v1/${encodeURIComponent(table)}?${params.toString()}`, {
+                    method: 'PATCH',
+                    headers: { 'Content-Type': 'application/json', Prefer: 'return=representation', ...profile(schema, true) },
+                    body: JSON.stringify(patch),
+                });
+                return this.answer(response, `update ${table}`);
+            },
+            remove: async (table, where, schema) => {
+                const response = await this.request(`/rest/v1/${encodeURIComponent(table)}?${filterParams(where).toString()}`, {
+                    method: 'DELETE',
+                    headers: profile(schema, true),
+                });
+                if (!response.ok)
+                    await this.answer(response, `delete from ${table}`);
+            },
+            close: async () => { },
+        };
+    }
+}
+/** A value inside `in.(…)`: quoted, so a comma or a parenthesis in it is text. */
+function listed(value) {
+    return value === null ? 'null' : `"${String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+/** Filters, in the spelling PostgREST reads from a query string. */
+function filterParams(filters) {
+    const params = new URLSearchParams();
+    for (const filter of filters ?? []) {
+        switch (filter.op) {
+            case 'is':
+                params.append(filter.column, 'is.null');
+                break;
+            case 'in':
+                params.append(filter.column, `in.(${filter.value.map(listed).join(',')})`);
+                break;
+            default:
+                params.append(filter.column, `${filter.op}.${String(filter.value)}`);
+        }
+    }
+    return params;
+}
+//# sourceMappingURL=rest.js.map

package/dist/rest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.js","sourceRoot":"","sources":["../src/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAmD,MAAM,cAAc,CAAC;AAEnH,oDAAoD;AACpD,MAAM,YAAY,GAAG,EAAE,CAAC;AAqBxB,4FAA4F;AAC5F,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,IAAI,CAAqB;IACzB,MAAM,CAAqB;IAC3B,IAAI,CAAqB;IACzB,YAAY,OAAe,EAAE,MAA6F;QACxH,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,OAAO,UAAU;IAKQ;IAJrB,WAAW,CAAS;IACpB,YAAY,CAAqB;IACjC,SAAS,CAAqB;IAEtC,YAA6B,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/D,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,UAAU,CAAC,kEAAkE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtH,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,gEAAgE;YAChE,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAClG,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QAChD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,uEAAuE;IAC/D,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAiB;QACnD,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;YAC/B,IAAI,CAAC,SAAS,KAAK,SAAS;YAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,YAAY,EAC3C,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,GAAsB,EAAE,CACnC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE,EAAE;YAC7E,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,GAAI,IAAI,CAAC,OAA8C;gBACvD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBACrC,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;SACF,CAAC,CAAC;QACL,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAI,QAAkB,EAAE,IAAY;QACtD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAS,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;QAClG,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,IAAI,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE;YAClG,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,GAAG,CAAI,EAAU,EAAE,OAAgC,EAAE;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;YAC5E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAU,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAQ,CAAC;IACtD,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,MAAM,CAAI,KAAa,EAAE,OAAsB;QACnD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE;YAC/F,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAM,QAAQ,EAAE,eAAe,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAA0B,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,QAA4B;QAClC,MAAM,OAAO,GAAG,CAAC,MAA0B,EAAE,KAAc,EAA0B,EAAE,CACrF,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAEzF,MAAM,IAAI,GAAG,KAAK,EAAE,EAAU,EAAE,IAA6B,EAAE,MAAe,EAAoB,EAAE;YAClG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC5E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACzE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,MAAM,CAAU,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ;YAER,GAAG,EAAE,KAAK,EAAK,EAAU,EAAE,OAAgC,EAAE,EAAE,MAAe,EAAgB,EAAE;gBAC9F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC1C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAQ,CAAC;YACtD,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,EAAU,EAAE,OAAgC,EAAE,EAAE,MAAe,EAAiB,EAAE;gBAChG,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,EAAE,KAAK,EAAK,KAAkB,EAAgB,EAAE;gBACpD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxD,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACjH,CAAC;gBACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE;oBACtG,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC;iBACtC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAM,QAAQ,EAAE,eAAe,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,EAAE,KAAK,EAAK,KAAa,EAAE,IAAW,EAAE,YAAsB,CAAC,GAAG,CAAC,EAAE,MAAe,EAAgB,EAAE;gBAC1G,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE;oBAChG,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,uBAAuB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;oBAC1G,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;iBAC3B,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAM,QAAQ,EAAE,eAAe,KAAK,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,EAAE,KAAK,EAAK,KAAa,EAAE,KAAU,EAAE,KAAe,EAAE,YAAsB,CAAC,GAAG,CAAC,EAAE,MAAe,EAAgB,EAAE;gBAC1H,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE;oBAChG,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,uBAAuB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;oBAC1G,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC5B,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAM,QAAQ,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,KAAe,EAAE,MAAe,EAAiB,EAAE;gBAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,kBAAkB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE;oBAC7G,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;iBAC/B,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,MAAM,IAAI,CAAC,MAAM,CAAU,QAAQ,EAAE,eAAe,KAAK,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,KAAK,EAAE,KAAK,IAAmB,EAAE,GAAE,CAAC;SACrC,CAAC;IACJ,CAAC;CACF;AAED,kFAAkF;AAClF,SAAS,MAAM,CAAC,KAAY;IAC1B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACpG,CAAC;AAED,oEAAoE;AACpE,SAAS,YAAY,CAAC,OAA6B;IACjD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QACnC,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC;YAClB,KAAK,IAAI;gBACP,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACxC,MAAM;YACR,KAAK,IAAI;gBACP,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC3E,MAAM;YACR;gBACE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The schema version this CLI is written against.
+ *
+ * It is the one package of the three that also *carries* the migrations, so
+ * the number below is a floor and not a requirement it could fail: `ekwo
+ * migrate` moves a database up to what this release defines. What it buys is
+ * an installation that was set up by a much older release being named as such
+ * by `ekwo status`, instead of failing later in a query nobody can place.
+ *
+ * Declared in `package.json` under `ekwo.schemaMin` and repeated here, as in
+ * every package of this repository; `tests/cli/package.test.ts` keeps the two
+ * equal.
+ */
+export declare const SCHEMA_MIN = "0.4.0";
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,UAAU,UAAU,CAAC"}

