hollware 0.0.1 → 0.1.0

package/dist/index.mjs

@@ -1,11 +1,16 @@
 #!/usr/bin/env node
-import { readFileSync, realpathSync } from "node:fs";
+import { i as UsageError, r as CliError, t as printable } from "./format-BpRYEsGB.mjs";
+import { t as readVersion } from "./version-BMhdZaNo.mjs";
+import { t as createWranglerRunner } from "./wrangler-BLIfwbcu.mjs";
+import { mkdtempSync, realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 //#region src/index.ts
 const COMMANDS = [
 	{
 		name: "init",
-		summary: "Set up Hollware in a project"
+		summary: "Set up a site, its owner and a first token in the project's D1 database"
 	},
 	{
 		name: "migrate",
@@ -13,7 +18,7 @@ const COMMANDS = [
 	},
 	{
 		name: "token",
-		summary: "Create, list and revoke access tokens"
+		summary: "Create, list and revoke personal tokens"
 	},
 	{
 		name: "import",
@@ -21,34 +26,36 @@ const COMMANDS = [
 	},
 	{
 		name: "export",
-		summary: "Export entries as Markdown files"
+		summary: "Export entries as Markdown files (planned for v0.2, not implemented yet)"
 	}
 ];
 const NAME_WIDTH = Math.max(...COMMANDS.map((command) => command.name.length));
 const USAGE = [
-	"Usage: hollware <command>",
-	"",
-	"Pre-alpha: no command is implemented yet.",
+	"Usage: hollware <command> [options]",
 	"",
 	"Commands:",
-	...COMMANDS.map(({ name, summary }) => `  ${name.padEnd(NAME_WIDTH)}  ${summary} (not implemented yet)`),
+	...COMMANDS.map(({ name, summary }) => `  ${name.padEnd(NAME_WIDTH)}  ${summary}`),
 	"",
 	"Options:",
 	"  --help     Show this help",
-	"  --version  Print the version"
+	"  --version  Print the version",
+	"",
+	"Run \"hollware <command> --help\" for the options of a command.",
+	"init, migrate and token work on the project in the current directory, through its wrangler."
 ].join("\n");
-function readVersion() {
-	const manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
-	if (typeof manifest.version !== "string") throw new Error("package.json has no version");
-	return manifest.version;
-}
+const TOKEN_COMMANDS = [
+	"create",
+	"list",
+	"revoke"
+];
 /**
-* Runs the CLI and returns its exit code. Each call to `io.out` or `io.err` is one
-* message; whoever owns the streams adds the trailing newline. Only the first
-* argument is looked at.
+* Runs the CLI and returns its exit code. Each call to `io.out` or `io.err` is one message;
+* whoever owns the streams adds the trailing newline. The command is the first argument; the
+* rest are its own. A `CliError` becomes one message on stderr and the exit code 1, and
+* anything else is a bug, which escapes.
