snoutdata 0.1.0 → 0.1.1

package/dist/snoutdata.mjs

@@ -1,2477 +1,58 @@
 #!/usr/bin/env node
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
-// src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, parse, resolve } from "node:path";
-function authPath(home = homedir()) {
-  return join(home, ".snoutdata", "auth.json");
-}
-function readAuth(home = homedir()) {
-  const fromEnvironment = process.env.SNOUTDATA_ACCESS_TOKEN;
-  if (fromEnvironment) {
-    return { accessToken: fromEnvironment };
-  }
-  const path = authPath(home);
-  if (!existsSync(path)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    return typeof parsed.accessToken === "string" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function writeAuth(auth, home = homedir()) {
-  const path = authPath(home);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(auth, null, 2)}
-`, { mode: 384 });
-  chmodSync(path, 384);
-}
-function clearAuth(home = homedir()) {
-  rmSync(authPath(home), { force: true });
-}
-function isExpired(auth, now = Date.now()) {
-  if (!auth.expiresAt) {
-    return false;
-  }
-  return auth.expiresAt * 1e3 - 6e4 <= now;
-}
-function linkPath(directory) {
-  return join(directory, ".snoutdata", "project.json");
-}
-function findLink(from) {
-  let directory = resolve(from);
-  const root = parse(directory).root;
-  for (; ; ) {
-    const path = linkPath(directory);
-    if (existsSync(path)) {
-      try {
-        const parsed = JSON.parse(readFileSync(path, "utf8"));
-        if (typeof parsed.ref === "string" && parsed.ref) {
-          return { ref: parsed.ref, directory };
-        }
-      } catch {
-      }
-    }
-    if (directory === root) {
-      return null;
-    }
-    directory = dirname(directory);
-  }
-}
-function writeLink(directory, project) {
-  const path = linkPath(directory);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(project, null, 2)}
-`);
-  return path;
-}
-function resolveRef(options) {
-  const environment = options.environment ?? process.env;
-  if (options.flag) {
-    return options.flag;
-  }
-  if (environment.SNOUTDATA_PROJECT) {
-    return environment.SNOUTDATA_PROJECT;
-  }
-  return findLink(options.cwd ?? process.cwd())?.ref ?? null;
-}
-var init_config = __esm({
-  "src/config.ts"() {
-    "use strict";
-  }
-});
-
-// src/interactive.ts
-function interactiveState(input) {
-  const optOut = input.env.SNOUTDATA_NO_INTERACTIVE;
-  if (optOut !== void 0 && optOut !== "" && optOut !== "0" && optOut !== "false") {
-    return { canAsk: false, reason: "opted-out" };
-  }
-  if (input.json) {
-    return { canAsk: false, reason: "json" };
-  }
-  for (const name of CI_VARIABLES) {
-    const value = input.env[name];
-    if (value !== void 0 && value !== "" && value !== "0" && value !== "false") {
-      return { canAsk: false, reason: "ci" };
-    }
-  }
-  if (!input.isTty) {
-    return { canAsk: false, reason: "not-a-tty" };
-  }
-  return { canAsk: true };
-}
-function explainNoHuman(reason) {
-  switch (reason) {
-    case "json":
-      return "running with --json, so nothing was asked";
-    case "opted-out":
-      return "SNOUTDATA_NO_INTERACTIVE is set, so nothing was asked";
-    case "ci":
-      return "this looks like CI, so nothing was asked";
-    case "not-a-tty":
-      return "there is no terminal to ask at";
-  }
-}
-function setInteractive(state) {
-  override = state;
-}
-function canAsk() {
-  return (override ?? interactiveState({ isTty: Boolean(process.stdin.isTTY), json: false, env: process.env })).canAsk;
-}
-function noHumanReason() {
-  return (override ?? interactiveState({ isTty: Boolean(process.stdin.isTTY), json: false, env: process.env })).reason;
-}
-var CI_VARIABLES, override;
-var init_interactive = __esm({
-  "src/interactive.ts"() {
-    "use strict";
-    CI_VARIABLES = ["CI", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "CIRCLECI", "TF_BUILD"];
-    override = null;
-  }
-});
-
-// src/desktop.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2, hostname } from "node:os";
-import { join as join2 } from "node:path";
-function userDataDir(app, platform, env) {
-  if (platform === "win32") {
-    const appData = env.APPDATA ?? join2(homedir2(), "AppData", "Roaming");
-    return join2(appData, app);
-  }
-  if (platform === "darwin") {
-    return join2(homedir2(), "Library", "Application Support", app);
-  }
-  return join2(env.XDG_CONFIG_HOME ?? join2(homedir2(), ".config"), app);
-}
-function configPaths(platform = process.platform, env = process.env) {
-  if (env.SNOUTDATA_DESKTOP_CONFIG) {
-    return [env.SNOUTDATA_DESKTOP_CONFIG];
-  }
-  return ["snoutdata", "snoutdata-dev"].map((app) => join2(userDataDir(app, platform, env), "mcp.json"));
-}
-function configPath(platform = process.platform, env = process.env) {
-  return configPaths(platform, env)[0];
-}
-function readDesktopConfig(path = configPath()) {
-  if (!existsSync2(path)) {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    if (typeof parsed.port !== "number" || typeof parsed.token !== "string" || !parsed.token) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function offerFromConfig(config) {
-  if (!config) {
-    return "no-config";
-  }
-  if (config.enabled === false) {
-    return "server-disabled";
-  }
-  if (config.signInHandoff === false) {
-    return "handoff-disabled";
-  }
-  return null;
-}
-async function look(config) {
-  if (config !== void 0) {
-    return lookAt(config);
-  }
-  let lastSkip = "no-config";
-  for (const path of configPaths()) {
-    const found = readDesktopConfig(path);
-    if (!found) {
-      continue;
-    }
-    const result = await lookAt(found);
-    if (result.available) {
-      return result;
-    }
-    if (result.skip !== "not-running") {
-      lastSkip = result.skip;
-    } else if (lastSkip === "no-config") {
-      lastSkip = result.skip;
-    }
-  }
-  return { available: false, skip: lastSkip };
-}
-async function lookAt(config) {
-  const skip = offerFromConfig(config);
-  if (skip) {
-    return { available: false, skip };
-  }
-  const settled = config;
-  let who;
-  try {
-    const response = await fetch(`http://127.0.0.1:${settled.port}/cli/whoami`, {
-      headers: { Authorization: `Bearer ${settled.token}` },
-      signal: AbortSignal.timeout(DIAL_MS)
-    });
-    if (!response.ok) {
-      return { available: false, skip: "not-running" };
-    }
-    who = await response.json();
-  } catch {
-    return { available: false, skip: "not-running" };
-  }
-  if (!who.signedIn) {
-    return { available: false, skip: "signed-out" };
-  }
-  if (!who.canMintToken) {
-    return { available: false, skip: "cannot-mint" };
-  }
-  return { available: true, who, config: settled };
-}
-async function mint(config, command) {
-  const response = await fetch(`http://127.0.0.1:${config.port}/cli/token`, {
-    method: "POST",
-    headers: { Authorization: `Bearer ${config.token}`, "Content-Type": "application/json" },
-    body: JSON.stringify({ client: "snoutdata-cli", command }),
-    // Longer than the dial: there is a person reading a card on the other end of this.
-    signal: AbortSignal.timeout(6e4)
-  });
-  const body = await response.json().catch(() => ({}));
-  if (response.ok && body.ok && body.token) {
-    return { token: body.token, name: body.name ?? "SnoutData CLI" };
-  }
-  return { declined: true, reason: body.error ?? `the app refused (${response.status})` };
-}
-function thisMachine() {
-  return hostname();
-}
-async function rpc(config, method, params, timeoutMs) {
-  const response = await fetch(`http://127.0.0.1:${config.port}/mcp`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${config.token}`,
-      "Content-Type": "application/json",
-      Accept: "application/json"
-    },
-    body: JSON.stringify({ jsonrpc: "2.0", id: Date.now(), method, params }),
-    signal: AbortSignal.timeout(timeoutMs)
-  });
-  if (!response.ok) {
-    throw new Error(`the app answered ${response.status}`);
-  }
-  const body = await response.json();
-  if (body.error) {
-    throw new Error(body.error.message ?? "the app refused");
-  }
-  return body.result;
-}
-async function borrowTools(config) {
-  await rpc(config, "initialize", { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "snoutdata-cli", version: "0" } }, 3e3);
-  const listed = await rpc(config, "tools/list", {}, 3e3);
-  return listed.tools ?? [];
-}
-async function callBorrowed(config, name, args) {
-  return rpc(config, "tools/call", { name, arguments: args }, 12e4);
-}
-var DIAL_MS;
-var init_desktop = __esm({
-  "src/desktop.ts"() {
-    "use strict";
-    DIAL_MS = 1500;
-  }
-});
-
-// src/failure.ts
-function fail(code, message, details) {
-  throw new CliFailure(code, message, details);
-}
-function codeForStatus(status) {
-  if (status === 403) {
-    return "forbidden";
-  }
-  if (status === 404) {
-    return "not-found";
-  }
-  if (status === 409) {
-    return "conflict";
-  }
-  if (status === 402 || status === 429) {
-    return "quota";
-  }
-  if (status === 503) {
-    return "not-ready";
-  }
-  if (status === 504) {
-    return "timeout";
-  }
-  if (status >= 500) {
-    return "server";
-  }
-  return "failed";
-}
-function codeForThrown(error) {
-  const causes = [error];
-  let cursor = error;
-  for (let depth = 0; depth < 4 && cursor instanceof Error && cursor.cause; depth += 1) {
-    cursor = cursor.cause;
-    causes.push(cursor);
-  }
-  for (const one of causes) {
-    const code = typeof one === "object" && one && "code" in one ? String(one.code) : "";
-    if (NETWORK_ERRNO.has(code)) {
-      return "network";
-    }
-    if (code === "ABORT_ERR" || code === "ETIMEDOUT") {
-      return "timeout";
-    }
-  }
-  if (error instanceof Error && /fetch failed|network|socket hang up/i.test(error.message)) {
-    return "network";
-  }
-  return "failed";
-}
-var EXIT, CliFailure, NETWORK_ERRNO;
-var init_failure = __esm({
-  "src/failure.ts"() {
-    "use strict";
-    EXIT = {
-      ok: 0,
-      failed: 1,
-      usage: 2,
-      "not-signed-in": 3,
-      "not-ready": 4,
-      forbidden: 5,
-      "not-found": 6,
-      conflict: 7,
-      quota: 8,
-      network: 9,
-      timeout: 10,
-      // 127 is the shell's own convention for "command not found", and somebody reading a CI
-      // log knows it on sight. Worth more than a number of ours in sequence.
-      "tool-missing": 127,
-      server: 1
-    };
-    CliFailure = class extends Error {
-      code;
-      /** Anything structured worth handing back: a list of refusals, a ref, a limit. */
-      details;
-      constructor(code, message, details) {
-        super(message);
-        this.name = "CliFailure";
-        this.code = code;
-        this.details = details;
-      }
-      get exitCode() {
-        return EXIT[this.code];
-      }
-    };
-    NETWORK_ERRNO = /* @__PURE__ */ new Set([
-      "ECONNREFUSED",
-      "ECONNRESET",
-      "ENOTFOUND",
-      "EAI_AGAIN",
-      "EHOSTUNREACH",
-      "ENETUNREACH",
-      "EPIPE",
-      "CERT_HAS_EXPIRED",
-      "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
-      "DEPTH_ZERO_SELF_SIGNED_CERT"
-    ]);
-  }
-});
-
-// src/device.ts
-async function post(fn, body) {
-  const response = await fetch(`${SUPABASE_URL}/functions/v1/${fn}`, {
-    method: "POST",
-    headers: { apikey: ANON_KEY, "Content-Type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  const parsed = await response.json().catch(() => ({}));
-  return { status: response.status, body: parsed };
-}
-async function start(client = {}) {
-  const { status, body } = await post("cloud-device-start", { client });
-  if (status === 429) {
-    fail("quota", body.error ?? "too many pairing attempts from here: wait a few minutes");
-  }
-  if (status === 404) {
-    fail(
-      "not-found",
-      "this SnoutData does not have the pairing flow (cloud-device-start is not deployed). Use `snoutdata login` to sign in with a browser, or set SNOUTDATA_ACCESS_TOKEN."
-    );
-  }
-  if (status !== 200 || !body.code || !body.secret) {
-    fail("server", body.error ?? `could not start a pairing (${status})`);
-  }
-  return body;
-}
-async function waitForApproval(secret, options) {
-  let intervalMs = options.intervalMs;
-  const deadline = Date.parse(options.expiresAt);
-  for (; ; ) {
-    if (Date.now() > deadline) {
-      fail("timeout", "that pairing code expired before it was approved. Run the command again for a new one.");
-    }
-    await new Promise((resolve3) => setTimeout(resolve3, intervalMs));
-    const { status, body } = await post("cloud-device-poll", { secret });
-    if (status === 404) {
-      fail("not-found", "that pairing is not known to the server. Run the command again for a new code.");
-    }
-    if (status === 400) {
-      fail("usage", body.error ?? "that is not a pairing secret");
-    }
-    if (status !== 200) {
-      fail("server", body.error ?? `the pairing could not be checked (${status})`);
-    }
-    switch (body.status) {
-      case "approved":
-        return { token: body.token, name: body.name };
-      case "denied":
-        fail("forbidden", body.error ?? "that pairing was refused in the browser");
-      // falls through, unreachable: `fail` never returns
-      case "used":
-        fail("conflict", body.error ?? "that pairing has already been completed");
-      case "expired":
-        fail("timeout", body.error ?? "that pairing code expired before it was approved");
-      case "slow-down":
-        intervalMs = Math.max(intervalMs * 2, (body.interval ?? 2) * 1e3);
-        break;
-      default:
-        if (body.interval) {
-          intervalMs = Math.max(intervalMs, body.interval * 1e3);
-        }
-        break;
-    }
-    options.onWait?.(Math.max(0, Math.round((deadline - Date.now()) / 1e3)));
-  }
-}
-var init_device = __esm({
-  "src/device.ts"() {
-    "use strict";
-    init_api();
-    init_failure();
-  }
-});
-
-// src/output.ts
-function setJsonMode(on) {
-  jsonMode = on;
-}
-function setQuiet(on) {
-  quiet = on;
-}
-function dim(text) {
-  return colour ? `\x1B[2m${text}\x1B[0m` : text;
-}
-function bold(text) {
-  return colour ? `\x1B[1m${text}\x1B[0m` : text;
-}
-function emit(value, human) {
-  if (jsonMode) {
-    process.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-    return;
-  }
-  human();
-}
-function say(message) {
-  if (!jsonMode && !quiet) {
-    process.stderr.write(`${message}
-`);
-  }
-}
-function emitFailure(code, message, details) {
-  process.stderr.write(`${message}
-`);
-  if (jsonMode) {
-    process.stdout.write(`${JSON.stringify({ ok: false, code, error: message, ...details }, null, 2)}
-`);
-  }
-}
-function warn(message) {
-  process.stderr.write(`${message}
-`);
-}
-function table(rows) {
-  if (rows.length === 0) {
-    return "";
-  }
-  const widths = rows[0].map(
-    (_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))
-  );
-  return rows.map((row) => row.map((cell, i) => cell.padEnd(widths[i] ?? 0)).join("  ").trimEnd()).join("\n");
-}
-function relative(iso) {
-  if (!iso) {
-    return "never";
-  }
-  const delta = Math.round((Date.now() - Date.parse(iso)) / 1e3);
-  const ahead = delta < 0;
-  const seconds = Math.abs(delta);
-  if (seconds < 60) {
-    return ahead ? "in a moment" : "just now";
-  }
-  const units = [
-    [60, "minute"],
-    [60, "hour"],
-    [24, "day"],
-    [30, "month"]
-  ];
-  let value = seconds;
-  let name = "second";
-  for (const [size, unit] of units) {
-    if (value < size) {
-      break;
-    }
-    value = Math.round(value / size);
-    name = unit;
-  }
-  const plural = `${value} ${name}${value === 1 ? "" : "s"}`;
-  return ahead ? `in ${plural}` : `${plural} ago`;
-}
-var jsonMode, quiet, colour;
-var init_output = __esm({
-  "src/output.ts"() {
-    "use strict";
-    jsonMode = false;
-    quiet = false;
-    colour = process.stdout.isTTY && !process.env.NO_COLOR;
-  }
-});
-
-// src/commands/login.ts
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { spawn } from "node:child_process";
-function base64url(input) {
-  return input.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function page(kind, detail) {
-  const accent = kind === "ok" ? "#e0b256" : "#e0765a";
-  const heading = kind === "ok" ? "Signed in" : "Sign-in failed";
-  const body = kind === "ok" ? "You can close this tab and go back to your terminal." : escapeHtml(detail ?? "Something went wrong.");
-  const hint = kind === "ok" ? "" : '<p style="color:#8f887e;margin:14px 0 0;font-size:14px">Run <code style="background:#1b1917;border:1px solid #262320;border-radius:6px;padding:2px 6px;font-size:13px">snoutdata login</code> to try again.</p>';
-  return `<!doctype html><html><head><meta charset="utf-8"><title>SnoutData</title>
+var tn=Object.defineProperty;var _=(e,t)=>()=>(e&&(t=e(e=0)),t);var nn=(e,t)=>{for(var n in t)tn(e,n,{get:t[n],enumerable:!0})};import{chmodSync as an,existsSync as Ke,mkdirSync as ze,readFileSync as Ye,rmSync as cn,writeFileSync as Ve}from"node:fs";import{homedir as le}from"node:os";import{dirname as $e,join as Xe,parse as ln,resolve as dn}from"node:path";function Pe(e=le()){return Xe(e,".snoutdata","auth.json")}function Ze(e=le()){let t=process.env.SNOUTDATA_ACCESS_TOKEN;if(t)return{accessToken:t};let n=Pe(e);if(!Ke(n))return null;try{let r=JSON.parse(Ye(n,"utf8"));return typeof r.accessToken=="string"?r:null}catch{return null}}function j(e,t=le()){let n=Pe(t);ze($e(n),{recursive:!0}),Ve(n,`${JSON.stringify(e,null,2)}
+`,{mode:384}),an(n,384)}function Qe(e=le()){cn(Pe(e),{force:!0})}function et(e,t=Date.now()){return e.expiresAt?e.expiresAt*1e3-6e4<=t:!1}function tt(e){return Xe(e,".snoutdata","project.json")}function un(e){let t=dn(e),n=ln(t).root;for(;;){let r=tt(t);if(Ke(r))try{let o=JSON.parse(Ye(r,"utf8"));if(typeof o.ref=="string"&&o.ref)return{ref:o.ref,directory:t}}catch{}if(t===n)return null;t=$e(t)}}function de(e,t){let n=tt(e);return ze($e(n),{recursive:!0}),Ve(n,`${JSON.stringify(t,null,2)}
+`),n}function ue(e){let t=e.environment??process.env;return e.flag?e.flag:t.SNOUTDATA_PROJECT?t.SNOUTDATA_PROJECT:un(e.cwd??process.cwd())?.ref??null}var z=_(()=>{"use strict"});function pe(e){let t=e.env.SNOUTDATA_NO_INTERACTIVE;if(t!==void 0&&t!==""&&t!=="0"&&t!=="false")return{canAsk:!1,reason:"opted-out"};if(e.json)return{canAsk:!1,reason:"json"};for(let n of pn){let r=e.env[n];if(r!==void 0&&r!==""&&r!=="0"&&r!=="false")return{canAsk:!1,reason:"ci"}}return e.isTty?{canAsk:!0}:{canAsk:!1,reason:"not-a-tty"}}function me(e){switch(e){case"json":return"running with --json, so nothing was asked";case"opted-out":return"SNOUTDATA_NO_INTERACTIVE is set, so nothing was asked";case"ci":return"this looks like CI, so nothing was asked";case"not-a-tty":return"there is no terminal to ask at"}}function nt(e){Ee=e}function Y(){return(Ee??pe({isTty:!!process.stdin.isTTY,json:!1,env:process.env})).canAsk}function fe(){return(Ee??pe({isTty:!!process.stdin.isTTY,json:!1,env:process.env})).reason}var pn,Ee,ee=_(()=>{"use strict";pn=["CI","GITHUB_ACTIONS","GITLAB_CI","BUILDKITE","CIRCLECI","TF_BUILD"];Ee=null});import{existsSync as mn,readFileSync as fn}from"node:fs";import{homedir as Oe,hostname as gn}from"node:os";import{join as V}from"node:path";function hn(e,t,n){if(t==="win32"){let r=n.APPDATA??V(Oe(),"AppData","Roaming");return V(r,e)}return t==="darwin"?V(Oe(),"Library","Application Support",e):V(n.XDG_CONFIG_HOME??V(Oe(),".config"),e)}function ot(e=process.platform,t=process.env){return t.SNOUTDATA_DESKTOP_CONFIG?[t.SNOUTDATA_DESKTOP_CONFIG]:["snoutdata","snoutdata-dev"].map(n=>V(hn(n,e,t),"mcp.json"))}function wn(e=process.platform,t=process.env){return ot(e,t)[0]}function yn(e=wn()){if(!mn(e))return null;try{let t=JSON.parse(fn(e,"utf8"));return typeof t.port!="number"||typeof t.token!="string"||!t.token?null:t}catch{return null}}function kn(e){return e?e.enabled===!1?"server-disabled":e.signInHandoff===!1?"handoff-disabled":null:"no-config"}async function ge(e){if(e!==void 0)return rt(e);let t="no-config";for(let n of ot()){let r=yn(n);if(!r)continue;let o=await rt(r);if(o.available)return o;(o.skip!=="not-running"||t==="no-config")&&(t=o.skip)}return{available:!1,skip:t}}async function rt(e){let t=kn(e);if(t)return{available:!1,skip:t};let n=e,r;try{let o=await fetch(`http://127.0.0.1:${n.port}/cli/whoami`,{headers:{Authorization:`Bearer ${n.token}`},signal:AbortSignal.timeout(bn)});if(!o.ok)return{available:!1,skip:"not-running"};r=await o.json()}catch{return{available:!1,skip:"not-running"}}return r.signedIn?r.canMintToken?{available:!0,who:r,config:n}:{available:!1,skip:"cannot-mint"}:{available:!1,skip:"signed-out"}}async function st(e,t){let n=await fetch(`http://127.0.0.1:${e.port}/cli/token`,{method:"POST",headers:{Authorization:`Bearer ${e.token}`,"Content-Type":"application/json"},body:JSON.stringify({client:"snoutdata-cli",command:t}),signal:AbortSignal.timeout(6e4)}),r=await n.json().catch(()=>({}));return n.ok&&r.ok&&r.token?{token:r.token,name:r.name??"SnoutData CLI"}:{declined:!0,reason:r.error??`the app refused (${n.status})`}}function he(){return gn()}async function _e(e,t,n,r){let o=await fetch(`http://127.0.0.1:${e.port}/mcp`,{method:"POST",headers:{Authorization:`Bearer ${e.token}`,"Content-Type":"application/json",Accept:"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:Date.now(),method:t,params:n}),signal:AbortSignal.timeout(r)});if(!o.ok)throw new Error(`the app answered ${o.status}`);let s=await o.json();if(s.error)throw new Error(s.error.message??"the app refused");return s.result}async function at(e){return await _e(e,"initialize",{protocolVersion:"2025-06-18",capabilities:{},clientInfo:{name:"snoutdata-cli",version:"0"}},3e3),(await _e(e,"tools/list",{},3e3)).tools??[]}async function it(e,t,n){return _e(e,"tools/call",{name:t,arguments:n},12e4)}var bn,we=_(()=>{"use strict";bn=1500});function g(e,t,n){throw new B(e,t,n)}function lt(e){return e===403?"forbidden":e===404?"not-found":e===409?"conflict":e===402||e===429?"quota":e===503?"not-ready":e===504?"timeout":e>=500?"server":"failed"}function dt(e){let t=[e],n=e;for(let r=0;r<4&&n instanceof Error&&n.cause;r+=1)n=n.cause,t.push(n);for(let r of t){let o=typeof r=="object"&&r&&"code"in r?String(r.code):"";if(xn.has(o))return"network";if(o==="ABORT_ERR"||o==="ETIMEDOUT")return"timeout"}return e instanceof Error&&/fetch failed|network|socket hang up/i.test(e.message)?"network":"failed"}var L,B,xn,te=_(()=>{"use strict";L={ok:0,failed:1,usage:2,"not-signed-in":3,"not-ready":4,forbidden:5,"not-found":6,conflict:7,quota:8,network:9,timeout:10,"tool-missing":127,server:1},B=class extends Error{code;details;constructor(t,n,r){super(n),this.name="CliFailure",this.code=t,this.details=r}get exitCode(){return L[this.code]}};xn=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","CERT_HAS_EXPIRED","UNABLE_TO_VERIFY_LEAF_SIGNATURE","DEPTH_ZERO_SELF_SIGNED_CERT"])});async function ut(e,t){let n=await fetch(`${R}/functions/v1/${e}`,{method:"POST",headers:{apikey:F,"Content-Type":"application/json"},body:JSON.stringify(t)}),r=await n.json().catch(()=>({}));return{status:n.status,body:r}}async function ye(e={}){let{status:t,body:n}=await ut("cloud-device-start",{client:e});return t===429&&g("quota",n.error??"too many pairing attempts from here: wait a few minutes"),t===404&&g("not-found","this SnoutData does not have the pairing flow (cloud-device-start is not deployed). Use `snoutdata login` to sign in with a browser, or set SNOUTDATA_ACCESS_TOKEN."),(t!==200||!n.code||!n.secret)&&g("server",n.error??`could not start a pairing (${t})`),n}async function ke(e,t){let n=t.intervalMs,r=Date.parse(t.expiresAt);for(;;){Date.now()>r&&g("timeout","that pairing code expired before it was approved. Run the command again for a new one."),await new Promise(d=>setTimeout(d,n));let{status:o,body:s}=await ut("cloud-device-poll",{secret:e});switch(o===404&&g("not-found","that pairing is not known to the server. Run the command again for a new code."),o===400&&g("usage",s.error??"that is not a pairing secret"),o!==200&&g("server",s.error??`the pairing could not be checked (${o})`),s.status){case"approved":return{token:s.token,name:s.name};case"denied":g("forbidden",s.error??"that pairing was refused in the browser");case"used":g("conflict",s.error??"that pairing has already been completed");case"expired":g("timeout",s.error??"that pairing code expired before it was approved");case"slow-down":n=Math.max(n*2,(s.interval??2)*1e3);break;default:s.interval&&(n=Math.max(n,s.interval*1e3));break}t.onWait?.(Math.max(0,Math.round((r-Date.now())/1e3)))}}var je=_(()=>{"use strict";T();te()});function ne(e){be=e}function mt(e){pt=e}function y(e){return ft?`\x1B[2m${e}\x1B[0m`:e}function A(e){return ft?`\x1B[1m${e}\x1B[0m`:e}function p(e,t){if(be){process.stdout.write(`${JSON.stringify(e,null,2)}
