pikibun 0.0.0-stage → 0.19.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenCara
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,162 @@
-# Temporary Holding Version
+# pikibun
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Connect your Linux or WSL2 Pi host to a [Pikibun](https://pikibun.com) workspace. The connector uses outbound WebSocket only; no inbound port or tunnel is needed.
+
+Or run Pikibun itself on your own computer, for yourself: `npx pikibun@latest serve` (see [Running Pikibun on your own computer](#running-pikibun-on-your-own-computer)).
+
+## Requirements
+
+- Linux or WSL2 (native Windows is unsupported)
+- Node.js 24 or newer
+- Pi configured locally with the providers and models you want to offer
+- `bubblewrap`, Python 3, Git and `flock` (util-linux)
+
+## Usage
+
+In Pikibun, open **Settings → Hosts → Pair a host**, choose a workspace and create a pairing code. Then run, on the Pi host:
+
+```sh
+npx pikibun@latest connect --server https://pikibun.com --pairing-id PAIRING_ID
+```
+
+Enter the single-use code when prompted; it is never accepted as an argument and expires after 10 minutes. Later runs reuse the private saved connector token, kept in `~/.local/share/pikibun/connector` (`--state-dir` chooses another directory):
+
+```sh
+npx pikibun@latest connect
+```
+
+To pair the machine again, for example after revoking its host in Pikibun or to move it to another workspace or server, create a new pairing code and add `--force` to its command:
+
+```sh
+npx pikibun@latest connect --server https://pikibun.com --pairing-id PAIRING_ID --force
+```
+
+The saved token is replaced only once the new code is accepted. The old host stays in **Settings → Hosts**, offline, until you revoke it there; its sessions are not moved to the new host.
+
+Connector 0.8.0 moved the default state directory from `~/.local/share/opencara/connector` to `~/.local/share/pikibun/connector` without moving anything: to keep a pairing made by an older connector, run `npx pikibun@latest connect --state-dir ~/.local/share/opencara/connector`, or pair the machine again.
+
+Run `npx pikibun connect --help` for all options. The connector takes only what pairing and this machine's own setup need (`--state-dir`, `--pi-agent-dir`, `--model`, `--resources`, `--unsafe-no-sandbox`, `--experimental-sandbox`).
+
+## Host configuration
+
+Everything else about how the host runs sessions is set in the web app, on the host's page under **Settings → Hosts → the host → Configuration**, and reaches running sessions within a minute:
+
+- **Command time limit**: how long a shell command may run, from 30 seconds (the default) to an hour. A longer limit also lifts the per-process limits of short commands (25 seconds of CPU, 64 MiB per file, 256 open files) so builds fit. Set by the host's owner or its admins.
+- **GPU**: sandboxed commands get the host's GPU render device for offscreen rendering and compute: `/dev/dxg` on WSL2 (install Mesa's `vulkan-dzn` there for Vulkan), or Linux DRM render nodes. Never the screen, windows or input. Offered only where the connector found such a device. Set by the host's owner or its admins.
+- **Git credentials** and **Repository cache**: see below. Only the host's owner changes them.
+- **Sessions on the host**: the host's owner may start sessions that run directly on this machine, without the sandbox, by choosing **Where it runs → On this host** when starting one. Members' sessions run in the sandbox unless the owner's host command grant to them includes **Sessions on the host**. Only the owner changes it.
+
+`--git-credentials`, `--repo-cache` and `--repo-cache-scope` are still accepted, so existing service units keep starting, but ignored: a host that used them keeps those settings in its configuration.
+
+Workspace repositories can come from GitHub, GitHub Enterprise Server, GitLab (gitlab.com or self-managed), Bitbucket Cloud, Azure DevOps, Gitea/Forgejo and any Git server over HTTPS (smart HTTP). Connect the non-GitHub accounts in the web app under **Settings → Profile → Connected accounts** with personal access tokens, or a user name and password for a Git server. This connector accepts Git server repositories in its sessions; older connectors are sent the workspace's other repositories only. Sessions read the repositories through the Pikibun server, which uses those tokens; the connector never receives them.
+
+Model credentials stay in Pi on your host. Pairing keeps the host private to you; sharing it with a workspace is a separate, explicit action in the web app.
