@basedagents/keyring - npm Package Compare versions

Comparing version 0.6.1 to 0.6.2

dist/provisioner/connect-supabase.d.ts

+/**
+ * Supabase connect orchestration (PROVISIONER spec §1, §5) — bootstrap-then-API.
+ *
+ * The browser's job is bootstrap, once per account: mint ONE personal access
+ * token (the provisioning credential, `sbp_…`). Everything after that is API
+ * by id: mint per-agent SECRET KEYS (`sb_secret_…`, individually deletable),
+ * verify, burn. Where Vercel's shape is account→tokens, Supabase's is
+ * account→projects→keys, so a connect targets ONE PROJECT — auto-picked when
+ * the account has exactly one, `--project <ref>` otherwise.
+ *
+ * Two honesty notes baked into the credential cards:
+ *   - Supabase PATs and secret keys do not expire. The grant carries our own
+ *     expiry leash, and the kill switch burns the key by id at the provider —
+ *     but a minted key outlives its grant until burned.
+ *   - Projects still on legacy JWT keys (no new-key API) degrade to the shared
+ *     `service_role` key: project-wide, NOT individually revocable — the card
+ *     says so, and burn reports "revoke only".
+ */
+import type { ConnectDeps, ConnectResult } from './connect.js';
+export declare const SUPABASE_PROV_LABEL = "Supabase provisioning token";
+/**
+ * The whole §5 flow: ensure provisioner (browser at most once) → API-mint a
+ * per-agent secret key for the project → grant. Legacy-key projects degrade
+ * to the shared service_role key with the honesty recorded on the card.
+ */
+export declare function connectSupabase(deps: ConnectDeps, opts: {
+    agentRef: string;
+    agentName?: string;
+    expiryDays?: number;
+    projectRef?: string;
+}): Promise<ConnectResult & {
+    projectRef: string;
+    projectUrl: string;
+}>;
+/**
+ * Kill-switch integration (§6): burn every minted Supabase key an agent holds,
+ * by id, via the provisioning credential. Legacy service_role credentials have
+ * no id — those report "revoke only" with the dashboard pointer.
+ */
+export declare function burnSupabaseKeysForAgent(deps: Pick<ConnectDeps, 'kr' | 'owner' | 'fetchImpl'>, credentialIds: string[]): Promise<Array<{
+    credential_id: string;
+    label: string;
+    result: string;
+}>>;
+//# sourceMappingURL=connect-supabase.d.ts.map

dist/provisioner/connect-supabase.d.ts.map

+{"version":3,"file":"connect-supabase.d.ts","sourceRoot":"","sources":["../../src/provisioner/connect-supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE/D,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAyJjE;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACvF,OAAO,CAAC,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAgGrE;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,OAAO,GAAG,WAAW,CAAC,EACrD,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA+B1E"}