 */
-function main(argv, io) {
-	const [first] = argv;
+async function main(argv, io) {
+	const [first, ...rest] = argv;
 	if (first === void 0 || first === "--help") {
 		io.out(USAGE);
 		return 0;
@@ -57,12 +64,36 @@ function main(argv, io) {
 		io.out(`hollware ${readVersion()}`);
 		return 0;
 	}
-	if (COMMANDS.some((command) => command.name === first)) {
-		io.err(`hollware ${first}: not implemented yet`);
+	if (first === "export") {
+		io.err("hollware export: not implemented yet (planned for v0.2)");
 		return 1;
 	}
-	io.err(`hollware: unknown command or flag "${first}"\n\n${USAGE}`);
-	return 1;
+	if (![
+		"init",
+		"migrate",
+		"token",
+		"import"
+	].includes(first)) {
+		io.err(`hollware: unknown command or flag "${printable(first)}"\n\n${USAGE}`);
+		return 1;
+	}
+	const label = first === "token" && TOKEN_COMMANDS.includes(rest[0] ?? "") ? `token ${rest[0]}` : first;
+	try {
+		return await run(first, rest, io);
+	} catch (error) {
+		if (!(error instanceof CliError)) throw error;
+		const hint = error instanceof UsageError ? ` Run "hollware ${label} --help" for the options.` : "";
+		io.err(`hollware ${label}: ${error.message}${hint}`);
+		return 1;
+	}
+}
+async function run(command, args, io) {
+	switch (command) {
+		case "init": return (await import("./init-Cl9Epsbp.mjs")).init(args, io);
+		case "migrate": return (await import("./migrate-CLHWuUje.mjs")).migrate(args, io);
+		case "token": return (await import("./token-BLkrPLio.mjs")).token(args, io);
+		default: return (await import("./import-Dlpn_w3s.mjs")).importContent(args, io);
+	}
 }
 function isEntryPoint() {
 	const entry = process.argv[1];
@@ -73,9 +104,25 @@ function isEntryPoint() {
 		return false;
 	}
 }
-if (isEntryPoint()) process.exitCode = main(process.argv.slice(2), {
-	out: (s) => process.stdout.write(`${s}\n`),
-	err: (s) => process.stderr.write(`${s}\n`)
-});
+async function readStdin() {
+	if (process.stdin.isTTY) return void 0;
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+	return Buffer.concat(chunks).toString("utf8");
+}
+function processIo() {
+	const cwd = process.cwd();
+	return {
+		out: (message) => process.stdout.write(`${message}\n`),
+		err: (message) => process.stderr.write(`${message}\n`),
+		cwd,
+		now: () => /* @__PURE__ */ new Date(),
+		randomBytes: (length) => crypto.getRandomValues(new Uint8Array(length)),
+		readStdin,
+		wrangler: createWranglerRunner(cwd),
+		tempDir: () => mkdtempSync(join(tmpdir(), "hollware-"))
+	};
+}
+if (isEntryPoint()) process.exitCode = await main(process.argv.slice(2), processIo());
 //#endregion
-export { main };
+export { createWranglerRunner, main };

package/dist/init-Cl9Epsbp.mjs

@@ -0,0 +1,108 @@
+import { i as UsageError, r as CliError } from "./format-BpRYEsGB.mjs";
+import { t as parseFlags } from "./args-CljWh-kZ.mjs";
+import { a as runFile, f as parseOwnerName, i as resolveDatabase, l as ownerQuery, m as parseSiteKey, n as describeDatabase, o as initScript, r as query, t as chooseTarget } from "./d1-Bd-sdoDd.mjs";
+import { n as newId, r as newPersonalToken, t as inDays } from "./entropy-CIYbTHkj.mjs";
+import { rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { PERSONAL_TOKEN_TTL_DAYS, SCOPES, hashPersonalToken } from "@hollware/core";
+//#region src/commands/init.ts
+const INIT_USAGE = [
+	"Usage: hollware init --site <key> [--local | --remote] [--owner-name <name>] [--database <name>]",
+	"",
+	"Creates a site, its owner and the owner's first personal token in the project's D1 database,",