package/dist/schema.js

@@ -0,0 +1,15 @@
+/**
+ * The schema version this CLI is written against.
+ *
+ * It is the one package of the three that also *carries* the migrations, so
+ * the number below is a floor and not a requirement it could fail: `ekwo
+ * migrate` moves a database up to what this release defines. What it buys is
+ * an installation that was set up by a much older release being named as such
+ * by `ekwo status`, instead of failing later in a query nobody can place.
+ *
+ * Declared in `package.json` under `ekwo.schemaMin` and repeated here, as in
+ * every package of this repository; `tests/cli/package.test.ts` keeps the two
+ * equal.
+ */
+export const SCHEMA_MIN = '0.4.0';
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC"}

package/dist/seeds.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Reference data.
+ *
+ * `supabase/seed/*.sql` fills the template tables — currencies, the Belgian
+ * and French charts of accounts, their VAT codes — from which
+ * `install_country_template()` gives each company its own copy. Every file is
+ * written with `on conflict do nothing`, so applying them twice changes
+ * nothing, and they are deliberately *not* recorded in the migration history:
+ * they are data a new release may legitimately re-apply.
+ *
+ * `90_demo_company.sql` is not reference data and never runs here. It is
+ * sample data, it invents a company and a fictional administrator, and it
+ * only ever runs through `ekwo demo`.
+ */
+import type { SqlClient } from './sql.js';
+export interface Seed {
+    file: string;
+    path: string;
+}
+/** The reference seeds, in order, with the demo file left out. */
+export declare function listSeeds(dir: string): Promise<Seed[]>;
+export declare function applySeed(db: SqlClient, seed: Seed): Promise<void>;
+/** Applies every reference seed, reporting each as it lands. */
+export declare function applySeeds(db: SqlClient, dir: string, onApplied?: (seed: Seed) => void): Promise<Seed[]>;
+/** The demo company, on explicit request only. */
+export declare function applyDemoSeed(db: SqlClient, dir: string): Promise<void>;
+//# sourceMappingURL=seeds.d.ts.map