+`);return}t()}function i(e){!be&&!pt&&process.stderr.write(`${e}
+`)}function G(e,t,n){process.stderr.write(`${t}
+`),be&&process.stdout.write(`${JSON.stringify({ok:!1,code:e,error:t,...n},null,2)}
+`)}function $(e){process.stderr.write(`${e}
+`)}function W(e){if(e.length===0)return"";let t=e[0].map((n,r)=>Math.max(...e.map(o=>(o[r]??"").length)));return e.map(n=>n.map((r,o)=>r.padEnd(t[o]??0)).join("  ").trimEnd()).join(`
+`)}function H(e){if(!e)return"never";let t=Math.round((Date.now()-Date.parse(e))/1e3),n=t<0,r=Math.abs(t);if(r<60)return n?"in a moment":"just now";let o=[[60,"minute"],[60,"hour"],[24,"day"],[30,"month"]],s=r,d="second";for(let[c,l]of o){if(s<c)break;s=Math.round(s/c),d=l}let a=`${s} ${d}${s===1?"":"s"}`;return n?`in ${a}`:`${a} ago`}var be,pt,ft,E=_(()=>{"use strict";be=!1,pt=!1;ft=process.stdout.isTTY&&!process.env.NO_COLOR});import{createHash as gt,randomBytes as Re}from"node:crypto";import{createServer as ht}from"node:http";import{spawn as vn}from"node:child_process";function xe(e){return e.toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Se(e,t){let n=e==="ok"?"#e0b256":"#e0765a",r=e==="ok"?"Signed in":"Sign-in failed",o=e==="ok"?"You can close this tab and go back to your terminal.":Nn(t??"Something went wrong.");return`<!doctype html><html><head><meta charset="utf-8"><title>SnoutData</title>
 <meta name="viewport" content="width=device-width,initial-scale=1"></head>
 <body style="font-family:ui-sans-serif,system-ui,-apple-system,sans-serif;background:#050403;color:#e9e4dc;display:grid;place-items:center;min-height:100vh;margin:0">
 <div style="text-align:center;max-width:460px;padding:40px 24px">
 <div style="width:44px;height:44px;margin:0 auto 30px;border-radius:12px;background:#191714;border:1px solid #262320;display:grid;place-items:center">
-<div style="width:14px;height:14px;border-radius:50%;background:${accent}"></div>
+<div style="width:14px;height:14px;border-radius:50%;background:${n}"></div>
 </div>
 <div style="font-size:12px;font-weight:600;letter-spacing:.1em;text-transform:uppercase;color:#8f887e;margin-bottom:22px">SnoutData</div>
-<h1 style="margin:0 0 12px;font-size:30px;font-weight:600;letter-spacing:-.01em">${heading}</h1>
-<p style="color:#8f887e;margin:0;font-size:15px;line-height:1.5">${body}</p>
-${hint}
+<h1 style="margin:0 0 12px;font-size:30px;font-weight:600;letter-spacing:-.01em">${r}</h1>
+<p style="color:#8f887e;margin:0;font-size:15px;line-height:1.5">${o}</p>
+${e==="ok"?"":'<p style="color:#8f887e;margin:14px 0 0;font-size:14px">Run <code style="background:#1b1917;border:1px solid #262320;border-radius:6px;padding:2px 6px;font-size:13px">snoutdata login</code> to try again.</p>'}
 </div>
-</body></html>`;
-}
-function pkcePair() {
-  const verifier = base64url(randomBytes(32));
-  const challenge = base64url(createHash("sha256").update(verifier).digest());
-  return { verifier, challenge };
-}
-function openCommand(platform, url2) {
-  if (platform === "darwin") {
-    return { command: "open", args: [url2], verbatim: false };
-  }
-  if (platform === "win32") {
-    return { command: "cmd.exe", args: ["/c", "start", '""', `"${url2}"`], verbatim: true };
-  }
-  return { command: "xdg-open", args: [url2], verbatim: false };
-}
-function open(url2) {
-  const { command, args, verbatim } = openCommand(process.platform, url2);
-  const child = spawn(command, args, {
-    stdio: "ignore",
-    detached: true,
-    windowsVerbatimArguments: verbatim
-  });
-  child.on("error", () => {
-  });
-  child.unref();
-}
-function nonceForGoogle(raw) {
-  const value = raw ?? base64url(randomBytes(32));
-  return { raw: value, hashed: createHash("sha256").update(value).digest("hex") };
-}
-function googleAuthorizeUrl(parts) {
-  return `${GOOGLE_AUTH_ENDPOINT}?${new URLSearchParams({
-    client_id: GOOGLE_CLIENT_ID,
-    redirect_uri: parts.redirectUri,
-    response_type: "code",
-    scope: "openid email profile",
-    code_challenge: parts.challenge,
-    code_challenge_method: "S256",
-    nonce: parts.hashedNonce,
-    state: parts.state,
-    // ALWAYS ask which account.
-    //
-    // Without this, Google reuses whatever account the browser is already signed into
-    // and never says so: you type `snoutdata login`, a page flashes, and you are signed
-    // in as somebody else. On a shared machine, or for anybody with a work account and a
-    // personal one, that is silently the wrong identity, and the CLI is the surface where
-    // it is hardest to notice, because there is no avatar in the corner to check.
-    prompt: "select_account"
-  }).toString()}`;
-}
-function readRedirect(requestUrl, expectedState) {
-  const url2 = new URL(requestUrl, "http://127.0.0.1");
-  if (!url2.searchParams.has("code") && !url2.searchParams.has("error")) {
-    return { kind: "ignore" };
-  }
-  const error = url2.searchParams.get("error_description") ?? url2.searchParams.get("error");
-  if (error) {
-    return { kind: "error", message: error };
-  }
-  const code = url2.searchParams.get("code");
-  if (!code) {
-    return { kind: "error", message: "the browser came back without a code" };
-  }
-  if (url2.searchParams.get("state") !== expectedState) {
-    return { kind: "error", message: "the browser came back with a state that did not match" };
-  }
-  return { kind: "ok", code };
-}
-async function exchangeCodeForIdToken(code, verifier, redirectUri) {
-  const response = await fetch(GOOGLE_TOKEN_ENDPOINT, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      client_id: GOOGLE_CLIENT_ID,
-      client_secret: GOOGLE_CLIENT_SECRET,
-      code,
-      code_verifier: verifier,
-      grant_type: "authorization_code",
-      redirect_uri: redirectUri
-    })
-  });
-  const body = await response.json().catch(() => ({}));
-  if (!response.ok || !body.id_token) {
-    throw new Error(
-      `Google would not exchange the code: ${body.error_description ?? body.error ?? `HTTP ${response.status}`}`
-    );
-  }
-  return body.id_token;
-}
-async function loginWithGoogle(options) {
-  const { verifier, challenge } = pkcePair();
-  const { raw: rawNonce, hashed: hashedNonce } = nonceForGoogle();
-  const state = base64url(randomBytes(16));
-  const { code, redirectUri } = await new Promise(
-    (resolve3, reject) => {
-      let redirect = "";
-      const server = createServer((request, response2) => {
-        const outcome = readRedirect(request.url ?? "/", state);
-        if (outcome.kind === "ignore") {
-          response2.writeHead(404).end();
-          return;
-        }
-        response2.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-        response2.end(
-          outcome.kind === "ok" ? page("ok") : page("failed", outcome.message)
-        );
-        server.close();
-        if (outcome.kind === "ok") {
-          resolve3({ code: outcome.code, redirectUri: redirect });
-        } else {
-          reject(new Error(outcome.message));
-        }
-      });
-      server.listen(0, "127.0.0.1", () => {
-        const address = server.address();
-        const port = typeof address === "object" && address ? address.port : 0;
-        redirect = `http://127.0.0.1:${port}`;
-        const authorize = googleAuthorizeUrl({
-          redirectUri: redirect,
-          challenge,
-          hashedNonce,
-          state
-        });
-        process.stdout.write(`${authorize}
-`);
-        if (options.noBrowser) {
-          say("Open that in a browser, on any machine, and sign in.");
-        } else {
-          say("Opening that in your browser. If nothing opens, paste it into one.");
-          open(authorize);
-        }
-      });
-      server.on("error", reject);
-      const timer = setTimeout(() => {
-        server.close();
-        reject(new Error("timed out waiting for the browser"));
-      }, options.timeoutMs ?? 3e5);
-      timer.unref();
-    }
-  );
-  const idToken = await exchangeCodeForIdToken(code, verifier, redirectUri);
-  const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=id_token`, {
-    method: "POST",
-    headers: { apikey: ANON_KEY, "Content-Type": "application/json" },
-    body: JSON.stringify({ provider: "google", id_token: idToken, nonce: rawNonce })
-  });
-  if (!response.ok) {
-    throw new Error(
-      `could not turn the Google sign-in into a session: ${(await response.text()).slice(0, 200)}`
-    );
-  }
-  return storeSession(await response.json());
-}
-function storeSession(data) {
-  const body = data;
-  const result = {
-    accessToken: body.access_token,
-    refreshToken: body.refresh_token,
-    expiresAt: body.expires_at,
-    email: body.user?.email
-  };
-  writeAuth(result);
-  return result;
-}
-async function login(options = {}) {
-  const provider = options.provider ?? "google";
-  if (provider === "google") {
-    return loginWithGoogle(options);
-  }
-  const { verifier, challenge } = pkcePair();
-  const code = await new Promise((resolve3, reject) => {
-    const server = createServer((request, response2) => {
-      const url2 = new URL(request.url ?? "/", "http://127.0.0.1");
-      const received = url2.searchParams.get("code");
-      const error = url2.searchParams.get("error_description") ?? url2.searchParams.get("error");
-      response2.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      response2.end(received ? page("ok") : page("failed", error ?? "No code came back."));
-      server.close();
-      if (received) {
-        resolve3(received);
-      } else {
-        reject(new Error(error ?? "the browser came back without a code"));
-      }
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      const port = typeof address === "object" && address ? address.port : 0;
-      const redirect = `http://127.0.0.1:${port}/callback`;
-      const authorize = new URL(`${SUPABASE_URL}/auth/v1/authorize`);
-      authorize.searchParams.set("provider", provider);
-      authorize.searchParams.set("redirect_to", redirect);
-      authorize.searchParams.set("code_challenge", challenge);
-      authorize.searchParams.set("code_challenge_method", "s256");
-      authorize.searchParams.set("prompt", "select_account");
-      process.stdout.write(`${authorize.toString()}
-`);
-      if (options.noBrowser) {
-        say("Open that in a browser, on any machine, and sign in.");
-      } else {
-        say("Opening that in your browser. If nothing opens, paste it into one.");
-        open(authorize.toString());
-      }
-    });
-    const timer = setTimeout(() => {
-      server.close();
-      reject(new Error("timed out waiting for the browser"));
-    }, options.timeoutMs ?? 3e5);
-    timer.unref();
-  });
-  const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=pkce`, {
-    method: "POST",
-    headers: { apikey: ANON_KEY, "Content-Type": "application/json" },
-    body: JSON.stringify({ auth_code: code, code_verifier: verifier })
-  });
-  if (!response.ok) {
-    throw new Error(`could not exchange the code: ${(await response.text()).slice(0, 200)}`);
-  }
-  return storeSession(await response.json());
-}
-function escapeHtml(text) {
-  return text.replace(/[&<>"]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]);
-}
-var GOOGLE_AUTH_ENDPOINT, GOOGLE_TOKEN_ENDPOINT, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET;
-var init_login = __esm({
-  "src/commands/login.ts"() {
-    "use strict";
-    init_api();
-    init_config();
-    init_output();
-    GOOGLE_AUTH_ENDPOINT = "https://accounts.google.com/o/oauth2/v2/auth";
-    GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-    GOOGLE_CLIENT_ID = "1064562458607-9fqmghjoqjr7d56b98agkvjt9vt26pdc.apps.googleusercontent.com";
-    GOOGLE_CLIENT_SECRET = "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";
-  }
-});
-
-// src/ladder.ts
-import { createInterface } from "node:readline/promises";
-async function confirm(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = (await rl.question(`${question} [Y/n] `)).trim().toLowerCase();
-    return answer === "" || answer === "y" || answer === "yes";
-  } finally {
-    rl.close();
-  }
-}
-async function fromDesktop() {
-  const look2 = await look();
-  if (!look2.available) {
-    if (look2.skip === "handoff-disabled" || look2.skip === "server-disabled") {
-      say(dim("The SnoutData app is running but is not set to hand out sign-ins."));
-    }
-    return null;
-  }
-  const who = look2.who.email ?? "the signed-in account";
-  say("");
-  say(`The SnoutData app is open here, signed in as ${bold(who)}.`);
-  say(dim("It can create an access token for this terminal. Your sign-in itself is not handed over,"));
-  say(dim("and you can revoke the token later with `snoutdata tokens revoke`."));
-  if (!await confirm("Use it?")) {
-    return null;
-  }
-  say("Asking the app. Approve it there.");
-  const minted = await mint(look2.config, process.argv.slice(2).join(" ").slice(0, 60) || "snoutdata");
-  if ("declined" in minted) {
-    say(`The app did not create a token: ${minted.reason}`);
-    return null;
-  }
-  const auth = { accessToken: minted.token };
-  writeAuth(auth);
-  say(`Signed in with "${minted.name}".`);
-  return auth;
-}
-async function fromBrowser() {
-  if (!await confirm("Sign in with a browser?")) {
-    return null;
-  }
-  try {
-    const result = await login({});
-    say(`Signed in${result.email ? ` as ${result.email}` : ""}.`);
-    return { accessToken: result.accessToken, refreshToken: result.refreshToken, expiresAt: result.expiresAt };
-  } catch (error) {
-    say(`That did not finish: ${error instanceof Error ? error.message : String(error)}`);
-    return null;
-  }
-}
-async function fromDeviceCode() {
-  if (!await confirm("Sign in by typing a code into a browser on another machine?")) {
-    return null;
-  }
-  const started = await start({ name: thisMachine(), platform: process.platform });
-  say("");
-  say(`  Open   ${bold(started.verifyUrl)}`);
-  say(`  Type   ${bold(started.code)}`);
-  say("");
-  say(dim("The code is typed rather than in the link on purpose: it is what proves the person"));
-  say(dim("at the browser is the person at this terminal. Waiting\u2026"));
-  const approved = await waitForApproval(started.secret, {
-    intervalMs: Math.max(1, started.interval) * 1e3,
-    expiresAt: started.expiresAt
-  });
-  const auth = { accessToken: approved.token };
-  writeAuth(auth);
-  say(`Signed in${approved.name ? ` with "${approved.name}"` : ""}.`);
-  return auth;
-}
-async function climb() {
-  if (!canAsk()) {
-    return null;
-  }
-  const fromApp = await fromDesktop();
-  if (fromApp) {
-    return fromApp;
-  }
-  const browser = await fromBrowser();
-  if (browser) {
-    return browser;
-  }
-  return fromDeviceCode();
-}
-var init_ladder = __esm({
-  "src/ladder.ts"() {
-    "use strict";
-    init_config();
-    init_desktop();
-    init_device();
-    init_interactive();
-    init_login();
-    init_output();
-  }
-});
-
-// src/api.ts
-var api_exports = {};
-__export(api_exports, {
-  ANON_KEY: () => ANON_KEY,
-  ApiError: () => ApiError,
-  FUNCTIONS: () => FUNCTIONS,
-  NotSignedIn: () => NotSignedIn,
-  SUPABASE_URL: () => SUPABASE_URL,
-  call: () => call,
-  connection: () => connection,
-  exportStatus: () => exportStatus,
-  listProjects: () => listProjects,
-  listTeams: () => listTeams,
-  requestExport: () => requestExport,
-  waitForReady: () => waitForReady,
-  whoami: () => whoami
-});
-function notSignedInAdvice() {
-  const reason = noHumanReason();
-  if (reason) {
-    return `not signed in, and ${explainNoHuman(reason)}. Set SNOUTDATA_ACCESS_TOKEN to a token from \`snoutdata tokens create\`.`;
-  }
-  return "not signed in: run `snoutdata login`, or set SNOUTDATA_ACCESS_TOKEN";
-}
-async function currentToken() {
-  let auth = readAuth();
-  if (!auth) {
-    auth = await climb();
-  }
-  if (!auth) {
-    throw new NotSignedIn();
-  }
-  if (!isExpired(auth) || !auth.refreshToken) {
-    return auth.accessToken;
-  }
-  const response = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
-    method: "POST",
-    headers: { apikey: ANON_KEY, "Content-Type": "application/json" },
-    body: JSON.stringify({ refresh_token: auth.refreshToken })
-  });
-  if (!response.ok) {
-    throw new NotSignedIn();
-  }
-  const data = await response.json();
-  const next = {
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token,
-    expiresAt: data.expires_at,
-    email: auth.email
-  };
-  writeAuth(next);
-  return next.accessToken;
-}
-async function call(fn, body = {}, method = "POST") {
-  const token = await currentToken();
-  const query = method === "GET" && typeof body === "object" && body ? `?${new URLSearchParams(body).toString()}` : "";
-  const response = await fetch(`${FUNCTIONS}/${fn}${query}`, {
-    method,
-    headers: {
-      Authorization: `Bearer ${token}`,
-      apikey: ANON_KEY,
-      "Content-Type": "application/json"
-    },
-    body: method === "GET" ? void 0 : JSON.stringify(body)
-  });
-  const text = await response.text();
-  let parsed;
-  try {
-    parsed = text ? JSON.parse(text) : {};
-  } catch {
-    throw new ApiError(response.status, text.slice(0, 300) || response.statusText);
-  }
-  if (!response.ok) {
-    const message = typeof parsed === "object" && parsed && "error" in parsed ? String(parsed.error) : `${response.status} ${response.statusText}`;
-    if (response.status === 401) {
-      throw new NotSignedIn(message);
-    }
-    throw new ApiError(response.status, message);
-  }
-  return parsed;
-}
-async function whoami() {
-  return call("cloud-whoami");
-}
-async function listProjects() {
-  return call("cloud-project-list");
-}
-async function connection(ref) {
-  return call("cloud-project-connection", { ref });
-}
-async function listTeams() {
-  return call("cloud-team-list");
-}
-async function requestExport(ref) {
-  return call("cloud-project-export", { ref });
-}
-async function exportStatus(ref) {
-  return call("cloud-project-export", { ref }, "GET");
-}
-async function waitForReady(ref, options = {}) {
-  const deadline = Date.now() + (options.timeoutMs ?? 3e5);
-  for (; ; ) {
-    const { projects } = await listProjects();
-    const project = projects.find((candidate) => candidate.ref === ref);
-    if (!project) {
-      throw new ApiError(404, `no project ${ref}`);
-    }
-    options.onTick?.(project.state);
-    if (project.state === "ready") {
-      return project;
-    }
-    if (Date.now() >= deadline) {
-      throw new ApiError(504, `${ref} is still ${project.state} after waiting`);
-    }
-    await new Promise((resolve3) => setTimeout(resolve3, 2e3));
-  }
-}
-var SUPABASE_URL, ANON_KEY, FUNCTIONS, ApiError, NotSignedIn;
-var init_api = __esm({
-  "src/api.ts"() {
-    "use strict";
-    init_config();
-    init_interactive();
-    init_ladder();
-    SUPABASE_URL = process.env.SNOUTDATA_SUPABASE_URL ?? "https://krlhuuvhhgkwfsutvxtb.supabase.co";
-    ANON_KEY = process.env.SNOUTDATA_ANON_KEY ?? "sb_publishable_B0gbZinAncINGbDGOcP9rg_odcbriG3";
-    FUNCTIONS = `${SUPABASE_URL}/functions/v1`;
-    ApiError = class extends Error {
-      status;
-      constructor(status, message) {
-        super(message);
-        this.status = status;
-      }
-    };
-    NotSignedIn = class extends Error {
-      constructor(message) {
-        super(message ?? notSignedInAdvice());
-      }
-    };
-  }
-});
-
-// src/args.ts
-var UsageError = class extends Error {
-};
-var VALUED = /* @__PURE__ */ new Set([
-  "name",
-  "region",
-  "ref",
-  "file",
-  "provider",
-  "expires",
-  // `--timeout`: seconds to wait before giving up on anything that blocks. Every waiting
-  // path had a hardcoded ceiling (300s to create, 1800s to export) and no way to shorten
-  // it, which is fine for a person watching and useless inside a job with its own budget.