+	"in one step, and prints the token once. It does nothing when the database already has an owner.",
+	"Run \"hollware migrate\" first: the database needs its tables.",
+	"",
+	"Options:",
+	"  --site <key>         The site, by the key it has in hollware.config.ts (required)",
+	"  --local              Use the local database (the default)",
+	"  --remote             Use the database in Cloudflare",
+	"  --owner-name <name>  The name of the owner",
+	"  --database <name>    The D1 database, by name or binding (default: the binding \"DB\" of wrangler.jsonc)",
+	"  --help               Show this help"
+].join("\n");
+/** The label of the token `init` creates. */
+const FIRST_TOKEN_LABEL = "hollware init";
+async function init(argv, io) {
+	const { values } = parseFlags({
+		args: [...argv],
+		allowPositionals: false,
+		options: {
+			site: { type: "string" },
+			local: { type: "boolean" },
+			remote: { type: "boolean" },
+			"owner-name": { type: "string" },
+			database: { type: "string" },
+			help: { type: "boolean" }
+		}
+	});
+	if (values.help === true) {
+		io.out(INIT_USAGE);
+		return 0;
+	}
+	if (values.site === void 0) throw new UsageError("--site is required: name the site, as in hollware.config.ts.");
+	const site = parseSiteKey(values.site);
+	const ownerName = values["owner-name"] === void 0 ? void 0 : parseOwnerName(values["owner-name"]);
+	const target = chooseTarget(values);
+	const database = resolveDatabase(io.cwd, values.database);
+	const [owners = []] = await query(io.wrangler, database, target, ownerQuery());
+	const [existing] = owners;
+	if (existing !== void 0) {
+		const id = typeof existing.id === "string" ? ` (${existing.id})` : "";
+		throw new CliError(`the database already has an owner${id}, so there is nothing to set up. Create another token with "hollware token create --label <text>".`);
+	}
+	const now = io.now();
+	const timestamp = now.toISOString();
+	const ownerId = newId(io, "user");
+	const tokenId = newId(io, "token");
+	const secret = newPersonalToken(io);
+	const expiresAt = inDays(now, PERSONAL_TOKEN_TTL_DAYS);
+	const script = initScript({
+		site,
+		ownerId,
+		ownerName,
+		token: {
+			id: tokenId,
+			site,
+			userId: ownerId,
+			label: FIRST_TOKEN_LABEL,
+			hash: await hashPersonalToken(secret),
+			scopes: SCOPES,
+			expiresAt,
+			now: timestamp
+		}
+	});
+	const directory = io.tempDir();
+	try {
+		const file = join(directory, "init.sql");
+		writeFileSync(file, script, { mode: 384 });
+		await runFile(io.wrangler, database, target, file);
+	} finally {
+		rmSync(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+	io.out([
+		`Hollware is ready on ${describeDatabase(target, database)}.`,
+		"",
+		`Site     ${site}`,
+		`Owner    ${ownerId}`,
+		`Token    ${tokenId}`,
+		`Scopes   ${SCOPES.join(" ")}`,
+		`Expires  ${expiresAt} (in ${PERSONAL_TOKEN_TTL_DAYS} days)`,
+		"",
+		"Your personal token. It is shown only once: Hollware keeps just its hash.",
+		"",
+		secret,
+		"",
+		"Next:",
+		"  Save the token in a file only you can read, then import content:",
+		"    hollware import <directory> --url <your Hollware URL> --token-file <file>",
+		"  An MCP client sends it as the header \"Authorization: Bearer <token>\" to <your Hollware URL>/mcp.",
+		"  More tokens: hollware token create --label <text>"
+	].join("\n"));
+	return 0;
+}
+//#endregion
+export { init };

package/dist/migrate-CLHWuUje.mjs

@@ -0,0 +1,118 @@
+import { r as CliError } from "./format-BpRYEsGB.mjs";
+import { n as failureReason, r as stripAnsi } from "./wrangler-BLIfwbcu.mjs";