+
+The connector offers the models matched by `enabledModels` in Pi's `settings.json` (the same patterns Pi uses for model cycling, e.g. `"anthropic/*"`, `"*/claude-opus-5-5*"`), or every authenticated Pi model when that list is unset. `--model PROVIDER/MODEL` (repeatable) overrides both. In the web app, you and the host's admins can also disable any of these models, for everyone who uses the host, without restarting the connector (**Settings → Hosts →** the host **→ Models**).
+
+## Host commands from chat
+
+Ask the agent to use `host_bash` when you need a host-installed SDK or network access, for example `dotnet --info`. Ordinary `bash` remains in the offline sandbox; a missing SDK does not silently turn a sandbox command into a host command. Update the connector to a version advertising `hostCommands` to expose this tool.
+
+**Host commands run outside the sandbox as the connector's OS user.** They can read or change host files and credentials, access the network, and launch other processes. They have no CPU, memory, process-count or disk quotas. Pikibun passes the host's `PATH` and `HOME`, not the connector's entire environment, and starts Bash without shell profiles, in the session worktree. Use an absolute SDK path or configure the connector's `PATH` if a tool is only available in your interactive shell.
+
+Commands run in the session's worktree, whose files and Git configuration the agent can change: builds, package scripts, Git hooks and settings such as `core.fsmonitor` there can run the agent's code on the host, even for a command that looks harmless like `git status`. Approve a host command only if you would run it yourself in that directory.
+
+Each exact command and timeout needs the approval of the **host owner**, or of a member they (or one of the host's admins) granted host commands, in the session. On a shared host, the approver must also have approve access to the session. The session owner's **Auto-approve** skips this decision only when they own the host too, or hold an automatic host command grant on it; without one it never authorizes commands on someone else's host. Commands default to a five-minute timeout (`timeout_seconds`, 1-3600); timeout, cancellation and output limits terminate the process group, but cannot contain an unrestricted command that deliberately detaches processes.
+
+## macOS, Windows and hosts without bubblewrap
+
+The isolated sandbox needs Linux (or WSL2 on Windows). macOS and native Windows can try their own experimental sandboxes with `--experimental-sandbox` (see the main README, "Experimental sandboxes on macOS and Windows"). On macOS, native Windows, or Linux without bubblewrap, you can also opt out of isolation:
+
+```sh
+npx pikibun@latest connect --unsafe-no-sandbox
+```
+
+This needs only Git on your `PATH` (on macOS: `xcode-select --install` or `brew install git`). The connector prints the risks and asks you to type `unsandboxed` before starting:
+
+- Approved shell commands run directly as your user, with access to your files, credentials (`~/.ssh`, cloud and Git config, Pi's auth) and network, and no CPU, memory or disk limits.
+- File tools are confined to each session folder by path checks only.
+- Anyone you share the Pi with, and anyone granted approve permission on a session that runs on it, can cause approved commands to run on your machine.
+
+Every command needs an exact human approval unless the session's owner turns on **Auto-approve** in the chat box; then that owner's commands, pushes, GitHub comments, merges and issues run immediately. Pikibun labels the host **Unsandboxed** to everyone who can see it.
+
+## Repository cache (preview)
+
+Every session starts with an empty worktree, and its agent clones the workspace repositories it needs. With **Repository cache** set to **Shared** (one cache for every session on this host) or **Per owner** (a separate cache for each session owner) in the host's configuration, the connector keeps a full mirror of each repository on the host, so clones borrow its objects instead of downloading everything again. A change applies when the connector next connects.
+
+- `git clone` of a workspace repository in a sandboxed session borrows the cached objects (`--reference-if-able`) after bringing the mirror up to date through Pikibun, with the session owner's own account. The host uses no Git credential of its own for this. A session sees a mirror, read-only, only while Pikibun lets its owner read the repository.
+- `npx pikibun@latest cache list` shows the cached repositories and their sizes; `npx pikibun@latest cache prune --older-than 30` forgets clone sessions idle for longer and collects what nothing reaches any more (their clones lose the objects they borrowed). Pins of sessions from before every session cloned are kept.
+- It needs a Pikibun server that supports the repository cache; older servers refuse the connector's manifest.