package/dist/seeds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeds.d.ts","sourceRoot":"","sources":["../src/seeds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kEAAkE;AAClE,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAK5D;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxE;AAED,gEAAgE;AAChE,wBAAsB,UAAU,CAC9B,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,GAC/B,OAAO,CAAC,IAAI,EAAE,CAAC,CAOjB;AAED,kDAAkD;AAClD,wBAAsB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E"}

package/dist/seeds.js

@@ -0,0 +1,47 @@
+/**
+ * Reference data.
+ *
+ * `supabase/seed/*.sql` fills the template tables — currencies, the Belgian
+ * and French charts of accounts, their VAT codes — from which
+ * `install_country_template()` gives each company its own copy. Every file is
+ * written with `on conflict do nothing`, so applying them twice changes
+ * nothing, and they are deliberately *not* recorded in the migration history:
+ * they are data a new release may legitimately re-apply.
+ *
+ * `90_demo_company.sql` is not reference data and never runs here. It is
+ * sample data, it invents a company and a fictional administrator, and it
+ * only ever runs through `ekwo demo`.
+ */
+import { readFile, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { DEMO_SEED } from './bundle.js';
+/** The reference seeds, in order, with the demo file left out. */
+export async function listSeeds(dir) {
+    const files = (await readdir(dir))
+        .filter((f) => f.endsWith('.sql') && f !== DEMO_SEED)
+        .sort();
+    return files.map((file) => ({ file, path: join(dir, file) }));
+}
+export async function applySeed(db, seed) {
+    const sql = await readFile(seed.path, 'utf8');
+    try {
+        await db.exec(sql);
+    }
+    catch (error) {
+        throw new Error(`seed_failed: ${seed.file} — ${error.message}`);
+    }
+}
+/** Applies every reference seed, reporting each as it lands. */
+export async function applySeeds(db, dir, onApplied) {
+    const seeds = await listSeeds(dir);
+    for (const seed of seeds) {
+        await applySeed(db, seed);
+        onApplied?.(seed);
+    }
+    return seeds;
+}
+/** The demo company, on explicit request only. */
+export async function applyDemoSeed(db, dir) {
+    await applySeed(db, { file: DEMO_SEED, path: join(dir, DEMO_SEED) });
+}
+//# sourceMappingURL=seeds.js.map

package/dist/seeds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeds.js","sourceRoot":"","sources":["../src/seeds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQxC,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SACpD,IAAI,EAAE,CAAC;IACV,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAa,EAAE,IAAU;IACvD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAa,EACb,GAAW,EACX,SAAgC;IAEhC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAa,EAAE,GAAW;IAC5D,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Signing in, and staying signed in — over `fetch`, by hand.
+ *
+ * The MCP server uses `@supabase/supabase-js` for this and says why: a library
+ * known to work beats code of ours that is merely untested. The command line
+ * answers the other way, for the reason `args.ts` gives: it is handed a
+ * password, and every package it loads is a package that could read it. The
+ * whole exchange is three requests to the instance's auth endpoint — a
+ * password grant, a refresh grant, and "who is this token" — so it is written
+ * out here, and `tests/cli/login.test.ts` runs each of them, the refresh of a
+ * lost token included.
+ */
+import type { StoredSession } from './profiles.js';
+export type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;
+export interface Instance {
+    supabaseUrl: string;
+    anonKey: string;
+}
+export interface SessionUser {
+    id: string;
+    email: string | undefined;
+}
+export interface SignedIn {
+    session: StoredSession;
+    user: SessionUser;
+}
+/** The instance's auth service said no. `status` is what it answered with. */
+export declare class AuthError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function baseUrl(supabaseUrl: string): string;
+/** The password goes to the instance once and is kept nowhere. */
+export declare function signIn(fetchImpl: FetchLike, instance: Instance, email: string, password: string): Promise<SignedIn>;
+/** The instance rotates the refresh token: what comes back replaces what was sent. */
+export declare function refreshSession(fetchImpl: FetchLike, instance: Instance, refreshToken: string): Promise<SignedIn>;
+/** Tells the instance the session is over. Best effort: the local copy goes either way. */
+export declare function signOut(fetchImpl: FetchLike, instance: Instance, accessToken: string): Promise<boolean>;
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE/E,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,8EAA8E;AAC9E,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADvB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;CAI1B;AAED,wBAAgB,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEnD;AAyDD,kEAAkE;AAClE,wBAAgB,MAAM,CACpB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC,CAEnB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAC5B,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,QAAQ,CAAC,CAEnB;AAED,2FAA2F;AAC3F,wBAAsB,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU7G"}