dist/provisioner/connect-supabase.js

+/**
+ * Supabase connect orchestration (PROVISIONER spec §1, §5) — bootstrap-then-API.
+ *
+ * The browser's job is bootstrap, once per account: mint ONE personal access
+ * token (the provisioning credential, `sbp_…`). Everything after that is API
+ * by id: mint per-agent SECRET KEYS (`sb_secret_…`, individually deletable),
+ * verify, burn. Where Vercel's shape is account→tokens, Supabase's is
+ * account→projects→keys, so a connect targets ONE PROJECT — auto-picked when
+ * the account has exactly one, `--project <ref>` otherwise.
+ *
+ * Two honesty notes baked into the credential cards:
+ *   - Supabase PATs and secret keys do not expire. The grant carries our own
+ *     expiry leash, and the kill switch burns the key by id at the provider —
+ *     but a minted key outlives its grant until burned.
+ *   - Projects still on legacy JWT keys (no new-key API) degrade to the shared
+ *     `service_role` key: project-wide, NOT individually revocable — the card
+ *     says so, and burn reports "revoke only".
+ */
+import { randomBytes } from 'node:crypto';
+import { runRecipe } from './engine.js';
+import { supabaseBootstrapRecipe, SUPABASE_TOKENS_URL } from './recipes/supabase.js';
+import { SupabaseApi, SupabaseApiError, supabaseProjectUrl } from './supabase-api.js';
+export const SUPABASE_PROV_LABEL = 'Supabase provisioning token';
+const AGENT_GRANT_EXPIRY_DAYS_DEFAULT = 30;
+/** New-key names: lowercase alphanumeric + underscores (management-API constraint). */
+const keySlug = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 24) || 'agent';
+function api(deps, token) {
+    return new SupabaseApi(token, deps.fetchImpl);
+}
+/** Value-free description of why a captured string can't be a Supabase PAT. */
+function capturedPatProblem(v) {
+    if (v.length === 0)
+        return 'was empty';
+    if (v.includes('…') || v.includes('*'))
+        return `looks masked (${v.length} chars)`;
+    if (/\s/.test(v))
+        return 'contains whitespace';
+    if (!v.startsWith('sbp_'))
+        return `does not start with sbp_ (${v.length} chars)`;
+    if (v.length < 20)
+        return `is too short to be a token (${v.length} chars)`;
+    return null;
+}
+/**
+ * Verify a candidate PAT, salvaging via assisted paste when it fails — the
+ * dialog value is shown once and must not be thrown away. Distinguishes
+ * auth-rejection (bad capture) from network failure (token likely fine).
+ */
+async function verifyOrSalvage(deps, candidate) {
+    const verify = async (v) => {
+        try {
+            await api(deps, v).listProjects();
+            return 'ok';
+        }
+        catch (err) {
+            if (err instanceof SupabaseApiError && (err.status === 401 || err.status === 403))
+                return 'rejected';
+            throw new Error(`Could not reach the Supabase API to verify the token (${err.message}). ` +
+                'The token in the browser dialog is still valid — check your network and run connect again.');
+        }
+    };
+    if (candidate && (await verify(candidate)) === 'ok')
+        return candidate;
+    if (candidate)
+        deps.hooks.info(`The captured value did not authenticate (${candidate.length} chars) — falling back to paste.`);
+    for (let attempt = 0; attempt < 2; attempt++) {
+        const pasted = (await deps.pasteFallback('Copy the token shown in the browser window (sbp_…) and paste it here — it goes straight into your vault.'))?.trim();
+        if (!pasted)
+            throw new Error('Connect cancelled during assisted paste — nothing was saved.');
+        if ((await verify(pasted)) === 'ok')
+            return pasted;
+        deps.hooks.info('That value did not authenticate either — one more try.');
+    }
+    throw new Error('The pasted value was rejected by Supabase — nothing was saved. Run connect again.');
+}
+/** Drive the browser recipe to mint the PAT and return its verified value. */
+async function browserMintPat(deps, tokenName) {
+    const outcome = await runRecipe(supabaseBootstrapRecipe, deps.launchDriver, // engine launches AFTER consent (§3)
+    deps.hooks, { token_name: tokenName }, [
+        `Keyring then creates a Supabase access token FOR you — named ${tokenName}. Nothing for you to click.`,
+        'That token can mint per-project keys, so future connects need no browser at all.',
+    ]);
+    let value = null;
+    let transcript = [];
+    if (outcome.status === 'completed') {
+        const captured = (outcome.captured.get('token_value') ?? '').trim();
+        transcript = outcome.transcript;
+        const problem = capturedPatProblem(captured);
+        if (problem) {
+            deps.hooks.info(`The value I grabbed from the page ${problem} — falling back to paste.`);
+        }
+        else {
+            value = captured;
+        }
+    }
+    else if (outcome.status === 'fallback_paste') {