+
+## Pushing commits
+
+In a session that clones on demand, agents push their work to the session's own branch, named for its work (`pikibun/<title-slug>-<short id>`, for example `pikibun/add-dark-mode-1a2b3c4d5e6f`), with plain `git push` and no approval; Pikibun pushes it with the workspace's push identity below. Agents with the `git_push` tool push a clone's checked-out commit, as it is, to any other branch of the workspace repository it was cloned from. A push needs an approval that shows the repository, the branch and the exact commit, unless the session owner chose **Auto-approve** for that message. Pushes are fast-forward only and never forced, and send only the objects the branch doesn't have. On a host without the sandbox, the agent pushes with the host's own Git instead, each command with approval. The agent can also ask for a pull request; Pikibun opens it as the session owner with the owner's connected account (non-GitHub tokens then need write scopes: GitHub Enterprise pull requests write, GitLab `api`, Bitbucket `write:pullrequest:bitbucket`, Azure DevOps Code (Read & write), Gitea `write:repository`).
+
+For each push, Pikibun checks with the session owner's own account that the owner may push to the repository and, where the Git host reports it, to that branch (GitLab, Gitea/Forgejo and Azure DevOps branch permissions; GitHub protected branches are refused). Bitbucket owners need an Atlassian API token connected with their account email for this check. Pikibun then issues a credential for that push from the push identity that a workspace owner or admin sets up for the provider under **Settings → Workspaces → Push access**: usually a short-lived token minted from an app or bot, as below. The connector keeps the credential in memory only and talks to the Git host directly, so large files never pass through the Pikibun server, and the agent's shell and sandbox never see the credential.
+
+| Provider | Push identity | Token |
+|---|---|---|
+| GitHub | The Pikibun GitHub App installed on the repository, or your own GitHub App | 1 hour, this repository only, revoked after the push |
+| GitHub Enterprise Server | A GitHub App registered on your server | 1 hour, this repository only, revoked after the push |
+| GitLab | An OAuth application authorized once by a bot account (`write_repository read_user`) | Up to 2 hours, the bot's projects |
+| Bitbucket Cloud | An OAuth consumer of the Bitbucket workspace with Repositories: Write | 1–2 hours as Bitbucket issues it, the workspace's repositories |
+| Azure DevOps | A Microsoft Entra app with a federated credential that trusts Pikibun, its service principal added to the organization | About 1 hour, what you grant the service principal |
+| Forgejo v16 or newer | A Generic JWT Authorized Integration that trusts Pikibun | 10 minutes, what the integration allows |
+| Gitea 1.23 or newer | An OAuth2 application authorized once by a bot account (`write:repository read:user`) | Up to 1 hour, the bot's repositories |
+
+Except for GitHub, a push token carries everything its identity can reach until it expires, and the host that runs the session receives it. Give each bot, consumer, service principal or integration access to the workspace's repositories only; a Forgejo integration can also require the `repository` and `ref` claims Pikibun adds to each token. Workspace owners and admins can forbid agent pushes to a repository's default branch, and removing a repository from the workspace stops pushes from sessions pinned to it.
+
+Instead of an app or bot, a provider's push identity can be one of these. Both push only from sessions running on the session owner's own hosts, so no one's credentials reach anyone else's machine; elsewhere the push is refused and needs an app or bot identity:
+
+- **Session owner's account**: the push uses the account the session owner connected to Pikibun, the GitHub sign-in or the token under **Settings → Profile → Connected accounts**, which then needs write scopes (GitHub Enterprise Contents write, GitLab `write_repository`, Bitbucket `write:repository:bitbucket`, Azure DevOps Code (Read & write), Gitea `write:repository`). Your account tokens otherwise never reach the connector: with this identity your own host receives yours for each push in your sessions. Pikibun resets a GitHub token through its OAuth app when the push ends, so the host's copy stops working while you stay connected; if the host never reports the push, the reset follows about an hour later. Tokens for the other providers can't be reset and stay valid after the push.
+- **Host's Git credentials** (connector 0.6.0 or newer): the connector reads the HTTPS credentials Git on the host would use for the repository, through its credential helpers (for example after `gh auth setup-git`, or from the macOS keychain or Git Credential Manager), without ever prompting. Pikibun sends no credential. The host's owner turns on **Git credentials** in its configuration; then only their own sessions on that host push this way.
+
+Pull requests are still opened as the session owner, with the owner's connected account.
+
+## GitHub issues and pull requests
+
+The sandbox has no network, so `gh` and `curl` inside it can't reach GitHub. Agents read and act on GitHub through Pikibun instead, as the session owner and with the owner's GitHub sign-in, which stays on the Pikibun server: the host and the sandbox never see it. These tools need connector 0.7.0 or newer; an agent whose tools predate them asks the session owner the first time, with the permission card described below. GitHub Enterprise and other providers are not covered.