-  "timeout",
-  "out",
-  "team",
-  // `db push --dir`: which folder holds the migrations. A value rather than a positional
-  // so the command reads the same whether or not it is given.
-  "dir",
-  // `usage --days`: how much history to ask for.
-  "days"
-]);
-function parseArgs(argv) {
-  const command = [];
-  const flags = {};
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (!arg.startsWith("-")) {
-      command.push(arg);
-      continue;
-    }
-    if (arg === "--") {
-      command.push(...argv.slice(i + 1));
-      break;
-    }
-    const [name, inline] = splitFlag(arg);
-    if (VALUED.has(name)) {
-      const value = inline ?? argv[++i];
-      if (value === void 0) {
-        throw new UsageError(`--${name} needs a value`);
-      }
-      flags[name] = value;
-      continue;
-    }
-    if (inline !== void 0) {
-      throw new UsageError(`--${name} does not take a value`);
-    }
-    if (!KNOWN_BOOLEANS.has(name)) {
-      throw new UsageError(`unknown option --${name}`);
-    }
-    flags[name] = true;
-  }
-  return { command, flags, json: flags.json === true };
-}
-var KNOWN_BOOLEANS = /* @__PURE__ */ new Set([
-  "json",
-  "help",
-  "version",
-  "force",
-  // `--quiet`: drop the commentary, keep the answer and keep the errors. Wired 2026-09-06;
-  // it parsed and did nothing before.
-  "quiet",
-  // `--yes` is deliberately NOT here. Nothing in this CLI prompts, so there is nothing for
-  // it to answer, and accepting it would tell a script author it had confirmed something.
-  // The command that needs a confirmation says which flag it wants (`db restore --force`).
-  // `db export --status`: look at the last copy without asking for another one. The
-  // distinction is worth a flag rather than an inference, because the other branch runs a
-  // pg_dump against somebody's production database.
-  "status",
-  "no-wait",
-  // `login --no-browser`: print the URL and wait, rather than trying to spawn anything.
-  // The case the loopback flow could never serve on its own: SSH, a container, WSL.
-  "no-browser",
-  // `login --device`: a code typed into a browser on ANY machine, with no callback to
-  // this one at all. --no-browser still needs the loopback redirect to come back here;
-  // this does not, which is what makes it work over SSH and inside a container.
-  "device",
-  "env",
-  // `db push`: find out, and change nothing. Its own flag rather than the absence of a
-  // --yes, because the safe thing should be the easy thing to type.
-  "dry-run",
-  // `db push`: run a new migration that sorts BEFORE one already applied. Refused
-  // otherwise, because it gives this database a history no fresh one will have.
-  "out-of-order",
-  // `mcp`: let the agent's delete_project actually delete. Off by default, and the tool
-  // is listed either way so the agent can say what it wanted rather than invent.
-  "allow-delete",
-  // `usage`: print the day-by-day table under the headline, which most callers do not
-  // want and --json always carries anyway.
-  "history"
-]);
-function splitFlag(arg) {
-  const bare = arg.replace(/^--?/, "");
-  const equals = bare.indexOf("=");
-  if (equals === -1) {
-    return [bare, void 0];
-  }
-  return [bare.slice(0, equals), bare.slice(equals + 1)];
-}
-function flagString(args, name) {
-  const value = args.flags[name];
-  return typeof value === "string" ? value : void 0;
-}
-function flagBoolean(args, name) {
-  return args.flags[name] === true;
-}
-function flagNumber(args, name) {
-  const value = flagString(args, name);
-  if (value === void 0) {
-    return void 0;
-  }
-  const parsed = Number(value);
-  if (!Number.isInteger(parsed)) {
-    throw new UsageError(`--${name} must be a whole number, not "${value}"`);
-  }
-  return parsed;
-}
-
-// src/main.ts
-init_api();
-init_failure();
-init_interactive();
-init_config();
-init_device();
-init_desktop();
-init_output();
-init_login();
-
-// src/commands/projects.ts
-init_api();
-init_api();
-init_config();
-init_output();
-async function list() {
-  const { projects, allowance } = await listProjects();
-  emit({ projects, allowance }, () => {
-    if (projects.length === 0) {
-      say('No projects yet. `snoutdata projects create --name "my project"`.');
-      return;
-    }
-    process.stdout.write(
-      `${table([
-        ["REF", "NAME", "STATE", "REGION", "LAST CONNECTION"],
-        ...projects.map((p) => [
-          p.ref,
-          p.name,
-          // A project that is ready and refusing writes is NOT "ready" as far as
-          // somebody reading this is concerned: it is the state they need to know
-          // about, and showing `ready` beside a database that rejects every INSERT
-          // is the listing lying to them.
-          p.readOnly ? bold("read-only") : p.state === "ready" ? p.state : bold(p.state),
-          p.region,
-          relative(p.lastConnectionAt)
-        ])
-      ])}
-`
-    );
-  });
-}
-async function create(options) {
-  const created = await call("cloud-project-create", {
-    name: options.name,
-    region: options.region,
-    teamId: options.teamId
-  });
-  const ref = created.project.ref;
-  say(`Created ${ref}.`);
-  let project = created.project;
-  if (options.wait) {
-    say("Waiting for it to start\u2026");
-    project = await waitForReady(ref, {
-      timeoutMs: options.timeoutMs,
-      onTick: (state) => say(dim(`  ${state}`))
-    });
-  }
-  if (options.link) {
-    writeLink(options.link, { ref, name: project.name });
-  }
-  emit(
-    {
-      project,
-      // The one time a create's password is shown. `cloud-project-connection` gives
-      // it back to the owner any time, so this is convenience rather than a
-      // last chance — and saying so is better than implying otherwise.
-      password: created.password,
-      uri: `postgres://${project.user}:${encodeURIComponent(created.password)}@${project.host}:5432/${project.database}?sslmode=require`
-    },
-    () => {
-      process.stdout.write(
-        `postgres://${project.user}:${encodeURIComponent(created.password)}@${project.host}:5432/${project.database}?sslmode=require
-`
-      );
-      say("");
-      say(`Ready. ${bold(ref)} in ${project.region}.`);
-      say("The password is stored for you: `snoutdata db url` prints this again.");
-    }
-  );
-}
-async function action(verb, ref) {
-  const fn = `cloud-project-${verb}`;
-  const result = await call(fn, { ref });
-  emit(result, () => {
-    say(
-      result.changed ? `${ref}: ${verb}d.` : `${ref} was already ${verb === "delete" ? "deleted" : `${verb}d`}.`
-    );
-  });
-}
-async function resetPassword(ref) {
-  const result = await call(
-    "cloud-project-reset-password",
-    { ref }
-  );
-  emit(result, () => {
-    process.stdout.write(`${result.password}
-`);
-    say(`New password for ${result.user}. It applies ${result.appliesIn}.`);
-  });
-}
-async function listTeamsCommand() {
-  const { teams } = await listTeams();
-  emit({ teams }, () => {
-    if (teams.length === 0) {
-      say("You are not on any teams.");
-      return;
-    }
-    process.stdout.write(
-      `${table([
-        ["NAME", "ID", "SHARE"],
-        ...teams.map((team) => [
-          team.name,
-          team.id,
-          team.mayShare ? "yes" : team.why ?? "no"
-        ])
-      ])}
-`
-    );
-  });
-}
-async function resolveTeam(wanted) {
-  const { teams } = await listTeams();
-  const byId = teams.find((team2) => team2.id === wanted);
-  const matches = byId ? [byId] : teams.filter((team2) => team2.name.toLowerCase() === wanted.toLowerCase());
-  if (matches.length === 0) {
-    throw new Error(
-      teams.length === 0 ? `You are not on any teams, so there is no "${wanted}" to share with.` : `No team called "${wanted}". You are on: ${teams.map((t) => t.name).join(", ")}.`
-    );
-  }
-  if (matches.length > 1) {
-    throw new Error(
-      `More than one team is called "${wanted}". Use the id: ${matches.map((t) => t.id).join(", ")}.`
-    );
-  }
-  const team = matches[0];
-  if (!team.mayShare) {
-    throw new Error(`${team.name}: ${team.why ?? "you cannot share a project into this team"}.`);
-  }
-  return team.id;
-}
-
-// src/commands/tokens.ts
-init_api();
-init_output();
-async function create2(options) {
-  const created = await call("cloud-token-create", { name: options.name, expiresInDays: options.expiresInDays });
-  emit(created, () => {
-    process.stdout.write(`${created.token}
-`);
-    say("");
-    say(`${bold(created.name)} \u2014 ${created.expiresAt ? `expires ${created.expiresAt.slice(0, 10)}` : "does not expire"}.`);
-    say("This is the only time it is shown: only its hash is stored.");
-    say(dim("  export SNOUTDATA_ACCESS_TOKEN=<that token>"));
-  });
-}
-async function list2() {
-  const { tokens } = await call("cloud-token-list");
-  emit({ tokens }, () => {
-    if (tokens.length === 0) {
-      say("No access tokens. `snoutdata tokens create --name ci`.");
-      return;
-    }
-    process.stdout.write(
-      `${table([
-        ["PREFIX", "NAME", "STATE", "LAST USED", "EXPIRES"],
-        ...tokens.map((t) => [
-          t.current ? bold(t.prefix) : t.prefix,
-          t.name,
-          t.revokedAt ? "revoked" : t.live ? "live" : "expired",
-          relative(t.lastUsedAt),
-          t.expiresAt ? t.expiresAt.slice(0, 10) : "never"
-        ])
-      ])}
-`
-    );
-  });
-}
-async function revoke(wanted) {
-  const body = wanted.startsWith("sdt_") ? { prefix: wanted } : { id: wanted };
-  const result = await call("cloud-token-revoke", body);
-  emit(result, () => {
-    say(
-      result.changed ? `Revoked ${result.token.prefix} (${result.token.name}).` : `${result.token.prefix} was already revoked.`
-    );
-  });
-}
-
-// src/commands/db.ts
-import { spawn as spawn2 } from "node:child_process";
-import { appendFileSync, existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
-import { open as open2 } from "node:fs/promises";
-
-// src/restore.ts
-function dumpFormat(head) {
-  const ascii = (from, length) => String.fromCharCode(...Array.from(head.slice(from, from + length)));
-  if (ascii(0, 5) === "PGDMP") {
-    return "custom";
-  }
-  if (head.length >= 262 && ascii(257, 5) === "ustar") {
-    return "tar";
-  }
-  const printable = Array.from(head.slice(0, 256)).every(
-    (byte) => byte === 9 || byte === 10 || byte === 13 || byte >= 32 && byte < 127 || byte >= 128
-  );
-  return printable && head.length > 0 ? "plain" : "unknown";
-}
-function restoreVerdict(format, target, options = {}) {
-  if (target.readOnly) {
-    return {
-      ok: false,
-      code: "read-only",
-      reason: "this project is over its plan's storage limit, so it refuses writes. A restore would fail part way. Delete some rows or change plan first."
-    };
-  }
-  if (format === "unknown") {
-    return {
-      ok: false,
-      code: "unknown-format",
-      reason: "that file is not a pg_dump archive and does not look like SQL. `snoutdata db export` writes the custom format; psql reads plain .sql."