+        transcript = [...outcome.transcript, { step: outcome.atStep, result: 'manual' }];
+    }
+    else {
+        throw new Error(`Connect stopped: ${outcome.reason}`);
+    }
+    return { value: await verifyOrSalvage(deps, value), transcript };
+}
+/** A valid provisioning PAT, bootstrapping via the browser if needed. */
+async function ensureProvisioner(deps) {
+    const { kr, owner, hooks } = deps;
+    const existing = kr.findProvisioner('supabase');
+    if (existing) {
+        const value = kr.provisionerValue(owner, existing.credential_id);
+        try {
+            await api(deps, value).listProjects();
+            return { value, browserRan: false };
+        }
+        catch (err) {
+            if (!(err instanceof SupabaseApiError) || (err.status !== 401 && err.status !== 403))
+                throw err;
+            hooks.info('The stored provisioning token was rejected by Supabase — re-running the one-time browser setup.');
+            await kr.removeCredential(owner, existing.credential_id);
+        }
+    }
+    // ── Bootstrap (browser, once per account) ──
+    const tokenName = `ba/provisioning/${randomBytes(4).toString('hex')}`;
+    const { value, transcript } = await browserMintPat(deps, tokenName);
+    const credential = await kr.addCredential(owner, {
+        label: SUPABASE_PROV_LABEL,
+        provider: 'supabase',
+        provisioner: true,
+        scope: 'account (provisioning — can mint per-project Supabase keys)',
+        // Supabase PATs carry NO provider-side id or expiry; the management API
+        // cannot list or delete them, so rotation and burn are dashboard actions.
+        rotation_policy: `manual — Supabase access tokens do not expire; revoke at ${SUPABASE_TOKENS_URL}`,
+    }, value);
+    await kr.recordProvisioner(owner, 'provisioner_bootstrap', {
+        credentialId: credential.credential_id,
+        context: 'connect supabase',
+        detail: { recipe: supabaseBootstrapRecipe.id, recipe_version: supabaseBootstrapRecipe.version, token_name: tokenName, transcript },
+    });
+    return { value, browserRan: true };
+}
+/** Resolve the target project: --project wins; else exactly-one auto-picks. */
+async function resolveProject(deps, provValue, requested) {
+    const projects = await api(deps, provValue).listProjects();
+    if (requested) {
+        const hit = projects.find((p) => p.id === requested || p.name === requested);
+        if (!hit) {
+            const roster = projects.map((p) => `${p.id} (${p.name})`).join(', ') || '(none)';
+            throw new Error(`No Supabase project "${requested}" in this account. Projects: ${roster}.`);
+        }
+        return { ref: hit.id, name: hit.name };
+    }
+    if (projects.length === 1)
+        return { ref: projects[0].id, name: projects[0].name };
+    if (projects.length === 0) {
+        throw new Error('This Supabase account has no projects yet — create one at supabase.com/dashboard first.');
+    }
+    const roster = projects.map((p) => `${p.id} (${p.name})`).join(', ');
+    throw new Error(`This account has ${projects.length} Supabase projects — pick one with --project <ref>. Projects: ${roster}.`);
+}
+/**
+ * The whole §5 flow: ensure provisioner (browser at most once) → API-mint a
+ * per-agent secret key for the project → grant. Legacy-key projects degrade
+ * to the shared service_role key with the honesty recorded on the card.
+ */
+export async function connectSupabase(deps, opts) {
+    const { kr, owner } = deps;
+    const days = opts.expiryDays ?? AGENT_GRANT_EXPIRY_DAYS_DEFAULT;
+    // Validate the grantee BEFORE any minting: a provider-side key is an
+    // external side effect, and an unknown identity must fail here — not after
+    // a key already exists at Supabase (vercel field lesson).
+    const agentId = kr.resolveAgent(kr.vault(), opts.agentRef);
+    const prov = await ensureProvisioner(deps);
+    const project = await resolveProject(deps, prov.value, opts.projectRef);
+    const projectUrl = supabaseProjectUrl(project.ref);
+    const keyName = `ba_${keySlug(opts.agentName ?? opts.agentRef)}_${randomBytes(4).toString('hex')}`;
+    deps.hooks.info(`Minting secret key ${keyName} for project ${project.ref} via the Supabase API…`);
+    // The mint ladder: new-style secret key (per-agent, burnable by id) → the
+    // legacy shared service_role key (reveal), scope honesty on the card.
+    let secretValue;
+    let providerKeyId;
+    let envVar;
+    let scope;
+    try {
+        const minted = await api(deps, prov.value).createSecretKey(project.ref, keyName, `BasedAgents Keyring key for ${opts.agentName ?? opts.agentRef}`);
+        secretValue = minted.apiKey;
+        providerKeyId = minted.id;
+        envVar = 'SUPABASE_SECRET_KEY';
+        scope = `project ${project.ref} (${projectUrl}) — secret key, burnable by id`;
+    }
+    catch (err) {
+        if (!(err instanceof SupabaseApiError) || err.status < 400 || err.status >= 500)