+
+- `github_read` reads an issue or pull request of one of the workspace's github.com repositories: its description and comments, and for a pull request its merge state, head commit, reviews, review comments with file, line and diff hunk, and checks. Long threads keep their newest items. Like any repository content, what it returns is untrusted input. A read needs no approval, but only runs during a write message (until an hour after it was sent), and each read is recorded in the session's audit log.
+- `github_merge` merges a pull request of one of those repositories at the exact head commit the agent read, with a merge commit, squash or rebase. It waits for a human approval unless the session owner's message chose **Auto-approve** (in older Pikibun apps, with their **Auto-merge** option on too). If the head moved or GitHub refuses (failing checks, missing reviews, conflicts, a method the repository doesn't allow), nothing is merged and the agent gets GitHub's reason.
+- `github_comment` posts a comment. It waits for a human approval unless the session owner's message chose **Auto-approve**.
+- `github_issue` opens an issue with exactly the approved title and body in one of those repositories, and gives the agent its number and URL (connector newer than 0.9.0). It waits for a human approval unless the session owner's message chose **Auto-approve**. If GitHub refuses (issues turned off, no access), no issue is opened and the agent gets GitHub's reason.
+
+## Web pages and search
+
+Agents read web pages with `web_fetch` and search the web with `web_search` (connector newer than 0.9.0).
+
+- `web_fetch` reads one `https://` page from this host, as far as the workspace's network access lets the session's sandbox reach, and never at an address in this host's own networks. It sends no cookies or credentials and only reads; HTML comes back as text, images as images. It needs no approval, during a shared message. On a host running without the sandbox it still follows the workspace's network access.
+- `web_search` asks Pikibun, which searches with the provider its operator configured, where the workspace turned web search on. The provider's key never reaches this host.
+
+What they return is untrusted input, like any repository content.
+
+## Chat options
+
+In a session's chat box you can pick any model this host's Pi offers that isn't disabled in the web app, its reasoning level, and the access mode for each message: **Read only**, **Ask before acting** (the default) or **Auto-approve** (session owner only). Hosts running a connector older than 0.3.0 keep each session's pinned model; restart the connector with `npx pikibun@latest connect` to enable the options.
+
+A model starts at the reasoning level Pi on the host gives it: the level in its `enabledModels` pattern (such as `"anthropic/*:high"`), else its entry in `modelThinkingLevels`, else `defaultThinkingLevel`, else Pi's default (medium), moved to the nearest level the model supports. The chat box shows that level when you pick the model (connector 0.5.1 or newer). The levels on offer are the ones Pi reports for the model. If the host's `models.json` redefines a model without its `thinkingLevelMap`, Pi offers only Off to High for it.
+
+Agents change files with `edit_file`, which replaces exact text in place, or with `write_file`, which writes a whole file. `edit_file` needs connector 0.5.1 or newer.
+
+A new session starts from a host and one of its models, and gets every tool that host supports with no extra instructions. The access mode still decides what runs without asking.
+
+When a call needs more than the session allows, the agent asks instead of failing (connector 0.6.0 or newer): a tool its agent doesn't include, a change in a **Read only** message, or a shell command on a sandboxed host without resource limits. The session owner gets a card with **Allow once**, **Allow for this session** and **Deny**. The call can wait for the answer until an hour after the message was sent, and the session's queue waits with it. Allowing a tool doesn't approve what it does: commands, commits, pushes, GitHub comments, merges and issues still need their own approval unless the message auto-approves. A message the session owner sends with **Auto-approve** asks none of this (connector 0.7.1 or newer): its calls go ahead at once, for that message only. Only the host's owner can let commands run without resource limits in their own sessions, and so can members they granted host commands there, in theirs (connectors advertising `unboundedShellGrants`), whose commands are then decided like host commands. Either way they still run in the sandbox, offline and for at most the host's command time limit, but with no cap on CPU, memory, processes or disk. A session restored from a backup asks again.
+
+## Session status
+
+The session list shows what each session's agent is doing, as its host reports it: **In progress** while a message is queued or running, **Needs approval** while a permission card holds the work or, once the work stops, an operation awaits its approval, then **Done** or **Failed** for how the latest shared message ended. Side asks don't change done or failed. Hosts report this with connectors newer than 0.7.1; restart an older one with `npx pikibun@latest connect` to show it.