-    };
-  }
-  if (!options.force && target.existingTables > 0) {
-    return {
-      ok: false,
-      code: "not-empty",
-      reason: `this database already has ${target.existingTables} table${target.existingTables === 1 ? "" : "s"}. Restoring into it would leave some objects created and some not. Check --ref is the project you meant, or pass --force.`
-    };
-  }
-  return { ok: true, tool: format === "plain" ? "psql" : "pg_restore", format };
-}
-function classifyRestoreErrors(stderr) {
-  const lines = stderr.split("\n").filter((line) => /^pg_restore: error:/.test(line.trim()));
-  const fatal = lines.filter((line) => !/must be owner of extension/.test(line));
-  return { total: lines.length, harmless: lines.length - fatal.length, fatal };
-}
-
-// src/commands/db.ts
-init_api();
-init_failure();
-init_interactive();
-init_api();
-init_output();
-async function warnIfReadOnly(ref) {
-  try {
-    const { projects } = await listProjects();
-    const project = projects.find((candidate) => candidate.ref === ref);
-    if (project?.readOnly) {
-      warn(`${ref} is read-only: it is over the storage limit on your plan. Reading works; writing does not.`);
-    } else if (project?.readOnlyPending) {
-      warn(`${ref} is about to become read-only: it has grown past the storage limit on your plan.`);
-    }
-  } catch {
-  }
-}
-async function url(ref) {
-  await warnIfReadOnly(ref);
-  const details = await connection(ref);
-  emit(details, () => {
-    process.stdout.write(`${details.uri}
-`);
-  });
-}
-async function psql(ref, rest) {
-  if (rest.length === 0 && !canAsk()) {
-    const why = noHumanReason();
-    fail(
-      "usage",
-      `db psql with no statements opens an interactive session, and ${why ? explainNoHuman(why) : "there is nobody to use it"}. Pass statements after --, or use \`snoutdata db url\` and your own client.`
-    );
-  }
-  await warnIfReadOnly(ref);
-  const details = await connection(ref);
-  if (!details.wakesInstantly) {
-    say("This project is paused; the connection will wake it, which takes a few seconds.");
-  }
-  const child = spawn2(
-    "psql",
-    [
-      "--host",
-      details.host,
-      "--port",
-      String(details.port),
-      "--username",
-      details.user,
-      "--dbname",
-      details.database,
-      ...rest
-    ],
-    {
-      stdio: "inherit",
-      env: { ...process.env, PGPASSWORD: details.password, PGSSLMODE: "require" }
-    }
-  );
-  return new Promise((resolve3, reject) => {
-    child.on("error", (error) => {
-      if (error.code === "ENOENT") {
-        reject(new CliFailure("tool-missing", "psql is not installed. `snoutdata db url` prints a connection string for any client."));
-        return;
-      }
-      reject(new CliFailure("failed", String(error)));
-    });
-    child.on("close", (code) => resolve3(code ?? 0));
-  });
-}
-function writeEnv(directory, value, key = "DATABASE_URL") {
-  const path = join3(directory, ".env");
-  const line = `${key}=${value}`;
-  if (!existsSync3(path)) {
-    writeFileSync2(path, `${line}
-`);
-    return { path, replaced: false };
-  }
-  const existing = readFileSync3(path, "utf8");
-  const pattern = new RegExp(`^${key}=.*$`, "m");
-  if (pattern.test(existing)) {
-    writeFileSync2(path, existing.replace(pattern, line));
-    return { path, replaced: true };
-  }
-  appendFileSync(path, existing.endsWith("\n") ? `${line}
-` : `
-${line}
-`);
-  return { path, replaced: false };
-}
-async function exportDatabase(ref, options = {}) {
-  if (options.statusOnly) {
-    const { export: current } = await exportStatus(ref);
-    emit({ ref, export: current }, () => describeExport(current));
-    return 0;
-  }
-  const asked = await requestExport(ref);
-  if (!asked.export.pending && asked.export.url && !options.out) {
-    emit({ ref, export: asked.export }, () => describeExport(asked.export));
-    return 0;
-  }
-  say("Taking a copy of the database. This runs on the server and can take a few minutes.");
-  const finished = await waitForExport(ref, options.timeoutMs);
-  if (finished.error) {
-    fail("failed", `The export did not finish: ${finished.error}`, { ref });
-  }
-  if (!options.out) {
-    emit({ ref, export: finished }, () => describeExport(finished));
-    return 0;
-  }
-  if (!finished.url) {
-    fail("failed", "The copy was taken, but no download link could be signed. Run this again to get one.", { ref });
-  }
-  const written = await download(finished.url, options.out);
-  emit({ ref, path: options.out, bytes: written }, () => {
-    say(`Saved ${describeBytes(written)} to ${options.out}.`);
-    say(dim("Restore it with: pg_restore --dbname <your database> " + options.out));
-  });
-  return 0;
-}
-async function waitForExport(ref, timeoutMs = 30 * 6e4) {
-  const deadline = Date.now() + timeoutMs;
-  for (; ; ) {
-    const { export: current } = await exportStatus(ref);
-    if (!current.pending) {
-      return current;
-    }
-    if (Date.now() >= deadline) {
-      throw new Error(`the export of ${ref} was still running after waiting`);
-    }
-    await new Promise((resolve3) => setTimeout(resolve3, 3e3));
-  }
-}
-async function download(url2, path) {
-  const response = await fetch(url2);
-  if (!response.ok || !response.body) {
-    throw new Error(`the download failed: ${response.status} ${response.statusText}`);
-  }
-  const handle2 = await open2(path, "w");
-  let written = 0;
-  try {
-    for await (const chunk of response.body) {
-      await handle2.write(chunk);
-      written += chunk.byteLength;
-    }
-  } finally {
-    await handle2.close();
-  }
-  return written;
-}
-function describeExport(current) {
-  if (current.error) {
-    warn(`The last export did not finish: ${current.error}`);
-    return;
-  }
-  if (current.pending) {
-    say("An export is running. Ask again in a minute, or run `snoutdata db export`, which waits for it.");
-    return;
-  }
-  if (!current.completedAt) {
-    say("This project has never been exported.");
-    return;
-  }
-  say(`A copy taken ${relative(current.completedAt)}, ${describeBytes(current.bytes ?? 0)}.`);
-  if (current.url) {
-    process.stdout.write(`${current.url}
-`);
-    if (current.urlExpiresAt) {
-      say(dim(`That link stops working ${relative(current.urlExpiresAt)}.`));
-    }
-  } else {
-    say(dim("The link has expired. Run the export again to sign a new one; the copy is kept."));
-  }
-}
-function describeBytes(value) {
-  if (value < 1024) {
-    return `${value} B`;
-  }
-  const units = ["KB", "MB", "GB", "TB"];
-  let size = value / 1024;
-  let unit = 0;
-  while (size >= 1024 && unit < units.length - 1) {
-    size /= 1024;
-    unit += 1;
-  }
-  return `${size.toFixed(size >= 10 ? 0 : 1)} ${units[unit]}`;
-}
-async function restoreDatabase(ref, options) {
-  const path = options.file;
-  if (!path) {
-    fail("usage", "db restore needs --file, pointing at a dump. `snoutdata db export` writes one.");
-  }
-  if (!existsSync3(path)) {
-    fail("usage", `no file at ${path}`, { file: path });
-  }
-  const handle2 = await open2(path, "r");
-  const head = new Uint8Array(512);
-  const read = await handle2.read(head, 0, 512, 0);
-  await handle2.close();
-  const format = dumpFormat(head.slice(0, read.bytesRead));
-  const details = await connection(ref);
-  if (!details.wakesInstantly) {
-    say("This project is paused; the connection will wake it, which takes a few seconds.");
-  }
-  const { projects } = await listProjects();
-  const project = projects.find((candidate) => candidate.ref === ref);
-  const counted = await countTables(details);
-  if (counted === null) {
-    fail("tool-missing", "psql is not installed, so the tables in this project could not be counted. Install the Postgres client tools, or restore with your own client using `snoutdata db url`.");
-  }
-  const verdict = restoreVerdict(format, { existingTables: counted, readOnly: project?.readOnly === true }, { force: options.force });
-  if (!verdict.ok) {
-    fail("conflict", verdict.reason, { ref, file: path, refusal: verdict.code });
-  }
-  say(`Restoring ${path} into ${ref} with ${verdict.tool} (${verdict.format} format).`);
-  const run2 = await runRestore(details, verdict.tool, path);
-  const errors = classifyRestoreErrors(run2.stderr);
-  if (run2.code !== 0 && errors.fatal.length === 0 && errors.total > 0) {
-    emit({ ref, file: path, ok: true, tool: verdict.tool, format: verdict.format, ignoredErrors: errors.harmless }, () => {
-      say(`Restored into ${ref}.`);
-      say(
-        `${errors.harmless} error${errors.harmless === 1 ? "" : "s"} above ${errors.harmless === 1 ? "is" : "are"} expected and nothing is missing: a dump carries comments on the extensions this image installs, and your role does not own them.`
-      );
-    });
-    return 0;
-  }
-  if (run2.code !== 0) {
-    fail(
-      "failed",
-      `${verdict.tool} exited ${run2.code}. Nothing here retried it: a half-finished restore is undone by deleting the project and making another.`,
-      { ref, file: path, errors: errors.fatal }
-    );
-  }
-  emit({ ref, file: path, ok: true, tool: verdict.tool, format: verdict.format }, () => say(`Restored into ${ref}.`));
-  return 0;
-}
-async function countTables(details) {
-  return new Promise((resolve3) => {
-    const child = spawn2(
-      "psql",
-      [
-        "--host",
-        details.host,
-        "--port",
-        String(details.port),
-        "--username",
-        details.user,
-        "--dbname",
-        details.database,
-        "--no-psqlrc",
-        "-tAc",
-        // ORDINARY tables the USER made, and neither of those words is decoration.
-        // `information_schema.tables` was the first version of this and it counted
-        // VIEWS: a fresh hosted project carries pg_stat_statements, whose two views
-        // made every brand-new database look occupied, so the guard refused exactly
-        // the restore it exists to allow. Found by driving it, 2026-09-06.
-        //
-        // `deptype = 'e'` is the general form of the same fix: anything an extension
-        // created belongs to the extension and not to the user, so pgvector's tables
-        // do not count either.
-        "select count(*) from pg_class c join pg_namespace n on n.oid = c.relnamespace where c.relkind = 'r' and n.nspname not in ('pg_catalog', 'information_schema') and n.nspname not like 'pg\\_toast%' and not exists (select 1 from pg_depend d where d.objid = c.oid and d.deptype = 'e')"
-      ],
-      { stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, PGPASSWORD: details.password, PGSSLMODE: "require" } }
-    );
-    let out = "";
-    child.stdout.on("data", (chunk) => out += String(chunk));
-    child.on("error", (error) => {
-      warn(
-        error.code === "ENOENT" ? "psql is not installed, and db restore needs it (and pg_restore for an archive)." : String(error)
-      );
-      resolve3(null);
-    });
-    child.on("close", (code) => resolve3(code === 0 ? Number(out.trim()) || 0 : null));
-  });
-}
-function runRestore(details, tool, path) {
-  const shared = ["--host", details.host, "--port", String(details.port), "--username", details.user, "--dbname", details.database];
-  const args = tool === "psql" ? [...shared, "--no-psqlrc", "-v", "ON_ERROR_STOP=1", "-f", path] : [...shared, "--no-owner", "--no-privileges", path];
-  return new Promise((resolve3) => {
-    const child = spawn2(tool, args, {
-      stdio: ["ignore", "inherit", "pipe"],
-      env: { ...process.env, PGPASSWORD: details.password, PGSSLMODE: "require" }
-    });
-    let stderr = "";
-    child.stderr?.on("data", (chunk) => {
-      const text = String(chunk);
-      stderr += text;
-      process.stderr.write(text);
-    });
-    child.on("error", (error) => {
-      warn(
-        error.code === "ENOENT" ? `${tool} is not installed, and this dump needs it.` : String(error)
-      );
-      resolve3({ code: 127, stderr });
-    });
-    child.on("close", (code) => resolve3({ code: code ?? 0, stderr }));
-  });
-}
-
-// src/commands/push.ts
-init_api();
-init_output();
-init_failure();
-import { spawn as spawn3 } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
-import { isAbsolute, join as join4, relative as relativePath, resolve as resolve2 } from "node:path";
-
-// src/migrations.ts
-function migrationOrder(files) {
-  return [...files].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
-}
-function planMigrations(files, applied, options = {}) {
-  const ordered = migrationOrder(files);
-  const onDisk = new Map(ordered.map((file) => [file.name, file]));
-  const problems = [];
-  for (const done2 of applied) {
-    const file = onDisk.get(done2.name);
-    if (!file) {
-      problems.push({
-        code: "missing",
-        name: done2.name,
-        reason: `${done2.name} has already run against this database and is no longer in the folder. If it was renamed, the old name is still recorded and the new one looks new, so its statements would run a second time.`
-      });
-      continue;
-    }
-    if (file.checksum !== done2.checksum) {
-      problems.push({
-        code: "changed",
-        name: done2.name,
-        reason: `${done2.name} has changed since it ran. The database and this folder no longer agree about what happened to the schema, and running anything cannot fix that. Put the change in a new migration instead.`
-      });
-    }
-  }
-  const highWater = applied.map((one) => one.name).sort((a, b) => a < b ? -1 : a > b ? 1 : 0)[applied.length - 1];
-  const done = new Set(applied.map((one) => one.name));
-  const pending = [];
-  for (const file of ordered) {
-    if (done.has(file.name)) {
-      continue;
-    }
-    if (highWater !== void 0 && file.name < highWater && !options.outOfOrder) {
-      problems.push({
-        code: "out-of-order",
-        name: file.name,
-        reason: `${file.name} sorts before ${highWater}, which has already run. Applying it now gives this database a history no fresh database will have. Pass --out-of-order if that is what you mean.`
-      });
-      continue;
-    }
-    pending.push(file);
-  }
-  if (problems.length > 0) {
-    return { ok: false, problems };
-  }
-  return { ok: true, pending };
-}
-function wantsTransaction(sql) {
-  return !/^[\t ]*--[\t ]*snoutdata:no-transaction[\t ]*$/im.test(sql);
-}
-
-// src/commands/push.ts
-function shown(path) {
-  const near = relativePath(process.cwd(), path);
-  return near && !near.startsWith("..") ? near : path;
-}
-var LEDGER = "_snoutdata_migrations";
-var LEDGER_DDL = `create table if not exists ${LEDGER} (
+</body></html>`}function wt(){let e=xe(Re(32)),t=xe(gt("sha256").update(e).digest());return{verifier:e,challenge:t}}function Tn(e,t){return e==="darwin"?{command:"open",args:[t],verbatim:!1}:e==="win32"?{command:"cmd.exe",args:["/c","start",'""',`"${t}"`],verbatim:!0}:{command:"xdg-open",args:[t],verbatim:!1}}function yt(e){let{command:t,args:n,verbatim:r}=Tn(process.platform,e),o=vn(t,n,{stdio:"ignore",detached:!0,windowsVerbatimArguments:r});o.on("error",()=>{}),o.unref()}function En(e){let t=e??xe(Re(32));return{raw:t,hashed:gt("sha256").update(t).digest("hex")}}function On(e){return`${An}?${new URLSearchParams({client_id:kt,redirect_uri:e.redirectUri,response_type:"code",scope:"openid email profile",code_challenge:e.challenge,code_challenge_method:"S256",nonce:e.hashedNonce,state:e.state,prompt:"select_account"}).toString()}`}function _n(e,t){let n=new URL(e,"http://127.0.0.1");if(!n.searchParams.has("code")&&!n.searchParams.has("error"))return{kind:"ignore"};let r=n.searchParams.get("error_description")??n.searchParams.get("error");if(r)return{kind:"error",message:r};let o=n.searchParams.get("code");return o?n.searchParams.get("state")!==t?{kind:"error",message:"the browser came back with a state that did not match"}:{kind:"ok",code:o}:{kind:"error",message:"the browser came back without a code"}}async function jn(e,t,n){let r=await fetch($n,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({client_id:kt,client_secret:Pn,code:e,code_verifier:t,grant_type:"authorization_code",redirect_uri:n})}),o=await r.json().catch(()=>({}));if(!r.ok||!o.id_token)throw new Error(`Google would not exchange the code: ${o.error_description??o.error??`HTTP ${r.status}`}`);return o.id_token}async function Rn(e){let{verifier:t,challenge:n}=wt(),{raw:r,hashed:o}=En(),s=xe(Re(16)),{code:d,redirectUri:a}=await new Promise((w,m)=>{let k="",u=ht((O,K)=>{let P=_n(O.url??"/",s);if(P.kind==="ignore"){K.writeHead(404).end();return}K.writeHead(200,{"Content-Type":"text/html; charset=utf-8"}),K.end(P.kind==="ok"?Se("ok"):Se("failed",P.message)),u.close(),P.kind==="ok"?w({code:P.code,redirectUri:k}):m(new Error(P.message))});u.listen(0,"127.0.0.1",()=>{let O=u.address();k=`http://127.0.0.1:${typeof O=="object"&&O?O.port:0}`;let P=On({redirectUri:k,challenge:n,hashedNonce:o,state:s});process.stdout.write(`${P}
+`),e.noBrowser?i("Open that in a browser, on any machine, and sign in."):(i("Opening that in your browser. If nothing opens, paste it into one."),yt(P))}),u.on("error",m),setTimeout(()=>{u.close(),m(new Error("timed out waiting for the browser"))},e.timeoutMs??3e5).unref()}),c=await jn(d,t,a),l=await fetch(`${R}/auth/v1/token?grant_type=id_token`,{method:"POST",headers:{apikey:F,"Content-Type":"application/json"},body:JSON.stringify({provider:"google",id_token:c,nonce:r})});if(!l.ok)throw new Error(`could not turn the Google sign-in into a session: ${(await l.text()).slice(0,200)}`);return bt(await l.json())}function bt(e){let t=e,n={accessToken:t.access_token,refreshToken:t.refresh_token,expiresAt:t.expires_at,email:t.user?.email};return j(n),n}async function ve(e={}){let t=e.provider??"google";if(t==="google")return Rn(e);let{verifier:n,challenge:r}=wt(),o=await new Promise((d,a)=>{let c=ht((w,m)=>{let k=new URL(w.url??"/","http://127.0.0.1"),u=k.searchParams.get("code"),M=k.searchParams.get("error_description")??k.searchParams.get("error");m.writeHead(200,{"Content-Type":"text/html; charset=utf-8"}),m.end(u?Se("ok"):Se("failed",M??"No code came back.")),c.close(),u?d(u):a(new Error(M??"the browser came back without a code"))});c.listen(0,"127.0.0.1",()=>{let w=c.address(),k=`http://127.0.0.1:${typeof w=="object"&&w?w.port:0}/callback`,u=new URL(`${R}/auth/v1/authorize`);u.searchParams.set("provider",t),u.searchParams.set("redirect_to",k),u.searchParams.set("code_challenge",r),u.searchParams.set("code_challenge_method","s256"),u.searchParams.set("prompt","select_account"),process.stdout.write(`${u.toString()}