package/dist/session.js

@@ -0,0 +1,92 @@
+/**
+ * Signing in, and staying signed in — over `fetch`, by hand.
+ *
+ * The MCP server uses `@supabase/supabase-js` for this and says why: a library
+ * known to work beats code of ours that is merely untested. The command line
+ * answers the other way, for the reason `args.ts` gives: it is handed a
+ * password, and every package it loads is a package that could read it. The
+ * whole exchange is three requests to the instance's auth endpoint — a
+ * password grant, a refresh grant, and "who is this token" — so it is written
+ * out here, and `tests/cli/login.test.ts` runs each of them, the refresh of a
+ * lost token included.
+ */
+/** The instance's auth service said no. `status` is what it answered with. */
+export class AuthError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+export function baseUrl(supabaseUrl) {
+    return supabaseUrl.replace(/\/+$/, '');
+}
+function said(body, fallback) {
+    if (typeof body !== 'object' || body === null)
+        return fallback;
+    const record = body;
+    for (const key of ['msg', 'error_description', 'message', 'error']) {
+        const value = record[key];
+        if (typeof value === 'string' && value.length > 0)
+            return value;
+    }
+    return fallback;
+}
+async function bodyOf(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return undefined;
+    }
+}
+function signedIn(body, now) {
+    const record = (body ?? {});
+    const access = record['access_token'];
+    const refresh = record['refresh_token'];
+    const user = (record['user'] ?? {});
+    if (typeof access !== 'string' || typeof refresh !== 'string' || typeof user['id'] !== 'string') {
+        throw new AuthError('sign_in_failed: the instance answered without a session', 502);
+    }
+    const expiresAt = typeof record['expires_at'] === 'number'
+        ? record['expires_at']
+        : now + (typeof record['expires_in'] === 'number' ? record['expires_in'] : 0);
+    return {
+        session: { access_token: access, refresh_token: refresh, expires_at: expiresAt },
+        user: { id: user['id'], email: typeof user['email'] === 'string' ? user['email'] : undefined },
+    };
+}
+async function grant(fetchImpl, instance, type, body, failure) {
+    const response = await fetchImpl(`${baseUrl(instance.supabaseUrl)}/auth/v1/token?grant_type=${type}`, {
+        method: 'POST',
+        headers: { apikey: instance.anonKey, 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    const answer = await bodyOf(response);
+    if (!response.ok) {
+        throw new AuthError(`${failure}: ${said(answer, `the instance answered ${response.status}`)}`, response.status);
+    }
+    return signedIn(answer, Math.floor(Date.now() / 1000));
+}
+/** The password goes to the instance once and is kept nowhere. */
+export function signIn(fetchImpl, instance, email, password) {
+    return grant(fetchImpl, instance, 'password', { email, password }, 'sign_in_failed');
+}
+/** The instance rotates the refresh token: what comes back replaces what was sent. */
+export function refreshSession(fetchImpl, instance, refreshToken) {
+    return grant(fetchImpl, instance, 'refresh_token', { refresh_token: refreshToken }, 'refresh_failed');
+}
+/** Tells the instance the session is over. Best effort: the local copy goes either way. */
+export async function signOut(fetchImpl, instance, accessToken) {
+    try {
+        const response = await fetchImpl(`${baseUrl(instance.supabaseUrl)}/auth/v1/logout?scope=local`, {
+            method: 'POST',
+            headers: { apikey: instance.anonKey, Authorization: `Bearer ${accessToken}` },
+        });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAqBH,8EAA8E;AAC9E,MAAM,OAAO,SAAU,SAAQ,KAAK;IAGvB;IAFX,YACE,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;IAGzB,CAAC;CACF;AAED,MAAM,UAAU,OAAO,CAAC,WAAmB;IACzC,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,QAAgB;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC/D,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAkB;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,GAAW;IAC1C,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,IAAI,SAAS,CAAC,yDAAyD,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,SAAS,GACb,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ;QACtC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACtB,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO;QACL,