+
+## License
+
+MIT
+
+## Running Pikibun on your own computer
+
+```sh
+npx pikibun@latest serve
+```
+
+runs the Pikibun server and its web app on `http://127.0.0.1:7878`, reachable from this computer only, with this computer as the host that runs your sessions. You sign in with GitHub through an OAuth app of your own: register one once at <https://github.com/settings/applications/new> with the homepage `http://127.0.0.1` and the callback URL `http://127.0.0.1/api/auth/github/callback`, and the first run asks for its client ID and secret (hidden). It then prints a sign-in link: the GitHub account that signs in through it becomes the owner, and the only account that can sign in. Once you have, this computer pairs itself as your host, sandboxed as with `connect` (or with `--unsafe-no-sandbox`; `--no-host` serves without it).
+
+Everything is kept in `~/.local/share/pikibun/server` (`--state-dir`), apart from `connect`'s own state, so later runs need no options. Run `npx pikibun serve --help` for the rest.

package/dist/chunks/chunk-5QG5ACQ3.js

@@ -0,0 +1,382 @@
+// ../../apps/server/src/db/types.ts
+var ConstraintError = class extends Error {
+  constructor(message, constraint, options) {
+    super(message, options);
+    this.constraint = constraint;
+    this.name = "ConstraintError";
+  }
+  constraint;
+};
+
+// ../../apps/server/src/db/migrations.ts
+import { existsSync } from "node:fs";
+import { readdir, readFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+function migrationsDirectory(provider) {
+  if (process.env.MIGRATIONS_DIR) return resolve(process.env.MIGRATIONS_DIR, provider);
+  let directory = dirname(fileURLToPath(import.meta.url));
+  for (let depth = 0; depth < 3; depth++) {
+    const candidate = join(directory, "migrations", provider);
+    if (existsSync(candidate)) return candidate;
+    directory = dirname(directory);
+  }
+  throw new Error(`No migrations directory for ${provider} near ${fileURLToPath(import.meta.url)}; set MIGRATIONS_DIR.`);
+}
+async function readMigrations(directory) {
+  const names = (await readdir(directory)).filter((name) => name.endsWith(".sql")).sort();
+  return Promise.all(names.map(async (name) => ({ name, sql: await readFile(join(directory, name), "utf8") })));
+}
+
+// ../../apps/server/src/db/sql.ts
+var identStart = /[A-Za-z_]/;
+var identChar = /[A-Za-z0-9_$]/;
+var operators = ["->>", "<>", "!=", "<=", ">=", "||", "->"];
+function tokenize(sql) {
+  const tokens = [];
+  let i = 0;
+  while (i < sql.length) {
+    const ch = sql[i];
+    if (/\s/.test(ch)) {
+      let end = i + 1;
+      while (end < sql.length && /\s/.test(sql[end])) end++;
+      tokens.push({ kind: "space", text: sql.slice(i, end) });
+      i = end;
+    } else if (ch === "-" && sql[i + 1] === "-") {
+      let end = sql.indexOf("\n", i);
+      if (end === -1) end = sql.length;
+      tokens.push({ kind: "space", text: sql.slice(i, end) });
+      i = end;
+    } else if (ch === "/" && sql[i + 1] === "*") {
+      let end = sql.indexOf("*/", i + 2);
+      if (end === -1) throw new Error("Unterminated comment in SQL statement.");
+      end += 2;
+      tokens.push({ kind: "space", text: sql.slice(i, end) });
+      i = end;
+    } else if (ch === "'" || ch === '"') {
+      let end = i + 1;
+      for (; ; ) {
+        const close = sql.indexOf(ch, end);
+        if (close === -1) throw new Error("Unterminated string literal in SQL statement.");
+        if (sql[close + 1] === ch) {
+          end = close + 2;
+          continue;
+        }
+        end = close + 1;
+        break;
+      }
+      tokens.push({ kind: ch === "'" ? "string" : "quoted", text: sql.slice(i, end) });
+      i = end;
+    } else if (ch === "?") {
+      tokens.push({ kind: "placeholder", text: "?" });
+      i++;