+`),e.noBrowser?i("Open that in a browser, on any machine, and sign in."):(i("Opening that in your browser. If nothing opens, paste it into one."),yt(u.toString()))}),setTimeout(()=>{c.close(),a(new Error("timed out waiting for the browser"))},e.timeoutMs??3e5).unref()}),s=await fetch(`${R}/auth/v1/token?grant_type=pkce`,{method:"POST",headers:{apikey:F,"Content-Type":"application/json"},body:JSON.stringify({auth_code:o,code_verifier:n})});if(!s.ok)throw new Error(`could not exchange the code: ${(await s.text()).slice(0,200)}`);return bt(await s.json())}function Nn(e){return e.replace(/[&<>"]/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"})[t])}var An,$n,kt,Pn,Ne=_(()=>{"use strict";T();z();E();An="https://accounts.google.com/o/oauth2/v2/auth",$n="https://oauth2.googleapis.com/token",kt="1064562458607-9fqmghjoqjr7d56b98agkvjt9vt26pdc.apps.googleusercontent.com",Pn="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"});import{createInterface as Dn}from"node:readline/promises";async function De(e){let t=Dn({input:process.stdin,output:process.stderr});try{let n=(await t.question(`${e} [Y/n] `)).trim().toLowerCase();return n===""||n==="y"||n==="yes"}finally{t.close()}}async function Cn(){let e=await ge();if(!e.available)return(e.skip==="handoff-disabled"||e.skip==="server-disabled")&&i(y("The SnoutData app is running but is not set to hand out sign-ins.")),null;let t=e.who.email??"the signed-in account";if(i(""),i(`The SnoutData app is open here, signed in as ${A(t)}.`),i(y("It can create an access token for this terminal. Your sign-in itself is not handed over,")),i(y("and you can revoke the token later with `snoutdata tokens revoke`.")),!await De("Use it?"))return null;i("Asking the app. Approve it there.");let n=await st(e.config,process.argv.slice(2).join(" ").slice(0,60)||"snoutdata");if("declined"in n)return i(`The app did not create a token: ${n.reason}`),null;let r={accessToken:n.token};return j(r),i(`Signed in with "${n.name}".`),r}async function In(){if(!await De("Sign in with a browser?"))return null;try{let e=await ve({});return i(`Signed in${e.email?` as ${e.email}`:""}.`),{accessToken:e.accessToken,refreshToken:e.refreshToken,expiresAt:e.expiresAt}}catch(e){return i(`That did not finish: ${e instanceof Error?e.message:String(e)}`),null}}async function Mn(){if(!await De("Sign in by typing a code into a browser on another machine?"))return null;let e=await ye({name:he(),platform:process.platform});i(""),i(`  Open   ${A(e.verifyUrl)}`),i(`  Type   ${A(e.code)}`),i(""),i(y("The code is typed rather than in the link on purpose: it is what proves the person")),i(y("at the browser is the person at this terminal. Waiting\u2026"));let t=await ke(e.secret,{intervalMs:Math.max(1,e.interval)*1e3,expiresAt:e.expiresAt}),n={accessToken:t.token};return j(n),i(`Signed in${t.name?` with "${t.name}"`:""}.`),n}async function xt(){if(!Y())return null;let e=await Cn();if(e)return e;let t=await In();return t||Mn()}var St=_(()=>{"use strict";z();we();je();ee();Ne();E()});var Q={};nn(Q,{ANON_KEY:()=>F,ApiError:()=>N,FUNCTIONS:()=>vt,NotSignedIn:()=>q,SUPABASE_URL:()=>R,call:()=>f,connection:()=>C,exportStatus:()=>Z,listProjects:()=>D,listTeams:()=>Te,requestExport:()=>re,waitForReady:()=>oe,whoami:()=>X});function Un(){let e=fe();return e?`not signed in, and ${me(e)}. Set SNOUTDATA_ACCESS_TOKEN to a token from \`snoutdata tokens create\`.`:"not signed in: run `snoutdata login`, or set SNOUTDATA_ACCESS_TOKEN"}async function Bn(){let e=Ze();if(e||(e=await xt()),!e)throw new q;if(!et(e)||!e.refreshToken)return e.accessToken;let t=await fetch(`${R}/auth/v1/token?grant_type=refresh_token`,{method:"POST",headers:{apikey:F,"Content-Type":"application/json"},body:JSON.stringify({refresh_token:e.refreshToken})});if(!t.ok)throw new q;let n=await t.json(),r={accessToken:n.access_token,refreshToken:n.refresh_token,expiresAt:n.expires_at,email:e.email};return j(r),r.accessToken}async function f(e,t={},n="POST"){let r=await Bn(),o=n==="GET"&&typeof t=="object"&&t?`?${new URLSearchParams(t).toString()}`:"",s=await fetch(`${vt}/${e}${o}`,{method:n,headers:{Authorization:`Bearer ${r}`,apikey:F,"Content-Type":"application/json"},body:n==="GET"?void 0:JSON.stringify(t)}),d=await s.text(),a;try{a=d?JSON.parse(d):{}}catch{throw new N(s.status,d.slice(0,300)||s.statusText)}if(!s.ok){let c=typeof a=="object"&&a&&"error"in a?String(a.error):`${s.status} ${s.statusText}`;throw s.status===401?new q(c):new N(s.status,c)}return a}async function X(){return f("cloud-whoami")}async function D(){return f("cloud-project-list")}async function C(e){return f("cloud-project-connection",{ref:e})}async function Te(){return f("cloud-team-list")}async function re(e){return f("cloud-project-export",{ref:e})}async function Z(e){return f("cloud-project-export",{ref:e},"GET")}async function oe(e,t={}){let n=Date.now()+(t.timeoutMs??3e5);for(;;){let{projects:r}=await D(),o=r.find(s=>s.ref===e);if(!o)throw new N(404,`no project ${e}`);if(t.onTick?.(o.state),o.state==="ready")return o;if(Date.now()>=n)throw new N(504,`${e} is still ${o.state} after waiting`);await new Promise(s=>setTimeout(s,2e3))}}var R,F,vt,N,q,T=_(()=>{"use strict";z();ee();St();R=process.env.SNOUTDATA_SUPABASE_URL??"https://krlhuuvhhgkwfsutvxtb.supabase.co",F=process.env.SNOUTDATA_ANON_KEY??"sb_publishable_B0gbZinAncINGbDGOcP9rg_odcbriG3",vt=`${R}/functions/v1`,N=class extends Error{status;constructor(t,n){super(n),this.status=t}},q=class extends Error{constructor(t){super(t??Un())}}});var b=class extends Error{},rn=new Set(["name","region","ref","file","provider","expires","timeout","out","team","dir","days"]);function He(e){let t=[],n={};for(let r=0;r<e.length;r++){let o=e[r];if(!o.startsWith("-")){t.push(o);continue}if(o==="--"){t.push(...e.slice(r+1));break}let[s,d]=sn(o);if(rn.has(s)){let a=d??e[++r];if(a===void 0)throw new b(`--${s} needs a value`);n[s]=a;continue}if(d!==void 0)throw new b(`--${s} does not take a value`);if(!on.has(s))throw new b(`unknown option --${s}`);n[s]=!0}return{command:t,flags:n,json:n.json===!0}}var on=new Set(["json","help","version","force","quiet","status","no-wait","no-browser","device","env","dry-run","out-of-order","allow-delete","history"]);function sn(e){let t=e.replace(/^--?/,""),n=t.indexOf("=");return n===-1?[t,void 0]:[t.slice(0,n),t.slice(n+1)]}function x(e,t){let n=e.flags[t];return typeof n=="string"?n:void 0}function U(e,t){return e.flags[t]===!0}function ce(e,t){let n=x(e,t);if(n===void 0)return;let r=Number(n);if(!Number.isInteger(r))throw new b(`--${t} must be a whole number, not "${n}"`);return r}T();te();ee();z();je();we();E();Ne();T();T();z();E();async function Tt(){let{projects:e,allowance:t}=await D();p({projects:e,allowance:t},()=>{if(e.length===0){i('No projects yet. `snoutdata projects create --name "my project"`.');return}process.stdout.write(`${W([["REF","NAME","STATE","REGION","LAST CONNECTION"],...e.map(n=>[n.ref,n.name,n.readOnly?A("read-only"):n.state==="ready"?n.state:A(n.state),n.region,H(n.lastConnectionAt)])])}
+`)})}async function Ce(e){let t=await f("cloud-project-create",{name:e.name,region:e.region,teamId:e.teamId}),n=t.project.ref;i(`Created ${n}.`);let r=t.project;e.wait&&(i("Waiting for it to start\u2026"),r=await oe(n,{timeoutMs:e.timeoutMs,onTick:o=>i(y(`  ${o}`))})),e.link&&de(e.link,{ref:n,name:r.name}),p({project:r,password:t.password,uri:`postgres://${r.user}:${encodeURIComponent(t.password)}@${r.host}:5432/${r.database}?sslmode=require`},()=>{process.stdout.write(`postgres://${r.user}:${encodeURIComponent(t.password)}@${r.host}:5432/${r.database}?sslmode=require
+`),i(""),i(`Ready. ${A(n)} in ${r.region}.`),i("The password is stored for you: `snoutdata db url` prints this again.")})}async function At(e,t){let n=`cloud-project-${e}`,r=await f(n,{ref:t});p(r,()=>{i(r.changed?`${t}: ${e}d.`:`${t} was already ${e==="delete"?"deleted":`${e}d`}.`)})}async function $t(e){let t=await f("cloud-project-reset-password",{ref:e});p(t,()=>{process.stdout.write(`${t.password}
+`),i(`New password for ${t.user}. It applies ${t.appliesIn}.`)})}async function Pt(){let{teams:e}=await Te();p({teams:e},()=>{if(e.length===0){i("You are not on any teams.");return}process.stdout.write(`${W([["NAME","ID","SHARE"],...e.map(t=>[t.name,t.id,t.mayShare?"yes":t.why??"no"])])}
+`)})}async function Et(e){let{teams:t}=await Te(),n=t.find(s=>s.id===e),r=n?[n]:t.filter(s=>s.name.toLowerCase()===e.toLowerCase());if(r.length===0)throw new Error(t.length===0?`You are not on any teams, so there is no "${e}" to share with.`:`No team called "${e}". You are on: ${t.map(s=>s.name).join(", ")}.`);if(r.length>1)throw new Error(`More than one team is called "${e}". Use the id: ${r.map(s=>s.id).join(", ")}.`);let o=r[0];if(!o.mayShare)throw new Error(`${o.name}: ${o.why??"you cannot share a project into this team"}.`);return o.id}T();E();async function Ot(e){let t=await f("cloud-token-create",{name:e.name,expiresInDays:e.expiresInDays});p(t,()=>{process.stdout.write(`${t.token}
+`),i(""),i(`${A(t.name)} \u2014 ${t.expiresAt?`expires ${t.expiresAt.slice(0,10)}`:"does not expire"}.`),i("This is the only time it is shown: only its hash is stored."),i(y("  export SNOUTDATA_ACCESS_TOKEN=<that token>"))})}async function _t(){let{tokens:e}=await f("cloud-token-list");p({tokens:e},()=>{if(e.length===0){i("No access tokens. `snoutdata tokens create --name ci`.");return}process.stdout.write(`${W([["PREFIX","NAME","STATE","LAST USED","EXPIRES"],...e.map(t=>[t.current?A(t.prefix):t.prefix,t.name,t.revokedAt?"revoked":t.live?"live":"expired",H(t.lastUsedAt),t.expiresAt?t.expiresAt.slice(0,10):"never"])])}
+`)})}async function jt(e){let t=e.startsWith("sdt_")?{prefix:e}:{id:e},n=await f("cloud-token-revoke",t);p(n,()=>{i(n.changed?`Revoked ${n.token.prefix} (${n.token.name}).`:`${n.token.prefix} was already revoked.`)})}import{spawn as Me}from"node:child_process";import{appendFileSync as qn,existsSync as It,readFileSync as Jn,writeFileSync as Ct}from"node:fs";import{join as Gn}from"node:path";import{open as Mt}from"node:fs/promises";function Rt(e){let t=(r,o)=>String.fromCharCode(...Array.from(e.slice(r,r+o)));return t(0,5)==="PGDMP"?"custom":e.length>=262&&t(257,5)==="ustar"?"tar":Array.from(e.slice(0,256)).every(r=>r===9||r===10||r===13||r>=32&&r<127||r>=128)&&e.length>0?"plain":"unknown"}function Nt(e,t,n={}){return t.readOnly?{ok:!1,code:"read-only",reason:"this project is over its plan's storage limit, so it refuses writes. A restore would fail part way. Delete some rows or change plan first."}:e==="unknown"?{ok:!1,code:"unknown-format",reason:"that file is not a pg_dump archive and does not look like SQL. `snoutdata db export` writes the custom format; psql reads plain .sql."}:!n.force&&t.existingTables>0?{ok:!1,code:"not-empty",reason:`this database already has ${t.existingTables} table${t.existingTables===1?"":"s"}. Restoring into it would leave some objects created and some not. Check --ref is the project you meant, or pass --force.`}:{ok:!0,tool:e==="plain"?"psql":"pg_restore",format:e}}function Dt(e){let t=e.split(`
+`).filter(r=>/^pg_restore: error:/.test(r.trim())),n=t.filter(r=>!/must be owner of extension/.test(r));return{total:t.length,harmless:t.length-n.length,fatal:n}}T();te();ee();T();E();async function Ut(e){try{let{projects:t}=await D(),n=t.find(r=>r.ref===e);n?.readOnly?$(`${e} is read-only: it is over the storage limit on your plan. Reading works; writing does not.`):n?.readOnlyPending&&$(`${e} is about to become read-only: it has grown past the storage limit on your plan.`)}catch{}}async function Ue(e){await Ut(e);let t=await C(e);p(t,()=>{process.stdout.write(`${t.uri}
+`)})}async function Bt(e,t){if(t.length===0&&!Y()){let o=fe();g("usage",`db psql with no statements opens an interactive session, and ${o?me(o):"there is nobody to use it"}. Pass statements after --, or use \`snoutdata db url\` and your own client.`)}await Ut(e);let n=await C(e);n.wakesInstantly||i("This project is paused; the connection will wake it, which takes a few seconds.");let r=Me("psql",["--host",n.host,"--port",String(n.port),"--username",n.user,"--dbname",n.database,...t],{stdio:"inherit",env:{...process.env,PGPASSWORD:n.password,PGSSLMODE:"require"}});return new Promise((o,s)=>{r.on("error",d=>{if(d.code==="ENOENT"){s(new B("tool-missing","psql is not installed. `snoutdata db url` prints a connection string for any client."));return}s(new B("failed",String(d)))}),r.on("close",d=>o(d??0))})}function Lt(e,t,n="DATABASE_URL"){let r=Gn(e,".env"),o=`${n}=${t}`;if(!It(r))return Ct(r,`${o}
+`),{path:r,replaced:!1};let s=Jn(r,"utf8"),d=new RegExp(`^${n}=.*$`,"m");return d.test(s)?(Ct(r,s.replace(d,o)),{path:r,replaced:!0}):(qn(r,s.endsWith(`
+`)?`${o}
+`:`
+${o}
+`),{path:r,replaced:!1})}async function Ft(e,t={}){if(t.statusOnly){let{export:s}=await Z(e);return p({ref:e,export:s},()=>Ie(s)),0}let n=await re(e);if(!n.export.pending&&n.export.url&&!t.out)return p({ref:e,export:n.export},()=>Ie(n.export)),0;i("Taking a copy of the database. This runs on the server and can take a few minutes.");let r=await Wn(e,t.timeoutMs);if(r.error&&g("failed",`The export did not finish: ${r.error}`,{ref:e}),!t.out)return p({ref:e,export:r},()=>Ie(r)),0;r.url||g("failed","The copy was taken, but no download link could be signed. Run this again to get one.",{ref:e});let o=await Hn(r.url,t.out);return p({ref:e,path:t.out,bytes:o},()=>{i(`Saved ${I(o)} to ${t.out}.`),i(y("Restore it with: pg_restore --dbname <your database> "+t.out))}),0}async function Wn(e,t=30*6e4){let n=Date.now()+t;for(;;){let{export:r}=await Z(e);if(!r.pending)return r;if(Date.now()>=n)throw new Error(`the export of ${e} was still running after waiting`);await new Promise(o=>setTimeout(o,3e3))}}async function Hn(e,t){let n=await fetch(e);if(!n.ok||!n.body)throw new Error(`the download failed: ${n.status} ${n.statusText}`);let r=await Mt(t,"w"),o=0;try{for await(let s of n.body)await r.write(s),o+=s.byteLength}finally{await r.close()}return o}function Ie(e){if(e.error){$(`The last export did not finish: ${e.error}`);return}if(e.pending){i("An export is running. Ask again in a minute, or run `snoutdata db export`, which waits for it.");return}if(!e.completedAt){i("This project has never been exported.");return}i(`A copy taken ${H(e.completedAt)}, ${I(e.bytes??0)}.`),e.url?(process.stdout.write(`${e.url}
+`),e.urlExpiresAt&&i(y(`That link stops working ${H(e.urlExpiresAt)}.`))):i(y("The link has expired. Run the export again to sign a new one; the copy is kept."))}function I(e){if(e<1024)return`${e} B`;let t=["KB","MB","GB","TB"],n=e/1024,r=0;for(;n>=1024&&r<t.length-1;)n/=1024,r+=1;return`${n.toFixed(n>=10?0:1)} ${t[r]}`}async function qt(e,t){let n=t.file;n||g("usage","db restore needs --file, pointing at a dump. `snoutdata db export` writes one."),It(n)||g("usage",`no file at ${n}`,{file:n});let r=await Mt(n,"r"),o=new Uint8Array(512),s=await r.read(o,0,512,0);await r.close();let d=Rt(o.slice(0,s.bytesRead)),a=await C(e);a.wakesInstantly||i("This project is paused; the connection will wake it, which takes a few seconds.");let{projects:c}=await D(),l=c.find(M=>M.ref===e),w=await Kn(a);w===null&&g("tool-missing","psql is not installed, so the tables in this project could not be counted. Install the Postgres client tools, or restore with your own client using `snoutdata db url`.");let m=Nt(d,{existingTables:w,readOnly:l?.readOnly===!0},{force:t.force});m.ok||g("conflict",m.reason,{ref:e,file:n,refusal:m.code}),i(`Restoring ${n} into ${e} with ${m.tool} (${m.format} format).`);let k=await zn(a,m.tool,n),u=Dt(k.stderr);return k.code!==0&&u.fatal.length===0&&u.total>0?(p({ref:e,file:n,ok:!0,tool:m.tool,format:m.format,ignoredErrors:u.harmless},()=>{i(`Restored into ${e}.`),i(`${u.harmless} error${u.harmless===1?"":"s"} above ${u.harmless===1?"is":"are"} expected and nothing is missing: a dump carries comments on the extensions this image installs, and your role does not own them.`)}),0):(k.code!==0&&g("failed",`${m.tool} exited ${k.code}. Nothing here retried it: a half-finished restore is undone by deleting the project and making another.`,{ref:e,file:n,errors:u.fatal}),p({ref:e,file:n,ok:!0,tool:m.tool,format:m.format},()=>i(`Restored into ${e}.`)),0)}async function Kn(e){return new Promise(t=>{let n=Me("psql",["--host",e.host,"--port",String(e.port),"--username",e.user,"--dbname",e.database,"--no-psqlrc","-tAc","select count(*) from pg_class c join pg_namespace n on n.oid = c.relnamespace where c.relkind = 'r' and n.nspname not in ('pg_catalog', 'information_schema') and n.nspname not like 'pg\\_toast%' and not exists (select 1 from pg_depend d where d.objid = c.oid and d.deptype = 'e')"],{stdio:["ignore","pipe","pipe"],env:{...process.env,PGPASSWORD:e.password,PGSSLMODE:"require"}}),r="";n.stdout.on("data",o=>r+=String(o)),n.on("error",o=>{$(o.code==="ENOENT"?"psql is not installed, and db restore needs it (and pg_restore for an archive).":String(o)),t(null)}),n.on("close",o=>t(o===0?Number(r.trim())||0:null))})}function zn(e,t,n){let r=["--host",e.host,"--port",String(e.port),"--username",e.user,"--dbname",e.database],o=t==="psql"?[...r,"--no-psqlrc","-v","ON_ERROR_STOP=1","-f",n]:[...r,"--no-owner","--no-privileges",n];return new Promise(s=>{let d=Me(t,o,{stdio:["ignore","inherit","pipe"],env:{...process.env,PGPASSWORD:e.password,PGSSLMODE:"require"}}),a="";d.stderr?.on("data",c=>{let l=String(c);a+=l,process.stderr.write(l)}),d.on("error",c=>{$(c.code==="ENOENT"?`${t} is not installed, and this dump needs it.`:String(c)),s({code:127,stderr:a})}),d.on("close",c=>s({code:c??0,stderr:a}))})}T();E();te();import{spawn as Xn}from"node:child_process";import{createHash as Zn}from"node:crypto";import{existsSync as Qn,readdirSync as er,readFileSync as tr,statSync as nr}from"node:fs";import{isAbsolute as rr,join as Le,relative as or,resolve as sr}from"node:path";function Vn(e){return[...e].sort((t,n)=>t.name<n.name?-1:t.name>n.name?1:0)}function Jt(e,t,n={}){let r=Vn(e),o=new Map(r.map(l=>[l.name,l])),s=[];for(let l of t){let w=o.get(l.name);if(!w){s.push({code:"missing",name:l.name,reason:`${l.name} has already run against this database and is no longer in the folder. If it was renamed, the old name is still recorded and the new one looks new, so its statements would run a second time.`});continue}w.checksum!==l.checksum&&s.push({code:"changed",name:l.name,reason:`${l.name} has changed since it ran. The database and this folder no longer agree about what happened to the schema, and running anything cannot fix that. Put the change in a new migration instead.`})}let d=t.map(l=>l.name).sort((l,w)=>l<w?-1:l>w?1:0)[t.length-1],a=new Set(t.map(l=>l.name)),c=[];for(let l of r)if(!a.has(l.name)){if(d!==void 0&&l.name<d&&!n.outOfOrder){s.push({code:"out-of-order",name:l.name,reason:`${l.name} sorts before ${d}, which has already run. Applying it now gives this database a history no fresh database will have. Pass --out-of-order if that is what you mean.`});continue}c.push(l)}return s.length>0?{ok:!1,problems:s}:{ok:!0,pending:c}}function Be(e){return!/^[\t ]*--[\t ]*snoutdata:no-transaction[\t ]*$/im.test(e)}function Wt(e){let t=or(process.cwd(),e);return t&&!t.startsWith("..")?t:e}var se="_snoutdata_migrations",ar=`create table if not exists ${se} (
 	name text primary key,
 	checksum text not null,
 	applied_at timestamptz not null default now()
-);`;
-function readFolder(directory) {
-  if (!existsSync4(directory) || !statSync(directory).isDirectory()) {
-    throw new Error(
-      `no migrations folder at ${shown(directory)}. Put your .sql files there, or pass --dir.`
-    );
-  }
-  return readdirSync(directory).filter((name) => name.endsWith(".sql")).map((name) => {
-    const path = join4(directory, name);
-    const sql = readFileSync4(path, "utf8");
-    return {
-      name,
-      path,
-      sql,
-      checksum: createHash2("sha256").update(sql, "utf8").digest("hex")
-    };
-  });
-}
-function runSql(details, sql, extra = []) {
-  return new Promise((done) => {
-    const child = spawn3(
-      "psql",
-      [
-        "--host",
-        details.host,
-        "--port",
-        String(details.port),
-        "--username",
-        details.user,
-        "--dbname",
-        details.database,
-        "--no-psqlrc",
-        "-v",
-        "ON_ERROR_STOP=1",
-        ...extra
-      ],
-      { stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, PGPASSWORD: details.password, PGSSLMODE: "require" } }
-    );
-    let out = "";
-    let err = "";
-    child.stdout.on("data", (chunk) => out += String(chunk));
-    child.stderr.on("data", (chunk) => err += String(chunk));
-    child.on("error", (error) => {
-      done({
-        code: 127,
-        out: "",
-        err: error.code === "ENOENT" ? "psql is not installed, and db push needs it to run your migrations. `snoutdata db url` prints a connection string for any client." : String(error)
-      });
-    });
-    child.on("close", (code) => done({ code: code ?? 0, out, err }));
-    child.stdin.end(sql);
-  });
-}
-async function readLedger(details) {
-  const created = await runSql(details, LEDGER_DDL);
-  if (created.code !== 0) {
-    throw new Error(created.err.trim() || `could not create ${LEDGER}`);
-  }
-  const rows = await runSql(details, `select name || E'\\t' || checksum from ${LEDGER};`, ["-tA"]);
-  if (rows.code !== 0) {
-    throw new Error(rows.err.trim() || `could not read ${LEDGER}`);
-  }
-  return rows.out.split("\n").map((line) => line.trim()).filter((line) => line.length > 0).map((line) => {
-    const tab = line.indexOf("	");
-    return { name: line.slice(0, tab), checksum: line.slice(tab + 1) };
-  });
-}
-function literal(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
-async function push(ref, options = {}) {
-  const result = await runPush(ref, options, (message) => say(message));
-  if (!result.ok) {
-    if (result.problems) {
-      const lines = result.problems.map((problem) => `  ${problem.reason}`).join("\n");
-      fail("conflict", `Refused. This folder and ${ref} do not agree:
-${lines}`, {
-        ref,
-        problems: result.problems
-      });
-    }
-    fail("failed", `${result.failed} failed, and nothing after it was tried.