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE;QAChF,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;KAC/F,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,KAAK,CAClB,SAAoB,EACpB,QAAkB,EAClB,IAAkC,EAClC,IAA4B,EAC5B,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,6BAA6B,IAAI,EAAE,EAAE;QACpG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACzE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,MAAM,EAAE,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,MAAM,CACpB,SAAoB,EACpB,QAAkB,EAClB,KAAa,EACb,QAAgB;IAEhB,OAAO,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACvF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAC5B,SAAoB,EACpB,QAAkB,EAClB,YAAoB;IAEpB,OAAO,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACxG,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAoB,EAAE,QAAkB,EAAE,WAAmB;IACzF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,6BAA6B,EAAE;YAC9F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SAC9E,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/sql.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The only way this CLI talks to Postgres.
+ *
+ * Everything above this file is written against `SqlClient`, so the same
+ * migration runner, bootstrap and checks can run against a real Supabase
+ * project (the `postgres` driver, below) and against PGlite in the tests.
+ * No command imports a driver directly.
+ */
+/** A Postgres connection, reduced to what this CLI needs. */
+export interface SqlClient {
+    /** Multi-statement SQL with no parameters, sent as one command string. */
+    exec(sql: string): Promise<void>;
+    /** One parameterised statement (`$1`, `$2`, …), returning its rows. */
+    query<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>;
+    /** Runs `fn` inside a transaction; a throw rolls the whole thing back. */
+    transaction<T>(fn: (tx: SqlClient) => Promise<T>): Promise<T>;
+    /** Closes the connection. Calling it twice is harmless. */
+    close(): Promise<void>;
+}
+/** One row, or `undefined` when the query returned none. */
+export declare function first<T = Record<string, unknown>>(db: SqlClient, sql: string, params?: unknown[]): Promise<T | undefined>;
+/** One scalar, or `undefined`. */
+export declare function scalar<T>(db: SqlClient, sql: string, params?: unknown[]): Promise<T | undefined>;
+/**
+ * Connects to Postgres with the `postgres` driver.
+ *
+ * Imported lazily so that the tests — which plug PGlite into `SqlClient` —
+ * never load a network driver, and so `ekwo --help` costs nothing.
+ *
+ * `prepare: false` because Supabase's transaction-mode pooler (port 6543)
+ * rejects prepared statements; the CLI works on either port with it off.
+ */
+export declare function connect(connectionString: string): Promise<SqlClient>;
+/**
+ * Runs `fn` with `auth.uid()` answering `userId`.
+ *
+ * The CLI holds a superuser connection, so row level security is bypassed —
+ * but the guards written *inside* the schema's functions (`register_instance`
+ * refusing anyone who is not an instance administrator, for one) read
+ * `auth.uid()` and would refuse the installer. Setting the request claim the
+ * way PostgREST does makes those functions see the administrator the CLI is
+ * acting for, so the rule is satisfied rather than circumvented.
+ *
+ * The connection pool is capped at one, so the setting and the call land on
+ * the same backend.
+ */
+export declare function asUser<T>(db: SqlClient, userId: string, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=sql.d.ts.map

package/dist/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,0EAA0E;IAC1E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,uEAAuE;IACvE,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAClF,0EAA0E;IAC1E,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9D,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,4DAA4D;AAC5D,wBAAsB,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrD,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,OAAO,EAAO,GACrB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAGxB;AAED,kCAAkC;AAClC,wBAAsB,MAAM,CAAC,CAAC,EAC5B,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,OAAO,EAAO,GACrB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAKxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,OAAO,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CA0D1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAC5B,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAYZ"}