+import { t as parseFlags } from "./args-CljWh-kZ.mjs";
+import { i as resolveDatabase, n as describeDatabase, t as chooseTarget } from "./d1-Bd-sdoDd.mjs";
+import { existsSync, mkdirSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+//#region src/commands/migrate.ts
+const MIGRATE_USAGE = [
+	"Usage: hollware migrate [--local | --remote] [--check] [--database <name>]",
+	"",
+	"Applies the D1 migrations the project has not applied yet, with wrangler. Before it applies",
+	"anything to the remote database it exports a backup, and it stops if the backup fails. The",
+	"export can make the database unavailable for a moment; with nothing pending there is no backup.",
+	"",
+	"Options:",
+	"  --local            Use the local database (the default)",
+	"  --remote           Use the database in Cloudflare, after a backup in .wrangler/hollware-backups",
+	"  --check            Only list the pending migrations; exit with code 1 when there are some",
+	"  --database <name>  The D1 database, by name or binding (default: the binding \"DB\" of wrangler.jsonc)",
+	"  --help             Show this help"
+].join("\n");
+/** Where the backups before a remote migration go, below the project: wrangler's own, git-ignored folder. */
+const BACKUP_DIRECTORY = join(".wrangler", "hollware-backups");
+async function migrate(argv, io) {
+	const { values } = parseFlags({
+		args: [...argv],
+		allowPositionals: false,
+		options: {
+			local: { type: "boolean" },
+			remote: { type: "boolean" },
+			check: { type: "boolean" },
+			database: { type: "string" },
+			help: { type: "boolean" }
+		}
+	});
+	if (values.help === true) {
+		io.out(MIGRATE_USAGE);
+		return 0;
+	}
+	const target = chooseTarget(values);
+	const database = resolveDatabase(io.cwd, values.database);
+	const where = describeDatabase(target, database);
+	const listed = await io.wrangler([
+		"d1",
+		"migrations",
+		"list",
+		database,
+		`--${target}`
+	]);
+	if (listed.code !== 0) throw new CliError(`wrangler could not list the migrations: ${failureReason(listed)}`);
+	const pending = parsePendingMigrations(listed.stdout);
+	if (pending.length === 0) {
+		io.out(`No pending migrations on ${where}.`);
+		return 0;
+	}
+	const count = `${pending.length} ${pending.length === 1 ? "migration" : "migrations"}`;
+	if (values.check === true) {
+		io.out([`${count} pending on ${where}:`, ...pending.map((name) => `  ${name}`)].join("\n"));
+		throw new CliError(`${count} pending. Run "hollware migrate --${target}" to apply them.`);
+	}
+	const backup = target === "remote" ? await takeBackup(io, database) : void 0;
+	const applied = await io.wrangler([
+		"d1",
+		"migrations",
+		"apply",
+		database,
+		`--${target}`
+	]);
+	if (applied.code !== 0) {
+		const saved = backup === void 0 ? "" : ` The backup taken before is in ${backup}.`;
+		throw new CliError(`wrangler stopped while applying the migrations: ${failureReason(applied)}. The migrations before the failing one stay applied; "hollware migrate --check" shows what is left.${saved}`);
+	}
+	io.out([
+		`Applied ${count} to ${where}:`,
+		...pending.map((name) => `  ${name}`),
+		...backup === void 0 ? [] : [`Backup taken before: ${backup}`]
+	].join("\n"));
+	return 0;
+}
+/**
+* The migrations that `wrangler d1 migrations list` says are pending. It only knows two
+* answers, "No migrations to apply!" and a table headed "Migrations to be applied:"; anything
+* else is an error, so that a wrangler that words it differently never reads as "up to date".