-${result.error ?? ""}`.trimEnd(), {
-      ref,
-      failed: result.failed
-    });
-  }
-  emit(result, () => {
-    if (result.wouldApply) {
-      say(`Would apply ${result.wouldApply.length} migration${result.wouldApply.length === 1 ? "" : "s"} to ${ref}:`);
-      for (const name of result.wouldApply) {
-        say(`  ${name}`);
-      }
-      return;
-    }
-    if (result.upToDate) {
-      say(`${ref} is up to date.`);
-      return;
-    }
-    say(`Applied ${result.applied.length} migration${result.applied.length === 1 ? "" : "s"} to ${ref}.`);
-  });
-  return 0;
-}
-async function runPush(ref, options = {}, note = () => {
-}) {
-  const directory = resolve2(
-    options.dir === void 0 ? join4(process.cwd(), "migrations") : isAbsolute(options.dir) ? options.dir : join4(process.cwd(), options.dir)
-  );
-  const notes = [];
-  function record(message) {
-    notes.push(message);
-    note(message);
-  }
-  const files = readFolder(directory);
-  if (files.length === 0) {
-    record(`No .sql files in ${shown(directory)}.`);
-    return { ref, directory, ok: true, applied: [], upToDate: true, notes };
-  }
-  const details = await connection(ref);
-  if (!details.wakesInstantly) {
-    record("This project is paused; the connection will wake it, which takes a few seconds.");
-  }
-  const already = await readLedger(details);
-  const plan = planMigrations(files, already, { outOfOrder: options.outOfOrder });
-  if (!plan.ok) {
-    return { ref, directory, ok: false, applied: [], problems: [...plan.problems], notes };
-  }
-  const byName = new Map(files.map((file) => [file.name, file]));
-  const pending = plan.pending.map((one) => byName.get(one.name));
-  if (pending.length === 0) {
-    record(`${ref} is up to date: ${already.length} migration${already.length === 1 ? "" : "s"} already applied.`);
-    return { ref, directory, ok: true, applied: [], upToDate: true, notes };
-  }
-  if (options.dryRun) {
-    for (const one of pending) {
-      if (!wantsTransaction(one.sql)) {
-        record(`${one.name} would run outside a transaction.`);
-      }
-    }
-    return { ref, directory, ok: true, applied: [], wouldApply: pending.map((one) => one.name), notes };
-  }
-  const done = [];
-  for (const migration of pending) {
-    const ledgerRow = `insert into ${LEDGER} (name, checksum) values (${literal(migration.name)}, ${literal(migration.checksum)});`;
-    const wrapped = wantsTransaction(migration.sql);
-    if (!wrapped) {
-      record(`${migration.name} runs outside a transaction, so an interruption can leave it half applied.`);
-    }
-    const sql = wrapped ? `begin;
-${migration.sql}
-${ledgerRow}
+);`;function ir(e){if(!Qn(e)||!nr(e).isDirectory())throw new Error(`no migrations folder at ${Wt(e)}. Put your .sql files there, or pass --dir.`);return er(e).filter(t=>t.endsWith(".sql")).map(t=>{let n=Le(e,t),r=tr(n,"utf8");return{name:t,path:n,sql:r,checksum:Zn("sha256").update(r,"utf8").digest("hex")}})}function Fe(e,t,n=[]){return new Promise(r=>{let o=Xn("psql",["--host",e.host,"--port",String(e.port),"--username",e.user,"--dbname",e.database,"--no-psqlrc","-v","ON_ERROR_STOP=1",...n],{stdio:["pipe","pipe","pipe"],env:{...process.env,PGPASSWORD:e.password,PGSSLMODE:"require"}}),s="",d="";o.stdout.on("data",a=>s+=String(a)),o.stderr.on("data",a=>d+=String(a)),o.on("error",a=>{r({code:127,out:"",err:a.code==="ENOENT"?"psql is not installed, and db push needs it to run your migrations. `snoutdata db url` prints a connection string for any client.":String(a)})}),o.on("close",a=>r({code:a??0,out:s,err:d})),o.stdin.end(t)})}async function cr(e){let t=await Fe(e,ar);if(t.code!==0)throw new Error(t.err.trim()||`could not create ${se}`);let n=await Fe(e,`select name || E'\\t' || checksum from ${se};`,["-tA"]);if(n.code!==0)throw new Error(n.err.trim()||`could not read ${se}`);return n.out.split(`
+`).map(r=>r.trim()).filter(r=>r.length>0).map(r=>{let o=r.indexOf("	");return{name:r.slice(0,o),checksum:r.slice(o+1)}})}function Gt(e){return`'${e.replace(/'/g,"''")}'`}async function Ht(e,t={}){let n=await qe(e,t,r=>i(r));if(!n.ok){if(n.problems){let r=n.problems.map(o=>`  ${o.reason}`).join(`
+`);g("conflict",`Refused. This folder and ${e} do not agree:
+${r}`,{ref:e,problems:n.problems})}g("failed",`${n.failed} failed, and nothing after it was tried.
+${n.error??""}`.trimEnd(),{ref:e,failed:n.failed})}return p(n,()=>{if(n.wouldApply){i(`Would apply ${n.wouldApply.length} migration${n.wouldApply.length===1?"":"s"} to ${e}:`);for(let r of n.wouldApply)i(`  ${r}`);return}if(n.upToDate){i(`${e} is up to date.`);return}i(`Applied ${n.applied.length} migration${n.applied.length===1?"":"s"} to ${e}.`)}),0}async function qe(e,t={},n=()=>{}){let r=sr(t.dir===void 0?Le(process.cwd(),"migrations"):rr(t.dir)?t.dir:Le(process.cwd(),t.dir)),o=[];function s(u){o.push(u),n(u)}let d=ir(r);if(d.length===0)return s(`No .sql files in ${Wt(r)}.`),{ref:e,directory:r,ok:!0,applied:[],upToDate:!0,notes:o};let a=await C(e);a.wakesInstantly||s("This project is paused; the connection will wake it, which takes a few seconds.");let c=await cr(a),l=Jt(d,c,{outOfOrder:t.outOfOrder});if(!l.ok)return{ref:e,directory:r,ok:!1,applied:[],problems:[...l.problems],notes:o};let w=new Map(d.map(u=>[u.name,u])),m=l.pending.map(u=>w.get(u.name));if(m.length===0)return s(`${e} is up to date: ${c.length} migration${c.length===1?"":"s"} already applied.`),{ref:e,directory:r,ok:!0,applied:[],upToDate:!0,notes:o};if(t.dryRun){for(let u of m)Be(u.sql)||s(`${u.name} would run outside a transaction.`);return{ref:e,directory:r,ok:!0,applied:[],wouldApply:m.map(u=>u.name),notes:o}}let k=[];for(let u of m){let M=`insert into ${se} (name, checksum) values (${Gt(u.name)}, ${Gt(u.checksum)});`,O=Be(u.sql);O||s(`${u.name} runs outside a transaction, so an interruption can leave it half applied.`);let K=O?`begin;
+${u.sql}
+${M}
 commit;
-` : `${migration.sql}
-${ledgerRow}
-`;
-    const result = await runSql(details, sql);
-    if (result.code !== 0) {
-      if (wrapped) {
-        record("It ran inside a transaction, so nothing from it is in the database.");
-      }
-      return {
-        ref,
-        directory,
-        ok: false,
-        applied: done,
-        failed: migration.name,
-        error: result.err.trim(),
-        notes
-      };
-    }
-    done.push(migration.name);
-    record(`  applied ${migration.name}`);
-  }
-  return { ref, directory, ok: true, applied: done, notes };
-}
-
-// src/commands/mcp.ts
-init_api();
-init_output();
-
-// src/mcp.ts
-var PROTOCOL_VERSION = "2024-11-05";
-function object(properties, required = []) {
-  return { type: "object", properties, additionalProperties: false, ...required.length ? { required } : {} };
-}
-var STRING = { type: "string" };
-var TOOLS = [
-  {
-    name: "whoami",
-    description: "Who this CLI is signed in as, and how (a session or a long-lived access token). Use it to check a credential before doing anything else.",
-    inputSchema: object({})
-  },
-  {
-    name: "list_projects",
-    description: "Every hosted Postgres database on this account, with its ref, name, region, state (ready, paused, error), size, and whether it is read-only because it is over its plan's storage limit.",
-    inputSchema: object({})
-  },
-  {
-    name: "create_project",
-    description: "Make a new hosted Postgres database and wait for it to be ready. Costs a project against the plan allowance; a free plan includes two. Returns its ref, which every other tool takes.",
-    inputSchema: object({ name: STRING, region: STRING, teamId: STRING }, ["name"])
-  },
-  {
-    name: "get_connection_url",
-    description: "The postgres:// URL for a project, ready to put in DATABASE_URL. IT CONTAINS A LIVE PASSWORD, so treat it as a credential and do not print it into a log or a file that is committed. Connecting to a paused project wakes it, which takes a few seconds.",
-    inputSchema: object({ ref: STRING }, ["ref"])
-  },
-  {
-    name: "pause_project",
-    description: "Stop a project. Its data is kept and the next connection wakes it. A production project refuses this.",
-    inputSchema: object({ ref: STRING }, ["ref"])
-  },
-  {
-    name: "resume_project",
-    description: "Start a paused project without waiting for a connection to wake it.",
-    inputSchema: object({ ref: STRING }, ["ref"])
-  },
-  {
-    name: "push_migrations",
-    description: "Run the .sql files in a folder against a project, in name order, once each, recording what ran in a _snoutdata_migrations table. Refuses a file that changed after it ran, a file that has gone, and a new file that sorts before one already applied. Use dryRun first to see what would happen. Needs psql on this machine.",
-    inputSchema: object({ ref: STRING, dir: STRING, dryRun: { type: "boolean" } }, ["ref"])
-  },
-  {
-    name: "usage",
-    description: "How much storage and compute a project has used against the limit on this plan, and whether it is near it. READ THIS BEFORE a migration or a bulk insert: a project over its storage limit is made read-only, and `list_projects` will say readOnly afterwards without ever saying how much headroom was left. Takes an optional number of days of history (default 30, maximum 365).",
-    inputSchema: object({ ref: STRING, days: { type: "number" } }, ["ref"])
-  },
-  {
-    name: "export_status",
-    description: "Whether a copy of this database is being taken, when the last one finished, and a download link if there is a live one. Costs nothing and starts nothing.",
-    inputSchema: object({ ref: STRING }, ["ref"])
-  },
-  {
-    name: "start_export",
-    description: "Take a copy of the whole database. Runs a pg_dump on the server and can take minutes, so this STARTS it and returns; poll export_status for the link. Worth doing before a migration you are unsure of. It does not block the database.",
-    inputSchema: object({ ref: STRING }, ["ref"])
-  },
-  {
-    name: "reset_password",
-    description: "Rotate the project's database password. THE OLD ONE STOPS WORKING IMMEDIATELY, including any DATABASE_URL already written into a file or a running process. Returns the new connection URL. Use it when a credential has leaked, not routinely.",
-    inputSchema: object({ ref: STRING }, ["ref"])
-  },
-  {
-    name: "list_teams",
-    description: "Teams this account belongs to, with the id create_project takes as teamId. Without this there is no way to discover that id.",
-    inputSchema: object({})
-  },
-  {
-    name: "list_tokens",
-    description: "The long-lived sdt_ access tokens on this account: id, name, prefix, when each was made and last used. Never the token itself, which is shown once when it is made.",
-    inputSchema: object({})
-  },
-  {
-    name: "create_token",
-    description: "Mint a long-lived sdt_ access token, for a CI job or another machine. RETURNS THE TOKEN ONCE AND NEVER AGAIN. It is as capable as this account, so hand it over deliberately. Optionally expires, as an ISO date.",
-    inputSchema: object({ name: STRING, expires: STRING }, ["name"])
-  },
-  {
-    name: "revoke_token",
-    description: "Revoke an access token by its id. Anything using it stops working at once. Safe to do to a token you think has leaked.",
-    inputSchema: object({ id: STRING }, ["id"])
-  },
-  {
-    name: "delete_project",
-    description: "Delete a project. THIS DESTROYS A DATABASE. Off unless the person who started this server passed --allow-delete, in which case it still only marks the project deleted and its data is erasable for a grace period.",
-    inputSchema: object({ ref: STRING }, ["ref"])
-  }
-];
-function uniqueByName(tools) {
-  const seen = /* @__PURE__ */ new Set();
-  return tools.filter((tool) => !seen.has(tool.name) && seen.add(tool.name));
-}
-function ok(id, result) {
-  return { jsonrpc: "2.0", id, result };
-}
-function fail2(id, code, message) {
-  return { jsonrpc: "2.0", id, error: { code, message } };
-}
-function said(id, value, isError = false) {
-  const text = typeof value === "string" ? value : JSON.stringify(value, null, 2);
-  return ok(id, { content: [{ type: "text", text }], ...isError ? { isError: true } : {} });
-}
-function stringArg(params, name) {
-  const value = params[name];
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
-}
-async function handle(request, operations2, options) {
-  const id = request.id ?? null;
-  const method = request.method ?? "";
-  const params = request.params ?? {};
-  if (request.id === void 0 || request.id === null) {
-    return null;
-  }
-  switch (method) {
-    case "initialize":
-      return ok(id, {
-        protocolVersion: PROTOCOL_VERSION,
-        capabilities: { tools: { listChanged: false } },
-        serverInfo: { name: "snoutdata", version: options.version }
-      });
-    case "ping":
-      return ok(id, {});
-    case "tools/list":
-      return ok(id, { tools: uniqueByName([...TOOLS, ...options.borrowed ?? []]) });
-    case "tools/call":
-      return callTool(id, params, operations2, options);
-    default:
-      return fail2(id, -32601, `unknown method: ${method}`);
-  }
-}
-async function callTool(id, params, operations2, options) {
-  const name = typeof params.name === "string" ? params.name : "";
-  const args = params.arguments ?? {};
-  const known = TOOLS.some((tool) => tool.name === name) || (options.borrowed?.some((tool) => tool.name === name) ?? false);
-  if (!known) {
-    return fail2(id, -32602, `unknown tool: ${name}`);
-  }
-  const needsRef = [
-    "get_connection_url",
-    "pause_project",
-    "resume_project",
-    "delete_project",
-    "push_migrations",
-    "usage",
-    "export_status",
-    "start_export",
-    "reset_password"
-  ];
-  const ref = stringArg(args, "ref");
-  if (needsRef.includes(name) && !ref) {
-    return said(id, `${name} needs a project ref. Call list_projects to see them.`, true);
-  }
-  try {
-    switch (name) {
-      case "whoami":
-        return said(id, await operations2.whoami());
-      case "list_projects":
-        return said(id, await operations2.listProjects());
-      case "create_project": {
-        const projectName = stringArg(args, "name");
-        if (!projectName) {
-          return said(id, "create_project needs a name.", true);
-        }
-        return said(
-          id,
-          await operations2.createProject({
-            name: projectName,
-            region: stringArg(args, "region") ?? void 0,
-            teamId: stringArg(args, "teamId") ?? void 0
-          })
-        );
-      }
-      case "get_connection_url": {
-        const details = await operations2.connection(ref);
-        return said(id, {
-          url: details.uri,
-          state: details.state,
-          wakesInstantly: details.wakesInstantly,
-          warning: "This URL contains a live database password. Put it in an environment variable, not in a file that is committed."
-        });
-      }
-      case "pause_project":
-        return said(id, await operations2.setProjectState("pause", ref));
-      case "resume_project":
-        return said(id, await operations2.setProjectState("resume", ref));
-      case "usage": {
-        const days = typeof args.days === "number" ? args.days : void 0;
-        return said(id, await operations2.usage(ref, days));
-      }
-      case "export_status":
-        return said(id, await operations2.exportStatus(ref));
-      case "start_export":
-        return said(id, await operations2.requestExport(ref));
-      case "reset_password":
-        return said(id, await operations2.resetPassword(ref));
-      case "list_teams":
-        return said(id, await operations2.listTeams());
-      case "list_tokens":
-        return said(id, await operations2.listTokens());
-      case "create_token": {
-        const tokenName = stringArg(args, "name");
-        if (!tokenName) {
-          return said(id, "create_token needs a name, so somebody can tell later what it was for.", true);
-        }
-        return said(id, await operations2.createToken(tokenName, stringArg(args, "expires") ?? void 0));
-      }
-      case "revoke_token": {
-        const tokenId = stringArg(args, "id");
-        if (!tokenId) {
-          return said(id, "revoke_token needs the id of a token. list_tokens has them.", true);
-        }
-        return said(id, await operations2.revokeToken(tokenId));
-      }
-      case "push_migrations":
-        return said(
-          id,
-          await operations2.pushMigrations(ref, {
-            dir: stringArg(args, "dir") ?? void 0,
-            dryRun: args.dryRun === true
-          })
-        );
-      case "delete_project": {
-        if (!options.allowDelete) {
-          return said(
-            id,
-            "delete_project is off. The person running this server started it without --allow-delete, so deleting a database is theirs to do. Tell them that is what you wanted.",
-            true
-          );
-        }
-        return said(id, await operations2.setProjectState("delete", ref));
-      }
-      default: {
-        if (options.borrowed?.some((tool) => tool.name === name)) {
-          if (!operations2.callBorrowed) {
-            return said(id, `${name} needs the SnoutData app, which is no longer answering.`, true);
-          }
-          return ok(id, await operations2.callBorrowed(name, args));
-        }
-        return fail2(id, -32602, `unknown tool: ${name}`);
-      }
-    }
-  } catch (error) {
-    return said(id, error instanceof Error ? error.message : String(error), true);
-  }
-}
-function takeMessages(buffer) {
-  const parts = buffer.split("\n");
-  const rest = parts.pop() ?? "";
-  return { messages: parts.map((line) => line.trim()).filter((line) => line.length > 0), rest };
-}
-
-// src/commands/mcp.ts
-init_desktop();
-function operations() {
-  return {
-    whoami: () => whoami(),
-    listProjects: () => listProjects(),
-    createProject: async (input) => {
-      const created = await call("cloud-project-create", {
-        name: input.name,
-        ...input.region ? { region: input.region } : {},
-        ...input.teamId ? { teamId: input.teamId } : {}
-      });
-      try {
-        return await waitForReady(created.project.ref);
-      } catch {
-        return {
-          ...created.project,
-          ready: false,
-          note: `${created.project.ref} was created and is still starting. It was not ready within the wait. Call list_projects in a few seconds; do not connect to it yet.`
-        };
-      }
-    },
-    usage: (ref, days) => call("cloud-project-usage", { ref, ...days ? { days } : {} }),
-    exportStatus: (ref) => exportStatus(ref),
-    requestExport: (ref) => requestExport(ref),
-    resetPassword: (ref) => call("cloud-project-reset-password", { ref }),
-    listTeams: () => call("cloud-team-list", {}),
-    listTokens: () => call("cloud-token-list", {}),
-    createToken: (name, expires) => call("cloud-token-create", { name, ...expires ? { expires } : {} }),
-    revokeToken: (id) => call("cloud-token-revoke", { id }),
-    setProjectState: (verb, ref) => call(`cloud-project-${verb}`, { ref }),
-    connection: (ref) => connection(ref),
-    // The result-returning half, never the printing one: stdout is the JSON-RPC wire
-    // here, and a command that writes to it corrupts the protocol.
-    pushMigrations: (ref, options) => runPush(ref, { dir: options.dir, dryRun: options.dryRun })
-  };
-}
-var BORROWED = "app_";
-async function borrow() {
-  if (process.env.SNOUTDATA_NO_DESKTOP) {
-    return { tools: [], config: null };
-  }
-  const found = await look();
-  if (!found.available) {
-    return { tools: [], config: null };
-  }
-  const config = found.config;
-  try {
-    const borrowed = await borrowTools(config);
-    const tools = borrowed.map((tool) => ({
-      // Prefixed so provenance is visible in the name itself. An agent choosing
-      // between `list_projects` (your account, in the cloud) and `app_list_connections`
-      // (the databases configured in the app on this machine) should not have to infer
-      // which is which from a description.
-      name: `${BORROWED}${tool.name}`,
-      description: `[SnoutData app, on this machine] ${tool.description ?? tool.name}`,
-      inputSchema: tool.inputSchema ?? { type: "object", properties: {} }
-    }));
-    return { tools, config };
-  } catch {
-    return { tools: [], config: null };
-  }
-}
-async function serve(options) {
-  setJsonMode(true);
-  const { tools: borrowed, config: appConfig } = await borrow();
-  const ops = operations();
-  if (appConfig) {
-    ops.callBorrowed = (name, args) => callBorrowed(appConfig, name.slice(BORROWED.length), args);
-  }
-  const served = { ...options, borrowed };
-  warn(
-    borrowed.length > 0 ? `snoutdata mcp: ${TOOLS.length} cloud tools, and ${borrowed.length} borrowed from the SnoutData app on this machine.` : "snoutdata mcp: cloud tools only. The SnoutData app is not answering here, so its database tools are not on this endpoint."