+    } else if (identStart.test(ch)) {
+      let end = i + 1;
+      while (end < sql.length && identChar.test(sql[end])) end++;
+      tokens.push({ kind: "ident", text: sql.slice(i, end) });
+      i = end;
+    } else if (/[0-9]/.test(ch)) {
+      let end = i + 1;
+      while (end < sql.length && /[0-9.]/.test(sql[end])) end++;
+      tokens.push({ kind: "number", text: sql.slice(i, end) });
+      i = end;
+    } else {
+      const operator = operators.find((candidate) => sql.startsWith(candidate, i));
+      tokens.push({ kind: "punct", text: operator ?? ch });
+      i += operator ? operator.length : 1;
+    }
+  }
+  return tokens;
+}
+var keywordList = [
+  "SELECT",
+  "FROM",
+  "WHERE",
+  "AND",
+  "OR",
+  "NOT",
+  "NULL",
+  "IS",
+  "IN",
+  "AS",
+  "ON",
+  "JOIN",
+  "LEFT",
+  "RIGHT",
+  "INNER",
+  "CROSS",
+  "OUTER",
+  "FULL",
+  "NATURAL",
+  "USING",
+  "GROUP",
+  "ORDER",
+  "BY",
+  "HAVING",
+  "LIMIT",
+  "OFFSET",
+  "UNION",
+  "ALL",
+  "EXCEPT",
+  "INTERSECT",
+  "INSERT",
+  "INTO",
+  "VALUES",
+  "UPDATE",
+  "SET",
+  "DELETE",
+  "RETURNING",
+  "CONFLICT",
+  "DO",
+  "NOTHING",
+  "WITH",
+  "RECURSIVE",
+  "CASE",
+  "WHEN",
+  "THEN",
+  "ELSE",
+  "END",
+  "EXISTS",
+  "BETWEEN",
+  "LIKE",
+  "GLOB",
+  "DISTINCT",
+  "ASC",
+  "DESC",
+  "COLLATE",
+  "CAST",
+  "LATERAL",
+  "EXCLUDED",
+  "TRUE",
+  "FALSE",
+  "REPLACE",
+  "DEFAULT",
+  "ESCAPE"
+];
+var keywords = Object.fromEntries(keywordList.map((word) => [word, true]));
+var joinQualifiers = { CROSS: true, INNER: true, LEFT: true, RIGHT: true, FULL: true, OUTER: true, NATURAL: true };
+var isKeyword = (token) => token?.kind === "ident" && keywords[token.text.toUpperCase()] === true;
+var isIdent = (token, name) => token?.kind === "ident" && token.text.toUpperCase() === name;
+var isPunct = (token, text) => token?.kind === "punct" && token.text === text;
+function next(tokens, from) {
+  let i = from;
+  while (i < tokens.length && tokens[i].kind === "space") i++;
+  return i;
+}
+function previous(tokens, from) {
+  let i = from;
+  while (i >= 0 && tokens[i].kind === "space") i--;
+  return i;
+}
+function closing(tokens, open) {
+  let depth = 0;
+  for (let i = open; i < tokens.length; i++) {
+    if (isPunct(tokens[i], "(")) depth++;
+    else if (isPunct(tokens[i], ")") && --depth === 0) return i;
+  }
+  throw new Error("Unbalanced parentheses in SQL statement.");
+}
+function callArguments(tokens, open, close) {
+  const ranges = [];
+  let start = open + 1, depth = 0;
+  for (let i = open + 1; i < close; i++) {
+    if (isPunct(tokens[i], "(")) depth++;
+    else if (isPunct(tokens[i], ")")) depth--;
+    else if (depth === 0 && isPunct(tokens[i], ",")) {
+      ranges.push([start, i]);
+      start = i + 1;
+    }
+  }
+  if (next(tokens, start) < close) ranges.push([start, close]);
+  return ranges;
+}
+function jsonPath(tokens, range) {
+  const token = range && tokens[next(tokens, range[0])];
+  const literal = token?.kind === "string" ? token.text.slice(1, -1) : null;
+  if (literal === null || !/^\$(\.[A-Za-z_][A-Za-z0-9_]*)+$/.test(literal) || next(tokens, next(tokens, range[0]) + 1) < range[1]) {
+    throw new Error("Only literal JSON paths of the form '$.a.b' can be translated.");
+  }
+  return literal.slice(2).split(".");
+}
+var pathOperator = (segments) => segments.length === 1 ? `->> '${segments[0]}'` : `#>> '{${segments.join(",")}}'`;
+var pathArray = (segments) => `'{${segments.join(",")}}'`;
+var CHANGES = "\0changes\0";
+var Translator = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  tokens;
+  placeholders = 0;
+  changes = false;
+  subqueries = 0;
+  /** Indices of `)` closing an unaliased FROM/JOIN subquery that needs an alias appended. */
+  aliasAfter = /* @__PURE__ */ new Set();