+            throw err;
+        deps.hooks.info('This project cannot mint new-style keys — falling back to its service_role key (shared, not individually revocable).');
+        const keys = await api(deps, prov.value).listApiKeys(project.ref, true);
+        const serviceRole = keys.find((k) => k.name === 'service_role' && k.api_key);
+        if (!serviceRole?.api_key) {
+            throw new Error(`Supabase would not mint a key for project ${project.ref} and no service_role key was readable — nothing was saved. (${err.message})`);
+        }
+        secretValue = serviceRole.api_key;
+        providerKeyId = undefined; // legacy JWTs cannot be burned individually
+        envVar = 'SUPABASE_SERVICE_ROLE_KEY';
+        scope = `project ${project.ref} (${projectUrl}) — LEGACY service_role: shared, revoke = rotate in the dashboard`;
+    }
+    const expiresAtIso = new Date(Date.now() + days * 86_400_000).toISOString();
+    let credential;
+    let grant;
+    try {
+        credential = await kr.addCredential(owner, {
+            label: `Supabase key (${opts.agentName ?? opts.agentRef} · ${project.name || project.ref})`,
+            provider: 'supabase',
+            env_var: envVar,
+            scope,
+            provider_key_id: providerKeyId,
+            // provider_team doubles as the provider-side container (Vercel: teamId;
+            // Supabase: project ref) — burn needs it to address the key.
+            provider_team: project.ref,
+        }, secretValue);
+        // Supabase keys never expire provider-side; the grant is OUR leash.
+        const constraints = { expires_at: expiresAtIso };
+        grant = await kr.createGrant(owner, credential.credential_id, agentId, constraints);
+    }
+    catch (err) {
+        // Compensating rollback: a minted provider-side key must not outlive a
+        // failed vault write — burn it and drop the half-written credential.
+        try {
+            if (credential)
+                await kr.removeCredential(owner, credential.credential_id);
+        }
+        catch { /* best effort */ }
+        try {
+            if (providerKeyId)
+                await api(deps, prov.value).deleteApiKey(project.ref, providerKeyId);
+        }
+        catch { /* best effort */ }
+        throw err;
+    }
+    await kr.recordProvisioner(owner, 'provisioner_mint', {
+        credentialId: credential.credential_id,
+        context: `connect supabase for ${opts.agentRef}`,
+        detail: {
+            key_id: providerKeyId ?? null,
+            key_name: keyName,
+            project_ref: project.ref,
+            scope,
+            grant_expires_at: expiresAtIso,
+            grant_id: grant.grant_id,
+            browser_ran: prov.browserRan,
+        },
+    });
+    return {
+        credential,
+        grantId: grant.grant_id,
+        agentId: grant.agent_id,
+        tokenName: keyName,
+        scope,
+        expiresAt: expiresAtIso,
+        browserRan: prov.browserRan,
+        projectRef: project.ref,
+        projectUrl,
+    };
+}
+/**
+ * Kill-switch integration (§6): burn every minted Supabase key an agent holds,
+ * by id, via the provisioning credential. Legacy service_role credentials have
+ * no id — those report "revoke only" with the dashboard pointer.
+ */
+export async function burnSupabaseKeysForAgent(deps, credentialIds) {
+    const { kr, owner } = deps;
+    const prov = kr.findProvisioner('supabase');
+    const results = [];
+    const all = kr.credentialsView();
+    for (const id of credentialIds) {
+        const cred = all.find((c) => c.credential_id === id);
+        if (!cred || cred.provider !== 'supabase' || cred.provisioner)
+            continue;
+        if (!cred.provider_key_id || !cred.provider_team) {
+            results.push({ credential_id: id, label: cred.label, result: 'no provider id — revoke only (rotate the key in the Supabase dashboard)' });
+            continue;
+        }
+        if (!prov) {
+            results.push({ credential_id: id, label: cred.label, result: 'no provisioning token — revoke only (delete the key in the Supabase dashboard)' });
+            continue;
+        }
+        try {
+            const value = kr.provisionerValue(owner, prov.credential_id);
+            const status = await new SupabaseApi(value, deps.fetchImpl).deleteApiKey(cred.provider_team, cred.provider_key_id);
+            results.push({ credential_id: id, label: cred.label, result: status });
+            await kr.recordProvisioner(owner, 'provisioner_burn', {
+                credentialId: id,
+                context: 'kill switch',
+                detail: { key_id: cred.provider_key_id, project_ref: cred.provider_team, status },
+            });
+        }
+        catch (err) {
+            results.push({ credential_id: id, label: cred.label, result: `burn failed: ${err.message}` });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=connect-supabase.js.map