-  );
-  let rest = "";
-  process.stdin.setEncoding("utf8");
-  try {
-    const who = await whoami();
-    warn(`snoutdata mcp: signed in as ${who.email ?? "this account"}.`);
-  } catch (error) {
-    warn(`snoutdata mcp: ${error instanceof Error ? error.message : String(error)}`);
-    warn("Sign in with `snoutdata login`, or set SNOUTDATA_ACCESS_TOKEN.");
-    return 3;
-  }
-  warn(`snoutdata mcp: ready${options.allowDelete ? " (delete_project is ON)" : ""}. Speaking MCP on stdin/stdout; stop it with Ctrl-C.`);
-  const inFlight = /* @__PURE__ */ new Set();
-  function track(work) {
-    inFlight.add(work);
-    void work.finally(() => inFlight.delete(work));
-  }
-  return new Promise((resolve3) => {
-    process.stdin.on("data", (chunk) => {
-      const taken = takeMessages(rest + chunk);
-      rest = taken.rest;
-      for (const line of taken.messages) {
-        track(respond(line, ops, served));
-      }
-    });
-    process.stdin.on("end", () => {
-      void (async () => {
-        while (inFlight.size > 0) {
-          await Promise.allSettled([...inFlight]);
-        }
-        resolve3(0);
-      })();
-    });
-    process.stdin.on("error", () => resolve3(1));
-  });
-}
-async function respond(line, ops, options) {
-  let request;
-  try {
-    request = JSON.parse(line);
-  } catch {
-    warn(`snoutdata mcp: ignoring a line that is not JSON: ${line.slice(0, 120)}`);
-    return;
-  }
-  try {
-    const answer = await handle(request, ops, options);
-    if (answer) {
-      process.stdout.write(`${JSON.stringify(answer)}
-`);
-    }
-  } catch (error) {
-    const id = request.id ?? null;
-    process.stdout.write(
-      `${JSON.stringify({
-        jsonrpc: "2.0",
-        id,
-        error: { code: -32603, message: error instanceof Error ? error.message : String(error) }
-      })}
-`
-    );
-  }
-}
-
-// src/commands/usage.ts
-init_api();
-init_output();
-
-// src/usage.ts
-var NEAR_FRACTION = 0.8;
-function storageState(fraction) {
-  if (fraction >= 1) {
-    return "over";
-  }
-  return fraction >= NEAR_FRACTION ? "near" : "ok";
-}
-function summariseUsage(days, limit) {
-  let latest = null;
-  let peak = null;
-  let computeSeconds = 0;
-  let connections = 0;
-  for (const day of days) {
-    computeSeconds += Number.isFinite(day.computeSeconds) ? day.computeSeconds : 0;
-    connections += Number.isFinite(day.connections) ? day.connections : 0;
-    if (day.dbBytes === null || !Number.isFinite(day.dbBytes)) {
-      continue;
-    }
-    peak = peak === null ? day.dbBytes : Math.max(peak, day.dbBytes);
-    if (!latest || day.day >= latest.day) {
-      latest = { day: day.day, dbBytes: day.dbBytes, repoBytes: day.repoBytes };
-    }
-  }
-  const storage = latest && limit && limit.maxStorageBytes > 0 ? {
-    limitBytes: limit.maxStorageBytes,
-    usedBytes: latest.dbBytes,
-    fraction: latest.dbBytes / limit.maxStorageBytes,
-    state: storageState(latest.dbBytes / limit.maxStorageBytes)
-  } : null;
-  return { days: days.length, latest, peakDbBytes: peak, computeSeconds, connections, storage };
-}
-function describeCompute(seconds) {
-  if (!Number.isFinite(seconds) || seconds <= 0) {
-    return "none";
-  }
-  const day = Math.floor(seconds / 86400);
-  const hour = Math.floor(seconds % 86400 / 3600);
-  const minute = Math.floor(seconds % 3600 / 60);
-  if (day > 0) {
-    return hour > 0 ? `${day}d ${hour}h` : `${day}d`;
-  }
-  if (hour > 0) {
-    return minute > 0 ? `${hour}h ${minute}m` : `${hour}h`;
-  }
-  return minute > 0 ? `${minute}m` : `${Math.round(seconds)}s`;
-}
-
-// src/commands/usage.ts
-async function usage(ref, options = {}) {
-  const answer = await call("cloud-project-usage", {
-    ref,
-    ...options.days ? { days: options.days } : {}
-  });
-  const summary = summariseUsage(answer.days, answer.limit);
-  emit({ ...answer, summary }, () => {
-    say(bold(`${answer.name} (${answer.ref})`));
-    if (!summary.latest) {
-      say("Nothing measured yet. The host samples every fifteen minutes.");
-    } else if (summary.storage) {
-      const percent = Math.round(summary.storage.fraction * 100);
-      const of = `${describeBytes(summary.storage.usedBytes)} of ${describeBytes(summary.storage.limitBytes)} on ${answer.limit?.tier}`;
-      say(
-        summary.storage.state === "over" ? `${of} (${percent}%). Over the limit, so writes are refused until it shrinks or the plan changes.` : summary.storage.state === "near" ? `${of} (${percent}%). Close to the limit: at 100% the database goes read-only.` : `${of} (${percent}%).`
-      );
-    } else {
-      say(`${describeBytes(summary.latest.dbBytes)} as of ${summary.latest.day}.`);
-    }
-    if (answer.readOnly && summary.storage?.state !== "over") {
-      say("This project is currently read-only.");
-    }
-    say(
-      `Over ${summary.days} day${summary.days === 1 ? "" : "s"}: ${describeCompute(summary.computeSeconds)} of compute, ${summary.connections} connection${summary.connections === 1 ? "" : "s"}.`
-    );
-    if (summary.peakDbBytes !== null && summary.latest && summary.peakDbBytes > summary.latest.dbBytes) {
-      say(dim(`Peak in that window was ${describeBytes(summary.peakDbBytes)}.`));
-    }
-    if (options.history && answer.days.length > 0) {
-      say("");
-      say(
-        table([
-          ["DAY", "SIZE", "BACKUPS", "COMPUTE", "CONNS"],
-          ...answer.days.map((one) => [
-            one.day,
-            one.dbBytes === null ? "-" : describeBytes(one.dbBytes),
-            one.repoBytes === null ? "-" : describeBytes(one.repoBytes),
-            describeCompute(one.computeSeconds),
-            String(one.connections)
-          ])
-        ])
-      );
-      say(dim("A dash is a day nothing measured it, which is what a paused project looks like."));
-    }
-  });
-  return 0;
-}
-
-// src/main.ts
-var VERSION = "0.1.0";
-var COMMANDS = [
-  { name: "init", summary: "Create or link a project and write a DATABASE_URL", flags: ["--name", "--region", "--env", "--ref"] },
-  { name: "login", summary: "Sign in through a browser, or with --device by typing a code into one anywhere", flags: ["--provider", "--no-browser", "--device", "--timeout"] },
-  { name: "logout", summary: "Forget the stored session", flags: [] },
-  { name: "whoami", summary: "Who this credential belongs to", flags: [] },
-  { name: "tokens list", summary: "Long-lived access tokens on this account", flags: [] },
-  { name: "tokens create", summary: "Mint an sdt_ token for CI or an agent", flags: ["--name", "--expires"] },
-  { name: "tokens revoke", summary: "Revoke one by id or prefix", flags: [] },
-  { name: "projects list", summary: "Every project on this account", flags: [] },
-  { name: "projects create", summary: "Make a hosted database", flags: ["--name", "--region", "--team", "--no-wait", "--timeout"] },
-  { name: "projects pause", summary: "Stop a project", flags: ["--ref"] },
-  { name: "projects resume", summary: "Start a paused project", flags: ["--ref"] },
-  { name: "projects delete", summary: "Delete a project", flags: ["--ref"] },
-  { name: "teams", summary: "Teams this account belongs to", flags: [] },
-  { name: "link", summary: "Point this folder at a project", flags: ["--ref"] },
-  { name: "usage", summary: "Size and compute against the plan limit", flags: ["--ref", "--days", "--history"] },
-  { name: "db url", summary: "A connection string", flags: ["--ref"] },
-  { name: "db psql", summary: "Open psql, or run statements after --", flags: ["--ref"] },
-  { name: "db reset-password", summary: "Rotate the project password", flags: ["--ref"] },
-  { name: "db export", summary: "Take or download a dump", flags: ["--ref", "--out", "--status", "--timeout"] },
-  { name: "db push", summary: "Apply migrations from a folder", flags: ["--dir", "--dry-run", "--out-of-order"] },
-  { name: "db restore", summary: "Put a dump into a project", flags: ["--file", "--force"] },
-  { name: "mcp", summary: "Serve these operations as tools over stdio", flags: ["--allow-delete"] }
-];
-var USAGE = `snoutdata ${VERSION} \u2014 hosted Postgres, from a terminal or an agent
+`:`${u.sql}
+${M}
+`,P=await Fe(a,K);if(P.code!==0)return O&&s("It ran inside a transaction, so nothing from it is in the database."),{ref:e,directory:r,ok:!1,applied:k,failed:u.name,error:P.err.trim(),notes:o};k.push(u.name),s(`  applied ${u.name}`)}return{ref:e,directory:r,ok:!0,applied:k,notes:o}}T();E();var lr="2024-11-05";function S(e,t=[]){return{type:"object",properties:e,additionalProperties:!1,...t.length?{required:t}:{}}}var v={type:"string"},Ae=[{name:"whoami",description:"Who this CLI is signed in as, and how (a session or a long-lived access token). Use it to check a credential before doing anything else.",inputSchema:S({})},{name:"list_projects",description:"Every hosted Postgres database on this account, with its ref, name, region, state (ready, paused, error), size, and whether it is read-only because it is over its plan's storage limit.",inputSchema:S({})},{name:"create_project",description:"Make a new hosted Postgres database and wait for it to be ready. Costs a project against the plan allowance; a free plan includes two. Returns its ref, which every other tool takes.",inputSchema:S({name:v,region:v,teamId:v},["name"])},{name:"get_connection_url",description:"The postgres:// URL for a project, ready to put in DATABASE_URL. IT CONTAINS A LIVE PASSWORD, so treat it as a credential and do not print it into a log or a file that is committed. Connecting to a paused project wakes it, which takes a few seconds.",inputSchema:S({ref:v},["ref"])},{name:"pause_project",description:"Stop a project. Its data is kept and the next connection wakes it. A production project refuses this.",inputSchema:S({ref:v},["ref"])},{name:"resume_project",description:"Start a paused project without waiting for a connection to wake it.",inputSchema:S({ref:v},["ref"])},{name:"push_migrations",description:"Run the .sql files in a folder against a project, in name order, once each, recording what ran in a _snoutdata_migrations table. Refuses a file that changed after it ran, a file that has gone, and a new file that sorts before one already applied. Use dryRun first to see what would happen. Needs psql on this machine.",inputSchema:S({ref:v,dir:v,dryRun:{type:"boolean"}},["ref"])},{name:"usage",description:"How much storage and compute a project has used against the limit on this plan, and whether it is near it. READ THIS BEFORE a migration or a bulk insert: a project over its storage limit is made read-only, and `list_projects` will say readOnly afterwards without ever saying how much headroom was left. Takes an optional number of days of history (default 30, maximum 365).",inputSchema:S({ref:v,days:{type:"number"}},["ref"])},{name:"export_status",description:"Whether a copy of this database is being taken, when the last one finished, and a download link if there is a live one. Costs nothing and starts nothing.",inputSchema:S({ref:v},["ref"])},{name:"start_export",description:"Take a copy of the whole database. Runs a pg_dump on the server and can take minutes, so this STARTS it and returns; poll export_status for the link. Worth doing before a migration you are unsure of. It does not block the database.",inputSchema:S({ref:v},["ref"])},{name:"reset_password",description:"Rotate the project's database password. THE OLD ONE STOPS WORKING IMMEDIATELY, including any DATABASE_URL already written into a file or a running process. Returns the new connection URL. Use it when a credential has leaked, not routinely.",inputSchema:S({ref:v},["ref"])},{name:"list_teams",description:"Teams this account belongs to, with the id create_project takes as teamId. Without this there is no way to discover that id.",inputSchema:S({})},{name:"list_tokens",description:"The long-lived sdt_ access tokens on this account: id, name, prefix, when each was made and last used. Never the token itself, which is shown once when it is made.",inputSchema:S({})},{name:"create_token",description:"Mint a long-lived sdt_ access token, for a CI job or another machine. RETURNS THE TOKEN ONCE AND NEVER AGAIN. It is as capable as this account, so hand it over deliberately. Optionally expires, as an ISO date.",inputSchema:S({name:v,expires:v},["name"])},{name:"revoke_token",description:"Revoke an access token by its id. Anything using it stops working at once. Safe to do to a token you think has leaked.",inputSchema:S({id:v},["id"])},{name:"delete_project",description:"Delete a project. THIS DESTROYS A DATABASE. Off unless the person who started this server passed --allow-delete, in which case it still only marks the project deleted and its data is erasable for a grace period.",inputSchema:S({ref:v},["ref"])}];function dr(e){let t=new Set;return e.filter(n=>!t.has(n.name)&&t.add(n.name))}function ae(e,t){return{jsonrpc:"2.0",id:e,result:t}}function Je(e,t,n){return{jsonrpc:"2.0",id:e,error:{code:t,message:n}}}function h(e,t,n=!1){let r=typeof t=="string"?t:JSON.stringify(t,null,2);return ae(e,{content:[{type:"text",text:r}],...n?{isError:!0}:{}})}function J(e,t){let n=e[t];return typeof n=="string"&&n.trim().length>0?n.trim():null}async function Kt(e,t,n){let r=e.id??null,o=e.method??"",s=e.params??{};if(e.id===void 0||e.id===null)return null;switch(o){case"initialize":return ae(r,{protocolVersion:lr,capabilities:{tools:{listChanged:!1}},serverInfo:{name:"snoutdata",version:n.version}});case"ping":return ae(r,{});case"tools/list":return ae(r,{tools:dr([...Ae,...n.borrowed??[]])});case"tools/call":return ur(r,s,t,n);default:return Je(r,-32601,`unknown method: ${o}`)}}async function ur(e,t,n,r){let o=typeof t.name=="string"?t.name:"",s=t.arguments??{};if(!(Ae.some(l=>l.name===o)||(r.borrowed?.some(l=>l.name===o)??!1)))return Je(e,-32602,`unknown tool: ${o}`);let a=["get_connection_url","pause_project","resume_project","delete_project","push_migrations","usage","export_status","start_export","reset_password"],c=J(s,"ref");if(a.includes(o)&&!c)return h(e,`${o} needs a project ref. Call list_projects to see them.`,!0);try{switch(o){case"whoami":return h(e,await n.whoami());case"list_projects":return h(e,await n.listProjects());case"create_project":{let l=J(s,"name");return l?h(e,await n.createProject({name:l,region:J(s,"region")??void 0,teamId:J(s,"teamId")??void 0})):h(e,"create_project needs a name.",!0)}case"get_connection_url":{let l=await n.connection(c);return h(e,{url:l.uri,state:l.state,wakesInstantly:l.wakesInstantly,warning:"This URL contains a live database password. Put it in an environment variable, not in a file that is committed."})}case"pause_project":return h(e,await n.setProjectState("pause",c));case"resume_project":return h(e,await n.setProjectState("resume",c));case"usage":{let l=typeof s.days=="number"?s.days:void 0;return h(e,await n.usage(c,l))}case"export_status":return h(e,await n.exportStatus(c));case"start_export":return h(e,await n.requestExport(c));case"reset_password":return h(e,await n.resetPassword(c));case"list_teams":return h(e,await n.listTeams());case"list_tokens":return h(e,await n.listTokens());case"create_token":{let l=J(s,"name");return l?h(e,await n.createToken(l,J(s,"expires")??void 0)):h(e,"create_token needs a name, so somebody can tell later what it was for.",!0)}case"revoke_token":{let l=J(s,"id");return l?h(e,await n.revokeToken(l)):h(e,"revoke_token needs the id of a token. list_tokens has them.",!0)}case"push_migrations":return h(e,await n.pushMigrations(c,{dir:J(s,"dir")??void 0,dryRun:s.dryRun===!0}));case"delete_project":return r.allowDelete?h(e,await n.setProjectState("delete",c)):h(e,"delete_project is off. The person running this server started it without --allow-delete, so deleting a database is theirs to do. Tell them that is what you wanted.",!0);default:return r.borrowed?.some(l=>l.name===o)?n.callBorrowed?ae(e,await n.callBorrowed(o,s)):h(e,`${o} needs the SnoutData app, which is no longer answering.`,!0):Je(e,-32602,`unknown tool: ${o}`)}}catch(l){return h(e,l instanceof Error?l.message:String(l),!0)}}function zt(e){let t=e.split(`
+`),n=t.pop()??"";return{messages:t.map(r=>r.trim()).filter(r=>r.length>0),rest:n}}we();function pr(){return{whoami:()=>X(),listProjects:()=>D(),createProject:async e=>{let t=await f("cloud-project-create",{name:e.name,...e.region?{region:e.region}:{},...e.teamId?{teamId:e.teamId}:{}});try{return await oe(t.project.ref)}catch{return{...t.project,ready:!1,note:`${t.project.ref} was created and is still starting. It was not ready within the wait. Call list_projects in a few seconds; do not connect to it yet.`}}},usage:(e,t)=>f("cloud-project-usage",{ref:e,...t?{days:t}:{}}),exportStatus:e=>Z(e),requestExport:e=>re(e),resetPassword:e=>f("cloud-project-reset-password",{ref:e}),listTeams:()=>f("cloud-team-list",{}),listTokens:()=>f("cloud-token-list",{}),createToken:(e,t)=>f("cloud-token-create",{name:e,...t?{expires:t}:{}}),revokeToken:e=>f("cloud-token-revoke",{id:e}),setProjectState:(e,t)=>f(`cloud-project-${e}`,{ref:t}),connection:e=>C(e),pushMigrations:(e,t)=>qe(e,{dir:t.dir,dryRun:t.dryRun})}}var Yt="app_";async function mr(){if(process.env.SNOUTDATA_NO_DESKTOP)return{tools:[],config:null};let e=await ge();if(!e.available)return{tools:[],config:null};let t=e.config;try{return{tools:(await at(t)).map(o=>({name:`${Yt}${o.name}`,description:`[SnoutData app, on this machine] ${o.description??o.name}`,inputSchema:o.inputSchema??{type:"object",properties:{}}})),config:t}}catch{return{tools:[],config:null}}}async function Vt(e){ne(!0);let{tools:t,config:n}=await mr(),r=pr();n&&(r.callBorrowed=(c,l)=>it(n,c.slice(Yt.length),l));let o={...e,borrowed:t};$(t.length>0?`snoutdata mcp: ${Ae.length} cloud tools, and ${t.length} borrowed from the SnoutData app on this machine.`:"snoutdata mcp: cloud tools only. The SnoutData app is not answering here, so its database tools are not on this endpoint.");let s="";process.stdin.setEncoding("utf8");try{let c=await X();$(`snoutdata mcp: signed in as ${c.email??"this account"}.`)}catch(c){return $(`snoutdata mcp: ${c instanceof Error?c.message:String(c)}`),$("Sign in with `snoutdata login`, or set SNOUTDATA_ACCESS_TOKEN."),3}$(`snoutdata mcp: ready${e.allowDelete?" (delete_project is ON)":""}. Speaking MCP on stdin/stdout; stop it with Ctrl-C.`);let d=new Set;function a(c){d.add(c),c.finally(()=>d.delete(c))}return new Promise(c=>{process.stdin.on("data",l=>{let w=zt(s+l);s=w.rest;for(let m of w.messages)a(fr(m,r,o))}),process.stdin.on("end",()=>{(async()=>{for(;d.size>0;)await Promise.allSettled([...d]);c(0)})()}),process.stdin.on("error",()=>c(1))})}async function fr(e,t,n){let r;try{r=JSON.parse(e)}catch{$(`snoutdata mcp: ignoring a line that is not JSON: ${e.slice(0,120)}`);return}try{let o=await Kt(r,t,n);o&&process.stdout.write(`${JSON.stringify(o)}
+`)}catch(o){let s=r.id??null;process.stdout.write(`${JSON.stringify({jsonrpc:"2.0",id:s,error:{code:-32603,message:o instanceof Error?o.message:String(o)}})}
+`)}}T();E();function gr(e){return e>=1?"over":e>=.8?"near":"ok"}function Xt(e,t){let n=null,r=null,o=0,s=0;for(let a of e)o+=Number.isFinite(a.computeSeconds)?a.computeSeconds:0,s+=Number.isFinite(a.connections)?a.connections:0,!(a.dbBytes===null||!Number.isFinite(a.dbBytes))&&(r=r===null?a.dbBytes:Math.max(r,a.dbBytes),(!n||a.day>=n.day)&&(n={day:a.day,dbBytes:a.dbBytes,repoBytes:a.repoBytes}));let d=n&&t&&t.maxStorageBytes>0?{limitBytes:t.maxStorageBytes,usedBytes:n.dbBytes,fraction:n.dbBytes/t.maxStorageBytes,state:gr(n.dbBytes/t.maxStorageBytes)}:null;return{days:e.length,latest:n,peakDbBytes:r,computeSeconds:o,connections:s,storage:d}}function Ge(e){if(!Number.isFinite(e)||e<=0)return"none";let t=Math.floor(e/86400),n=Math.floor(e%86400/3600),r=Math.floor(e%3600/60);return t>0?n>0?`${t}d ${n}h`:`${t}d`:n>0?r>0?`${n}h ${r}m`:`${n}h`:r>0?`${r}m`:`${Math.round(e)}s`}async function Zt(e,t={}){let n=await f("cloud-project-usage",{ref:e,...t.days?{days:t.days}:{}}),r=Xt(n.days,n.limit);return p({...n,summary:r},()=>{if(i(A(`${n.name} (${n.ref})`)),!r.latest)i("Nothing measured yet. The host samples every fifteen minutes.");else if(r.storage){let o=Math.round(r.storage.fraction*100),s=`${I(r.storage.usedBytes)} of ${I(r.storage.limitBytes)} on ${n.limit?.tier}`;i(r.storage.state==="over"?`${s} (${o}%). Over the limit, so writes are refused until it shrinks or the plan changes.`:r.storage.state==="near"?`${s} (${o}%). Close to the limit: at 100% the database goes read-only.`:`${s} (${o}%).`)}else i(`${I(r.latest.dbBytes)} as of ${r.latest.day}.`);n.readOnly&&r.storage?.state!=="over"&&i("This project is currently read-only."),i(`Over ${r.days} day${r.days===1?"":"s"}: ${Ge(r.computeSeconds)} of compute, ${r.connections} connection${r.connections===1?"":"s"}.`),r.peakDbBytes!==null&&r.latest&&r.peakDbBytes>r.latest.dbBytes&&i(y(`Peak in that window was ${I(r.peakDbBytes)}.`)),t.history&&n.days.length>0&&(i(""),i(W([["DAY","SIZE","BACKUPS","COMPUTE","CONNS"],...n.days.map(o=>[o.day,o.dbBytes===null?"-":I(o.dbBytes),o.repoBytes===null?"-":I(o.repoBytes),Ge(o.computeSeconds),String(o.connections)])])),i(y("A dash is a day nothing measured it, which is what a paused project looks like.")))}),0}var ie="0.1.0",Qt=[{name:"init",summary:"Create or link a project and write a DATABASE_URL",flags:["--name","--region","--env","--ref"]},{name:"login",summary:"Sign in through a browser, or with --device by typing a code into one anywhere",flags:["--provider","--no-browser","--device","--timeout"]},{name:"logout",summary:"Forget the stored session",flags:[]},{name:"whoami",summary:"Who this credential belongs to",flags:[]},{name:"tokens list",summary:"Long-lived access tokens on this account",flags:[]},{name:"tokens create",summary:"Mint an sdt_ token for CI or an agent",flags:["--name","--expires"]},{name:"tokens revoke",summary:"Revoke one by id or prefix",flags:[]},{name:"projects list",summary:"Every project on this account",flags:[]},{name:"projects create",summary:"Make a hosted database",flags:["--name","--region","--team","--no-wait","--timeout"]},{name:"projects pause",summary:"Stop a project",flags:["--ref"]},{name:"projects resume",summary:"Start a paused project",flags:["--ref"]},{name:"projects delete",summary:"Delete a project",flags:["--ref"]},{name:"teams",summary:"Teams this account belongs to",flags:[]},{name:"link",summary:"Point this folder at a project",flags:["--ref"]},{name:"usage",summary:"Size and compute against the plan limit",flags:["--ref","--days","--history"]},{name:"db url",summary:"A connection string",flags:["--ref"]},{name:"db psql",summary:"Open psql, or run statements after --",flags:["--ref"]},{name:"db reset-password",summary:"Rotate the project password",flags:["--ref"]},{name:"db export",summary:"Take or download a dump",flags:["--ref","--out","--status","--timeout"]},{name:"db push",summary:"Apply migrations from a folder",flags:["--dir","--dry-run","--out-of-order"]},{name:"db restore",summary:"Put a dump into a project",flags:["--file","--force"]},{name:"mcp",summary:"Serve these operations as tools over stdio",flags:["--allow-delete"]}],en=`snoutdata ${ie} \u2014 hosted Postgres, from a terminal or an agent
 
   snoutdata init [--name X] [--env]        a database for this folder, linked, ready to use
   snoutdata login [--provider github]      sign in through a browser
@@ -2517,299 +98,10 @@ A project comes from --ref, then SNOUTDATA_PROJECT, then
 .snoutdata/project.json in this folder or a parent. A token comes from
 SNOUTDATA_ACCESS_TOKEN, then ~/.snoutdata/auth.json. The session that login writes lasts
 an hour, so CI wants "tokens create", which does not expire.