+  range(from, to) {
+    const { tokens } = this;
+    let out = "";
+    for (let i = from; i < to; ) {
+      const token = tokens[i];
+      if (token.kind === "placeholder") {
+        out += `$${++this.placeholders}`;
+        const is = next(tokens, i + 1);
+        if (isIdent(tokens[is], "IS")) {
+          let operand = next(tokens, is + 1);
+          if (isIdent(tokens[operand], "NOT")) operand = next(tokens, operand + 1);
+          if (isIdent(tokens[operand], "NULL")) out += "::text";
+        }
+        i++;
+        continue;
+      }
+      if (token.kind === "ident") {
+        const call = next(tokens, i + 1);
+        if (isPunct(tokens[call], "(")) {
+          const translated = this.call(token.text.toLowerCase(), i, call);
+          if (translated) {
+            out += translated.text;
+            i = translated.end;
+            continue;
+          }
+        }
+        const upper = token.text.toUpperCase();
+        if (upper === "IS") {
+          const not = next(tokens, i + 1);
+          const negated = isIdent(tokens[not], "NOT");
+          const literal = tokens[negated ? next(tokens, not + 1) : not];
+          if (!isIdent(literal, "NULL") && !isIdent(literal, "DISTINCT") && !isIdent(literal, "TRUE") && !isIdent(literal, "FALSE")) {
+            out += negated ? "IS DISTINCT FROM" : "IS NOT DISTINCT FROM";
+            i = negated ? not + 1 : i + 1;
+            continue;
+          }
+        } else if (upper === "COLLATE" && isIdent(tokens[next(tokens, i + 1)], "NOCASE")) {
+          i = next(tokens, i + 1) + 1;
+          continue;
+        } else if (upper === "JOIN" && joinQualifiers[tokens[previous(tokens, i - 1)]?.text.toUpperCase() ?? ""] !== true) {
+          const fn = next(tokens, i + 1);
+          const open = next(tokens, fn + 1);
+          if (isIdent(tokens[fn], "JSON_EACH") && isPunct(tokens[open], "(")) {
+            let after = next(tokens, closing(tokens, open) + 1);
+            if (isIdent(tokens[after], "AS")) after = next(tokens, after + 1);
+            if (tokens[after]?.kind === "ident" && !isKeyword(tokens[after])) after = next(tokens, after + 1);
+            if (!isIdent(tokens[after], "ON") && !isIdent(tokens[after], "USING")) {
+              out += "CROSS JOIN";
+              i++;
+              continue;
+            }
+          }
+        } else if (!isKeyword(token) && /[A-Z]/.test(token.text) && /[a-z]/.test(token.text)) {
+          out += `"${token.text}"`;
+          i++;
+          continue;
+        }
+        out += token.text;
+        i++;
+        continue;
+      }
+      if (isPunct(token, "(")) {
+        const before = tokens[previous(tokens, i - 1)];
+        if ((isIdent(before, "FROM") || isIdent(before, "JOIN")) && isIdent(tokens[next(tokens, i + 1)], "SELECT")) {
+          const close = closing(tokens, i);
+          const after = tokens[next(tokens, close + 1)];
+          if (!isIdent(after, "AS") && !(after?.kind === "ident" && !isKeyword(after))) this.aliasAfter.add(close);
+        }
+      } else if (isPunct(token, ")") && this.aliasAfter.has(i)) {
+        out += `) AS sq${++this.subqueries}`;
+        i++;
+        continue;
+      }
+      out += token.text;
+      i++;
+    }
+    return out;
+  }
+  call(name, at, open) {
+    const { tokens } = this;
+    const close = closing(tokens, open);
+    const args = callArguments(tokens, open, close);
+    const end = close + 1;
+    const argument = (index) => {
+      const range = args[index];
+      if (!range) throw new Error(`${name}() needs ${index + 1} arguments.`);
+      return this.range(range[0], range[1]).trim();
+    };
+    switch (name) {
+      case "json_extract":
+        return { text: `((${argument(0)})::jsonb ${pathOperator(jsonPath(tokens, args[1]))})`, end };