dist/provisioner/connect-supabase.js.map

+{"version":3,"file":"connect-supabase.js","sourceRoot":"","sources":["../../src/provisioner/connect-supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGtF,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AACjE,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAE3C,uFAAuF;AACvF,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CACpC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;AAE9F,SAAS,GAAG,CAAC,IAAiB,EAAE,KAAa;IAC3C,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,iBAAiB,CAAC,CAAC,MAAM,SAAS,CAAC;IAClF,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC/C,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,6BAA6B,CAAC,CAAC,MAAM,SAAS,CAAC;IACjF,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,+BAA+B,CAAC,CAAC,MAAM,SAAS,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,IAAiB,EAAE,SAAwB;IACxE,MAAM,MAAM,GAAG,KAAK,EAAE,CAAS,EAA8B,EAAE;QAC7D,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;gBAAE,OAAO,UAAU,CAAC;YACrG,MAAM,IAAI,KAAK,CACb,yDAA0D,GAAa,CAAC,OAAO,KAAK;gBACpF,4FAA4F,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,SAAS,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,SAAS;QAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,4CAA4C,SAAS,CAAC,MAAM,kCAAkC,CAAC,CAAC;IAE/H,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CACtC,0GAA0G,CAC3G,CAAC,EAAE,IAAI,EAAE,CAAC;QACX,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;AACvG,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,cAAc,CAAC,IAAiB,EAAE,SAAiB;IAIhE,MAAM,OAAO,GAAe,MAAM,SAAS,CACzC,uBAAuB,EACvB,IAAI,CAAC,YAAY,EAAE,qCAAqC;IACxD,IAAI,CAAC,KAAK,EACV,EAAE,UAAU,EAAE,SAAS,EAAE,EACzB;QACE,gEAAgE,SAAS,6BAA6B;QACtG,kFAAkF;KACnF,CACF,CAAC;IAEF,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,UAAU,GAA4C,EAAE,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAChC,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qCAAqC,OAAO,2BAA2B,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,QAAQ,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAC/C,UAAU,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;AACnE,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,iBAAiB,CAAC,IAAiB;IAChD,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAChG,KAAK,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;YAC9G,MAAM,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAAG,mBAAmB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACtE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAEpE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE;QAC/C,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,6DAA6D;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,eAAe,EAAE,4DAA4D,mBAAmB,EAAE;KACnG,EAAE,KAAK,CAAC,CAAC;IAEV,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,EAAE;QACzD,YAAY,EAAE,UAAU,CAAC,aAAa;QACtC,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE,EAAE,MAAM,EAAE,uBAAuB,CAAC,EAAE,EAAE,cAAc,EAAE,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE;KACnI,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,cAAc,CAC3B,IAAiB,EACjB,SAAiB,EACjB,SAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,YAAY,EAAE,CAAC;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,gCAAgC,MAAM,GAAG,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,iEAAiE,MAAM,GAAG,CAAC,CAAC;AACjI,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAiB,EACjB,IAAwF;IAExF,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,+BAA+B,CAAC;IAEhE,qEAAqE;IACrE,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,gBAAgB,OAAO,CAAC,GAAG,wBAAwB,CAAC,CAAC;IAElG,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,WAAmB,CAAC;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,MAAc,CAAC;IACnB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CACxD,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,+BAA+B,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE,CACvF,CAAC;QACF,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,qBAAqB,CAAC;QAC/B,KAAK,GAAG,WAAW,OAAO,CAAC,GAAG,KAAK,UAAU,gCAAgC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,gBAAgB,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM,GAAG,CAAC;QAC3F,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,sHAAsH,CAAC,CAAC;QACxI,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,CAAC,GAAG,+DAAgE,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QACpK,CAAC;QACD,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC;QAClC,aAAa,GAAG,SAAS,CAAC,CAAC,4CAA4C;QACvE,MAAM,GAAG,2BAA2B,CAAC;QACrC,KAAK,GAAG,WAAW,OAAO,CAAC,GAAG,KAAK,UAAU,mEAAmE,CAAC;IACnH,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;IAE5E,IAAI,UAAwC,CAAC;IAC7C,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE;YACzC,KAAK,EAAE,iBAAiB,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,MAAM,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG;YAC3F,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,MAAM;YACf,KAAK;YACL,eAAe,EAAE,aAAa;YAC9B,wEAAwE;YACxE,6DAA6D;YAC7D,aAAa,EAAE,OAAO,CAAC,GAAG;SAC3B,EAAE,WAAW,CAAC,CAAC;QAEhB,oEAAoE;QACpE,MAAM,WAAW,GAAqB,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QACnE,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC;YAAC,IAAI,UAAU;gBAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC/G,IAAI,CAAC;YAAC,IAAI,aAAa;gBAAE,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC5H,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE;QACpD,YAAY,EAAE,UAAU,CAAC,aAAa;QACtC,OAAO,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE;QAChD,MAAM,EAAE;YACN,MAAM,EAAE,aAAa,IAAI,IAAI;YAC7B,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,KAAK;YACL,gBAAgB,EAAE,YAAY;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,IAAI,CAAC,UAAU;SAC7B;KACF,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,OAAO,EAAE,KAAK,CAAC,QAAQ;QACvB,OAAO,EAAE,KAAK,CAAC,QAAQ;QACvB,SAAS,EAAE,OAAO;QAClB,KAAK;QACL,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,OAAO,CAAC,GAAG;QACvB,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAqD,EACrD,aAAuB;IAEvB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAoE,EAAE,CAAC;IACpF,MAAM,GAAG,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC;IAEjC,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,IAAI,CAAC,WAAW;YAAE,SAAS;QACxE,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,yEAAyE,EAAE,CAAC,CAAC;YAC1I,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC,CAAC;YACjJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACnH,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE;gBACpD,YAAY,EAAE,EAAE;gBAChB,OAAO,EAAE,aAAa;gBACtB,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAiB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