+*/
+function parsePendingMigrations(stdout) {
+	const text = stripAnsi(stdout);
+	if (text.includes("No migrations to apply!")) return [];
+	const marker = text.indexOf("Migrations to be applied:");
+	if (marker !== -1) {
+		const names = text.slice(marker).split("\n").map((line) => /^[│|]\s*(.+?)\s*[│|]$/.exec(line.trim())?.[1]).filter((cell) => cell !== void 0).slice(1);
+		if (names.length > 0) return names;
+	}
+	throw new CliError("could not read the answer of \"wrangler d1 migrations list\": it neither says that there is nothing to apply nor lists the pending migrations. Is the wrangler of this project a version hollware does not know?");
+}
+async function takeBackup(io, database) {
+	const where = describeDatabase("remote", database);
+	const file = join(io.cwd, BACKUP_DIRECTORY, `${database}-${timestamp(io.now())}.sql`);
+	mkdirSync(dirname(file), { recursive: true });
+	io.out(`Backing up ${where} to ${file} ...`);
+	const exported = await io.wrangler([
+		"d1",
+		"export",
+		database,
+		"--remote",
+		"--output",
+		file,
+		"--skip-confirmation"
+	]);
+	if (exported.code !== 0) throw new CliError(`the backup of ${where} failed, so no migration was applied: ${failureReason(exported)}`);
+	if (!existsSync(file) || statSync(file).size === 0) throw new CliError(`wrangler reported success but wrote no backup to ${file}, so no migration was applied. Check "wrangler d1 export ${database} --remote --output <file>" by hand.`);
+	return file;
+}
+/** `20261012T120000Z`: a moment, in UTC, that is safe in a file name. */
+function timestamp(date) {
+	return date.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+}
+//#endregion
+export { migrate };

package/dist/token-BLkrPLio.mjs

@@ -0,0 +1,228 @@
+import { i as UsageError, n as table, r as CliError, t as printable } from "./format-BpRYEsGB.mjs";
+import { t as parseFlags } from "./args-CljWh-kZ.mjs";
+import { _ as sitesAndOwnerQuery, c as listTokens, d as parseLabel, g as revokeToken, h as parseTokenId, i as resolveDatabase, m as parseSiteKey, p as parseScopes, r as query, s as insertToken, t as chooseTarget, u as parseExpiresInDays, v as sitesQuery } from "./d1-Bd-sdoDd.mjs";
+import { n as newId, r as newPersonalToken, t as inDays } from "./entropy-CIYbTHkj.mjs";
+import { PERSONAL_TOKEN_TTL_DAYS, hashPersonalToken } from "@hollware/core";
+//#region src/commands/token.ts
+const WHERE_FLAGS = [
+	"  --site <key>       The site (default: the only site of the database)",
+	"  --local            Use the local database (the default)",
+	"  --remote           Use the database in Cloudflare",
+	"  --database <name>  The D1 database, by name or binding (default: the binding \"DB\" of wrangler.jsonc)",
+	"  --help             Show this help"
+];
+const TOKEN_USAGE = [
+	"Usage: hollware token <command> [options]",
+	"",
+	"Commands:",
+	"  create  Create a personal token and print it once",
+	"  list    List the tokens of a site, never their hashes",
+	"  revoke  Revoke a token",
+	"",
+	"Run \"hollware token <command> --help\" for the options of a command."
+].join("\n");
+const TOKEN_CREATE_USAGE = [
+	"Usage: hollware token create --label <text> [--scopes <list>] [--expires-in-days <n>]",
+	"                             [--site <key>] [--local | --remote] [--database <name>]",
+	"",
+	"Creates a personal token for the site's owner and prints it once; Hollware keeps only its hash.",
+	"",
+	"Options:",
+	"  --label <text>          What the token is for, 1 to 64 characters (required)",
+	"  --scopes <list>         Comma-separated: content:read, content:write, content:publish, schema:admin",
+	"                          (default: content:read,content:write)",