+      case "json_each":
+        return { text: `jsonb_array_elements_text((${argument(0)})::jsonb)`, end };
+      case "json_group_array":
+        return { text: `COALESCE(jsonb_agg(${this.range(open + 1, close).trim()}), '[]'::jsonb)::text`, end };
+      case "json_array":
+        return { text: `jsonb_build_array(${this.range(open + 1, close).trim()})::text`, end };
+      case "json":
+        return { text: `((${argument(0)})::jsonb::text)`, end };
+      case "json_type": {
+        const value = args.length > 1 ? `((${argument(0)})::jsonb #> ${pathArray(jsonPath(tokens, args[1]))})` : `((${argument(0)})::jsonb)`;
+        return { text: `(CASE jsonb_typeof(${value}) WHEN 'boolean' THEN (${value} #>> '{}') WHEN 'string' THEN 'text' WHEN 'number' THEN (CASE WHEN (${value} #>> '{}') ~ '^-?[0-9]+$' THEN 'integer' ELSE 'real' END) ELSE jsonb_typeof(${value}) END)`, end };
+      }
+      case "json_set": {
+        const path = pathArray(jsonPath(tokens, args[1]));
+        const valueRange = args[2];
+        if (!valueRange) throw new Error("json_set() needs 3 arguments.");
+        const bare = next(tokens, valueRange[0]);
+        const value = tokens[bare]?.kind === "placeholder" && next(tokens, bare + 1) >= valueRange[1] ? `${argument(2)}::text` : argument(2);
+        return { text: `jsonb_set((${argument(0)})::jsonb, ${path}, to_jsonb(${value}))::text`, end };
+      }
+      case "changes":
+        if (args.length) return null;
+        this.changes = true;
+        return { text: CHANGES, end };
+      case "lower": {
+        const hex = next(tokens, open + 1), hexOpen = next(tokens, hex + 1), blob = next(tokens, hexOpen + 1);
+        const blobOpen = next(tokens, blob + 1), size = next(tokens, blobOpen + 1);
+        if (isIdent(tokens[hex], "HEX") && isPunct(tokens[hexOpen], "(") && isIdent(tokens[blob], "RANDOMBLOB") && isPunct(tokens[blobOpen], "(") && tokens[size]?.text === "16" && closing(tokens, blobOpen) === next(tokens, size + 1) && closing(tokens, hexOpen) === next(tokens, closing(tokens, blobOpen) + 1) && close === next(tokens, closing(tokens, hexOpen) + 1)) {
+          return { text: "replace(gen_random_uuid()::text, '-', '')", end };
+        }
+        return null;
+      }
+      default:
+        return null;
+    }
+  }
+};
+var postgresCache = /* @__PURE__ */ new Map();
+function translateToPostgres(sql) {
+  const cached = postgresCache.get(sql);
+  if (cached) return cached;
+  const tokens = tokenize(sql);
+  const translator = new Translator(tokens);
+  let text = translator.range(0, tokens.length);
+  if (translator.changes) text = text.replaceAll(CHANGES, `$${translator.placeholders + 1}`);
+  const statement = { text, placeholders: translator.placeholders, changes: translator.changes };
+  if (postgresCache.size >= 2048) postgresCache.clear();
+  postgresCache.set(sql, statement);
+  return statement;
+}
+var shapeCache = /* @__PURE__ */ new Map();
+function statementShape(sql) {
+  const cached = shapeCache.get(sql);
+  if (cached) return cached;
+  const tokens = tokenize(sql);
+  let depth = 0, verb = null, returning = false;
+  for (const token of tokens) {
+    if (isPunct(token, "(")) depth++;
+    else if (isPunct(token, ")")) depth--;
+    else if (depth === 0 && token.kind === "ident") {
+      const upper = token.text.toUpperCase();
+      if (!verb && ["SELECT", "INSERT", "UPDATE", "DELETE", "REPLACE"].includes(upper)) verb = upper;
+      if (upper === "RETURNING") returning = true;
+    }
+  }
+  const shape = { write: verb !== null && verb !== "SELECT", returning };
+  if (shapeCache.size >= 2048) shapeCache.clear();
+  shapeCache.set(sql, shape);
+  return shape;
+}
+
+export {
+  ConstraintError,
+  migrationsDirectory,
+  readMigrations,
+  translateToPostgres,
+  statementShape
+};