-`;
-async function run(args) {
-  const [group, action2, ...rest] = args.command;
-  if (flagBoolean(args, "version") || group === "version") {
-    emit({ version: VERSION }, () => process.stdout.write(`${VERSION}
-`));
-    return 0;
-  }
-  if (flagBoolean(args, "help") && group && group !== "help") {
-    const matching = COMMANDS.filter((one) => one.name === group || one.name.startsWith(`${group} `));
-    if (matching.length > 0) {
-      emit({ commands: matching }, () => {
-        for (const one of matching) {
-          const flags = one.flags.length > 0 ? ` ${one.flags.join(" ")}` : "";
-          process.stdout.write(`  snoutdata ${one.name}${flags}
-      ${one.summary}
-`);
-        }
-        process.stdout.write(`
+`;async function hr(e){let[t,n,...r]=e.command;if(U(e,"version")||t==="version")return p({version:ie},()=>process.stdout.write(`${ie}
+`)),0;if(U(e,"help")&&t&&t!=="help"){let a=Qt.filter(c=>c.name===t||c.name.startsWith(`${t} `));if(a.length>0)return p({commands:a},()=>{for(let c of a){let l=c.flags.length>0?` ${c.flags.join(" ")}`:"";process.stdout.write(`  snoutdata ${c.name}${l}
+      ${c.summary}
+`)}process.stdout.write(`
   Every command also takes --json, --quiet and --help.
-`);
-      });
-      return 0;
-    }
-  }
-  const wantsHelp = flagBoolean(args, "help") || group === "help";
-  if (wantsHelp || !group) {
-    emit({ version: VERSION, usage: USAGE.trim(), commands: COMMANDS }, () => process.stdout.write(USAGE));
-    return wantsHelp ? 0 : EXIT.usage;
-  }
-  const timeoutMs = () => {
-    const seconds = flagNumber(args, "timeout");
-    if (seconds === void 0) {
-      return void 0;
-    }
-    if (!(seconds > 0)) {
-      throw new UsageError("--timeout is a number of seconds greater than zero");
-    }
-    return seconds * 1e3;
-  };
-  const ref = () => {
-    const found = resolveRef({ flag: flagString(args, "ref") });
-    if (!found) {
-      throw new UsageError(
-        "no project: pass --ref, set SNOUTDATA_PROJECT, or run `snoutdata link --ref <ref>`"
-      );
-    }
-    return found;
-  };
-  switch (group) {
-    case "login": {
-      if (flagBoolean(args, "device")) {
-        const started = await start({ name: thisMachine(), platform: process.platform });
-        emit({ verifyUrl: started.verifyUrl, code: started.code, expiresAt: started.expiresAt }, () => {
-          say("");
-          say(`  Open   ${started.verifyUrl}`);
-          say(`  Type   ${started.code}`);
-          say("");
-          say(dim("Waiting for that to be approved\u2026"));
-        });
-        const approved = await waitForApproval(started.secret, {
-          intervalMs: Math.max(1, started.interval) * 1e3,
-          expiresAt: started.expiresAt
-        });
-        writeAuth({ accessToken: approved.token });
-        emit({ ok: true, name: approved.name ?? null }, () => say("Signed in."));
-        return 0;
-      }
-      const result = await login({
-        provider: flagString(args, "provider"),
-        noBrowser: flagBoolean(args, "no-browser") || !canAsk(),
-        timeoutMs: timeoutMs()
-      });
-      emit({ email: result.email ?? null }, () => say(`Signed in${result.email ? ` as ${result.email}` : ""}.`));
-      return 0;
-    }
-    case "logout": {
-      clearAuth();
-      const stillSet = Boolean(process.env.SNOUTDATA_ACCESS_TOKEN);
-      emit({ ok: true, environmentTokenStillSet: stillSet }, () => {
-        say("Signed out.");
-        if (stillSet) {
-          say("SNOUTDATA_ACCESS_TOKEN is still set in this shell, so commands will keep working.");
-          say(dim("  unset SNOUTDATA_ACCESS_TOKEN"));
-        }
-      });
-      return 0;
-    }
-    case "whoami": {
-      const me = await whoami();
-      emit(me, () => {
-        process.stdout.write(`${me.email ?? me.id}
-`);
-        if (me.token) {
-          say(`via access token ${me.token.prefix} (${me.token.name}).`);
-        }
-      });
-      return 0;
-    }
-    case "tokens": {
-      switch (action2) {
-        case void 0:
-        case "list":
-          await list2();
-          return 0;
-        case "create": {
-          const name = flagString(args, "name") ?? rest[0];
-          if (!name) {
-            throw new UsageError("tokens create needs --name (what is it for, and where does it live)");
-          }
-          await create2({ name, expiresInDays: flagNumber(args, "expires") });
-          return 0;
-        }
-        case "revoke": {
-          const wanted = rest[0];
-          if (!wanted) {
-            throw new UsageError("tokens revoke needs the token's id or its sdt_ prefix");
-          }
-          await revoke(wanted);
-          return 0;
-        }
-        default:
-          throw new UsageError(`unknown command: tokens ${action2}`);
-      }
-    }
-    case "projects": {
-      switch (action2) {
-        case void 0:
-        case "list":
-          await list();
-          return 0;
-        case "create": {
-          const name = flagString(args, "name") ?? rest[0];
-          if (!name) {
-            throw new UsageError("projects create needs --name");
-          }
-          const teamFlag = flagString(args, "team");
-          await create({
-            teamId: teamFlag ? await resolveTeam(teamFlag) : void 0,
-            name,
-            region: flagString(args, "region"),
-            wait: !flagBoolean(args, "no-wait"),
-            timeoutMs: timeoutMs(),
-            link: void 0
-          });
-          return 0;
-        }
-        case "pause":
-        case "resume":
-        case "delete":
-          await action(action2, flagString(args, "ref") ?? rest[0] ?? ref());
-          return 0;
-        default:
-          throw new UsageError(`unknown command: projects ${action2}`);
-      }
-    }
-    case "teams": {
-      await listTeamsCommand();
-      return 0;
-    }
-    case "link": {
-      const target = flagString(args, "ref") ?? action2;
-      if (!target) {
-        throw new UsageError("link needs --ref");
-      }
-      const path = writeLink(process.cwd(), { ref: target });
-      emit({ ref: target, path }, () => say(`Linked ${target} (${path}).`));
-      return 0;
-    }
-    case "db": {
-      switch (action2) {
-        case "url":
-          await url(ref());
-          return 0;
-        case "psql":
-          return psql(ref(), rest);
-        case "reset-password":
-          await resetPassword(ref());
-          return 0;
-        case "push":
-          return push(ref(), {
-            dir: flagString(args, "dir"),
-            dryRun: Boolean(args.flags["dry-run"]),
-            outOfOrder: Boolean(args.flags["out-of-order"])
-          });
-        case "restore":
-          return restoreDatabase(ref(), {
-            file: flagString(args, "file"),
-            force: Boolean(args.flags["force"])
-          });
-        case "export":
-          return exportDatabase(ref(), {
-            timeoutMs: timeoutMs(),
-            out: flagString(args, "out"),
-            // `--status` looks without asking. Worth its own flag rather than being
-            // inferred, because the difference between the two is whether a
-            // `pg_dump` runs against somebody's production database.
-            statusOnly: Boolean(args.flags["status"])
-          });
-        default:
-          throw new UsageError(
-            action2 ? `unknown command: db ${action2}` : "db needs an action: url, psql, reset-password, export, push, restore"
-          );
-      }
-    }
-    case "usage":
-      return usage(ref(), {
-        days: flagNumber(args, "days"),
-        history: Boolean(args.flags["history"])
-      });
-    case "mcp":
-      return serve({ version: VERSION, allowDelete: Boolean(args.flags["allow-delete"]) });
-    case "init":
-      return init(args);
-    default:
-      throw new UsageError(`unknown command: ${group}`);
-  }
-}
-async function init(args) {
-  const existing = resolveRef({ flag: flagString(args, "ref") });
-  if (existing) {
-    say(`This folder is already linked to ${existing}.`);
-    await url(existing);
-    return 0;
-  }
-  const name = flagString(args, "name") ?? basenameOf(process.cwd());
-  say(`Creating a project called "${name}"\u2026`);
-  await create({
-    name,
-    region: flagString(args, "region"),
-    wait: true,
-    link: process.cwd()
-  });
-  const ref = resolveRef({ cwd: process.cwd() });
-  if (ref && flagBoolean(args, "env")) {
-    const { connection: connection2 } = await Promise.resolve().then(() => (init_api(), api_exports));
-    const details = await connection2(ref);
-    const written = writeEnv(process.cwd(), details.uri);
-    say(`${written.replaced ? "Updated" : "Wrote"} DATABASE_URL in ${written.path}.`);
-  }
-  return 0;
-}
-function basenameOf(directory) {
-  const parts = directory.split(/[\\/]/).filter(Boolean);
-  return parts[parts.length - 1] ?? "project";
-}
-function report(error) {
-  if (error instanceof CliFailure) {
-    emitFailure(error.code, error.message, error.details);
-    return error.exitCode;
-  }
-  if (error instanceof UsageError) {
-    emitFailure("usage", error.message);
-    return EXIT.usage;
-  }
-  if (error instanceof NotSignedIn) {
-    emitFailure("not-signed-in", error.message);
-    return EXIT["not-signed-in"];
-  }
-  if (error instanceof ApiError) {
-    const code2 = codeForStatus(error.status);
-    emitFailure(code2, error.message, { status: error.status });
-    return EXIT[code2];
-  }
-  const code = codeForThrown(error);
-  emitFailure(code, error instanceof Error ? error.message : String(error));
-  return EXIT[code];
-}
-function exitWith(code) {
-  process.exitCode = code;
-  setTimeout(() => process.exit(code), 2e3).unref();
-}
-function wantsJson(argv) {
-  const end = argv.indexOf("--");
-  return (end === -1 ? argv : argv.slice(0, end)).includes("--json");
-}
-async function main() {
-  setJsonMode(wantsJson(process.argv.slice(2)));
-  let args;
-  try {
-    args = parseArgs(process.argv.slice(2));
-  } catch (error) {
-    emitFailure("usage", String(error instanceof Error ? error.message : error));
-    exitWith(EXIT.usage);
-    return;
-  }
-  setJsonMode(args.json);
-  setQuiet(args.flags.quiet === true);
-  setInteractive(interactiveState({ isTty: Boolean(process.stdin.isTTY), json: args.json, env: process.env }));
-  try {
-    exitWith(await run(args));
-  } catch (error) {
-    exitWith(report(error));
-  }
-}
-void main();
+`)}),0}let o=U(e,"help")||t==="help";if(o||!t)return p({version:ie,usage:en.trim(),commands:Qt},()=>process.stdout.write(en)),o?0:L.usage;let s=()=>{let a=ce(e,"timeout");if(a!==void 0){if(!(a>0))throw new b("--timeout is a number of seconds greater than zero");return a*1e3}},d=()=>{let a=ue({flag:x(e,"ref")});if(!a)throw new b("no project: pass --ref, set SNOUTDATA_PROJECT, or run `snoutdata link --ref <ref>`");return a};switch(t){case"login":{if(U(e,"device")){let c=await ye({name:he(),platform:process.platform});p({verifyUrl:c.verifyUrl,code:c.code,expiresAt:c.expiresAt},()=>{i(""),i(`  Open   ${c.verifyUrl}`),i(`  Type   ${c.code}`),i(""),i(y("Waiting for that to be approved\u2026"))});let l=await ke(c.secret,{intervalMs:Math.max(1,c.interval)*1e3,expiresAt:c.expiresAt});return j({accessToken:l.token}),p({ok:!0,name:l.name??null},()=>i("Signed in.")),0}let a=await ve({provider:x(e,"provider"),noBrowser:U(e,"no-browser")||!Y(),timeoutMs:s()});return p({email:a.email??null},()=>i(`Signed in${a.email?` as ${a.email}`:""}.`)),0}case"logout":{Qe();let a=!!process.env.SNOUTDATA_ACCESS_TOKEN;return p({ok:!0,environmentTokenStillSet:a},()=>{i("Signed out."),a&&(i("SNOUTDATA_ACCESS_TOKEN is still set in this shell, so commands will keep working."),i(y("  unset SNOUTDATA_ACCESS_TOKEN")))}),0}case"whoami":{let a=await X();return p(a,()=>{process.stdout.write(`${a.email??a.id}
+`),a.token&&i(`via access token ${a.token.prefix} (${a.token.name}).`)}),0}case"tokens":switch(n){case void 0:case"list":return await _t(),0;case"create":{let a=x(e,"name")??r[0];if(!a)throw new b("tokens create needs --name (what is it for, and where does it live)");return await Ot({name:a,expiresInDays:ce(e,"expires")}),0}case"revoke":{let a=r[0];if(!a)throw new b("tokens revoke needs the token's id or its sdt_ prefix");return await jt(a),0}default:throw new b(`unknown command: tokens ${n}`)}case"projects":switch(n){case void 0:case"list":return await Tt(),0;case"create":{let a=x(e,"name")??r[0];if(!a)throw new b("projects create needs --name");let c=x(e,"team");return await Ce({teamId:c?await Et(c):void 0,name:a,region:x(e,"region"),wait:!U(e,"no-wait"),timeoutMs:s(),link:void 0}),0}case"pause":case"resume":case"delete":return await At(n,x(e,"ref")??r[0]??d()),0;default:throw new b(`unknown command: projects ${n}`)}case"teams":return await Pt(),0;case"link":{let a=x(e,"ref")??n;if(!a)throw new b("link needs --ref");let c=de(process.cwd(),{ref:a});return p({ref:a,path:c},()=>i(`Linked ${a} (${c}).`)),0}case"db":switch(n){case"url":return await Ue(d()),0;case"psql":return Bt(d(),r);case"reset-password":return await $t(d()),0;case"push":return Ht(d(),{dir:x(e,"dir"),dryRun:!!e.flags["dry-run"],outOfOrder:!!e.flags["out-of-order"]});case"restore":return qt(d(),{file:x(e,"file"),force:!!e.flags.force});case"export":return Ft(d(),{timeoutMs:s(),out:x(e,"out"),statusOnly:!!e.flags.status});default:throw new b(n?`unknown command: db ${n}`:"db needs an action: url, psql, reset-password, export, push, restore")}case"usage":return Zt(d(),{days:ce(e,"days"),history:!!e.flags.history});case"mcp":return Vt({version:ie,allowDelete:!!e.flags["allow-delete"]});case"init":return wr(e);default:throw new b(`unknown command: ${t}`)}}async function wr(e){let t=ue({flag:x(e,"ref")});if(t)return i(`This folder is already linked to ${t}.`),await Ue(t),0;let n=x(e,"name")??yr(process.cwd());i(`Creating a project called "${n}"\u2026`),await Ce({name:n,region:x(e,"region"),wait:!0,link:process.cwd()});let r=ue({cwd:process.cwd()});if(r&&U(e,"env")){let{connection:o}=await Promise.resolve().then(()=>(T(),Q)),s=await o(r),d=Lt(process.cwd(),s.uri);i(`${d.replaced?"Updated":"Wrote"} DATABASE_URL in ${d.path}.`)}return 0}function yr(e){let t=e.split(/[\\/]/).filter(Boolean);return t[t.length-1]??"project"}function kr(e){if(e instanceof B)return G(e.code,e.message,e.details),e.exitCode;if(e instanceof b)return G("usage",e.message),L.usage;if(e instanceof q)return G("not-signed-in",e.message),L["not-signed-in"];if(e instanceof N){let n=lt(e.status);return G(n,e.message,{status:e.status}),L[n]}let t=dt(e);return G(t,e instanceof Error?e.message:String(e)),L[t]}function We(e){process.exitCode=e,setTimeout(()=>process.exit(e),2e3).unref()}function br(e){let t=e.indexOf("--");return(t===-1?e:e.slice(0,t)).includes("--json")}async function xr(){ne(br(process.argv.slice(2)));let e;try{e=He(process.argv.slice(2))}catch(t){G("usage",String(t instanceof Error?t.message:t)),We(L.usage);return}ne(e.json),mt(e.flags.quiet===!0),nt(pe({isTty:!!process.stdin.isTTY,json:e.json,env:process.env}));try{We(await hr(e))}catch(t){We(kr(t))}}xr();