+	`  --expires-in-days <n>   Days until it expires, 1 to 365 (default: ${PERSONAL_TOKEN_TTL_DAYS})`,
+	...WHERE_FLAGS
+].join("\n");
+const TOKEN_LIST_USAGE = [
+	"Usage: hollware token list [--site <key>] [--local | --remote] [--database <name>]",
+	"",
+	"Lists the tokens of a site: id, label, status, expiry, last use and scopes. Never the hashes.",
+	"",
+	"Options:",
+	...WHERE_FLAGS
+].join("\n");
+const TOKEN_REVOKE_USAGE = [
+	"Usage: hollware token revoke <id> [--site <key>] [--local | --remote] [--database <name>]",
+	"",
+	"Revokes a token: the server refuses it from now on. \"hollware token list\" shows the ids.",
+	"",
+	"Options:",
+	...WHERE_FLAGS
+].join("\n");
+/** The scopes of a token that `--scopes` does not name: to read and to write drafts, not to publish. */
+const DEFAULT_SCOPES = ["content:read", "content:write"];
+async function token(argv, io) {
+	const [subcommand, ...rest] = argv;
+	switch (subcommand) {
+		case void 0:
+		case "--help":
+			io.out(TOKEN_USAGE);
+			return 0;
+		case "create": return createToken(rest, io);
+		case "list": return listTokenRows(rest, io);
+		case "revoke": return revokeTokenById(rest, io);
+		default: throw new UsageError(`unknown command "${printable(subcommand)}": use create, list or revoke.`);
+	}
+}
+const WHERE_OPTIONS = {
+	site: { type: "string" },
+	local: { type: "boolean" },
+	remote: { type: "boolean" },
+	database: { type: "string" },
+	help: { type: "boolean" }
+};
+async function createToken(argv, io) {
+	const { values } = parseFlags({
+		args: [...argv],
+		allowPositionals: false,
+		options: {
+			...WHERE_OPTIONS,
+			label: { type: "string" },
+			scopes: { type: "string" },
+			"expires-in-days": { type: "string" }
+		}
+	});
+	if (values.help === true) {
+		io.out(TOKEN_CREATE_USAGE);
+		return 0;
+	}
+	if (values.label === void 0) throw new UsageError("--label is required: say what the token is for, such as \"ci\" or \"claude-code\".");
+	const label = parseLabel(values.label);
+	const siteFlag = values.site === void 0 ? void 0 : parseSiteKey(values.site);
+	const scopes = values.scopes === void 0 ? DEFAULT_SCOPES : parseScopes(values.scopes);
+	const days = values["expires-in-days"] === void 0 ? PERSONAL_TOKEN_TTL_DAYS : parseExpiresInDays(values["expires-in-days"]);
+	const target = chooseTarget(values);
+	const database = resolveDatabase(io.cwd, values.database);
+	const [siteRows = [], ownerRows = []] = await query(io.wrangler, database, target, sitesAndOwnerQuery());
+	const site = chooseSite(siteRows, siteFlag);
+	const ownerId = firstId(ownerRows);
+	if (ownerId === void 0) throw new CliError("the database has no owner yet. Run \"hollware init --site <key>\" first.");
+	const now = io.now();
+	const id = newId(io, "token");
+	const secret = newPersonalToken(io);
+	const expiresAt = inDays(now, days);
+	await query(io.wrangler, database, target, insertToken({
+		id,
+		site,
+		userId: ownerId,
+		label,
+		hash: await hashPersonalToken(secret),
+		scopes,
+		expiresAt,
+		now: now.toISOString()
+	}));
+	io.out([
+		`Created token ${id} for the site "${site}".`,
+		"",
+		`Label    ${label}`,
+		`Scopes   ${scopes.join(" ")}`,
+		`Expires  ${expiresAt} (in ${days} ${days === 1 ? "day" : "days"})`,
+		"",
+		"The token. It is shown only once: Hollware keeps just its hash.",
+		"",
+		secret
+	].join("\n"));
+	return 0;
+}
+async function listTokenRows(argv, io) {
+	const { values } = parseFlags({
+		args: [...argv],
+		allowPositionals: false,
+		options: WHERE_OPTIONS
+	});
+	if (values.help === true) {
+		io.out(TOKEN_LIST_USAGE);
+		return 0;
+	}
+	const siteFlag = values.site === void 0 ? void 0 : parseSiteKey(values.site);
+	const target = chooseTarget(values);
+	const database = resolveDatabase(io.cwd, values.database);
+	const [siteRows = []] = await query(io.wrangler, database, target, sitesQuery());
+	const site = chooseSite(siteRows, siteFlag);
+	const [rows = []] = await query(io.wrangler, database, target, listTokens(site));
+	if (rows.length === 0) {
+		io.out(`The site "${site}" has no tokens.`);
+		return 0;
+	}
+	const now = io.now();
+	io.out(table([
+		"ID",
+		"LABEL",
+		"STATUS",
+		"EXPIRES",
+		"LAST USED",
+		"SCOPES"
+	], rows.map((row) => [
+		text(row.id),
+		text(row.label),
+		statusOf(row, now),
+		text(row.expires_at, "never"),
+		text(row.last_used_at, "never"),
+		scopesOf(row.scopes)
+	])));
+	return 0;
+}
+async function revokeTokenById(argv, io) {
+	const { values, positionals } = parseFlags({
+		args: [...argv],
+		allowPositionals: true,
+		options: WHERE_OPTIONS
+	});
+	if (values.help === true) {
+		io.out(TOKEN_REVOKE_USAGE);
+		return 0;
+	}
+	const [rawId, ...extra] = positionals;
+	if (rawId === void 0 || extra.length > 0) throw new UsageError("revoke takes the id of one token: hollware token revoke <id>.");
+	const id = parseTokenId(rawId);
+	const site = values.site === void 0 ? void 0 : parseSiteKey(values.site);
+	const target = chooseTarget(values);
+	const database = resolveDatabase(io.cwd, values.database);
+	const [revoked = [], current = []] = await query(io.wrangler, database, target, revokeToken(id, site, io.now().toISOString()));
+	if (revoked.length > 0) {
+		io.out(`Revoked token ${id}.`);
+		return 0;
+	}
+	const [row] = current;
+	if (row === void 0) {
+		const inSite = site === void 0 ? "" : ` in the site "${site}"`;
+		throw new CliError(`there is no token ${id}${inSite}. "hollware token list" shows the tokens.`);
+	}
+	io.out(`Token ${id} was already revoked at ${text(row.revoked_at)}. Nothing changed.`);
+	return 0;
+}
+/** The site a command acts on: the one `--site` names (already checked), or the only one of the database. */
+function chooseSite(rows, site) {
+	const sites = rows.map((row) => row.id).filter((id) => typeof id === "string");
+	if (site !== void 0) {
+		if (!sites.includes(site)) throw new CliError(`the database has no site "${site}"${sites.length === 0 ? "" : ` (it has ${sites.join(", ")})`}. Run "hollware init --site ${site}" to create it.`);
+		return site;
+	}
+	const [only, ...others] = sites;
+	if (only === void 0) throw new CliError("the database has no site yet. Run \"hollware init --site <key>\" first.");
+	if (others.length > 0) throw new CliError(`the database has several sites (${sites.join(", ")}): choose one with --site <key>.`);
+	return only;
+}
+function firstId(rows) {
+	const [row] = rows;
+	return typeof row?.id === "string" ? row.id : void 0;
+}
+function text(value, otherwise = "") {
+	return typeof value === "string" ? printable(value) : otherwise;
+}
+function statusOf(row, now) {
+	if (typeof row.revoked_at === "string") return "revoked";
+	if (typeof row.expires_at === "string" && Date.parse(row.expires_at) <= now.getTime()) return "expired";
+	return "active";
+}
+function scopesOf(value) {
+	if (typeof value !== "string") return "";
+	try {
+		const parsed = JSON.parse(value);
+		if (Array.isArray(parsed)) return parsed.filter((scope) => typeof scope === "string").map(printable).join(" ");
+	} catch {}
+	return printable(value);
+}
+//#endregion
+export { token };

package/dist/version-BMhdZaNo.mjs

@@ -0,0 +1,9 @@
+import { readFileSync } from "node:fs";
+//#region src/version.ts
+function readVersion() {
+	const manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+	if (typeof manifest.version !== "string") throw new Error("package.json has no version");
+	return manifest.version;
+}
+//#endregion
+export { readVersion as t };