dist/provisioner/recipes/supabase.d.ts

+/**
+ * Supabase bootstrap recipe (PROVISIONER spec §5) — mints ONE personal access
+ * token (`sbp_…`): the provisioning credential. Agent keys are never minted
+ * here; they come from the management API afterwards (§1 bootstrap-then-API).
+ *
+ * Recipes are data. Selector strategy (§4): accessibility roles + visible
+ * labels first, CSS fallbacks second, checkpoint handoff as the safety net —
+ * so UI drift degrades to "click it yourself", never to a crash. Drift is
+ * caught by the canary, not by users.
+ *
+ * v1 — selectors written from the documented dashboard flow (Account →
+ * Access Tokens → "Generate new token" → name → token shown once with Copy)
+ * and NOT yet field-verified on the live DOM; every step carries fallbacks
+ * and the checkpoint absorbs whatever drifted. Bump the version on any step
+ * change, as with vercel.ts.
+ */
+import type { Recipe } from '../types.js';
+export declare const SUPABASE_TOKENS_URL = "https://supabase.com/dashboard/account/tokens";
+export declare const supabaseBootstrapRecipe: Recipe;
+//# sourceMappingURL=supabase.d.ts.map

dist/provisioner/recipes/supabase.d.ts.map

+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../../src/provisioner/recipes/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,eAAO,MAAM,mBAAmB,kDAAkD,CAAC;AAEnF,eAAO,MAAM,uBAAuB,EAAE,MAsErC,CAAC"}

dist/provisioner/recipes/supabase.js

+/**
+ * Supabase bootstrap recipe (PROVISIONER spec §5) — mints ONE personal access
+ * token (`sbp_…`): the provisioning credential. Agent keys are never minted
+ * here; they come from the management API afterwards (§1 bootstrap-then-API).
+ *
+ * Recipes are data. Selector strategy (§4): accessibility roles + visible
+ * labels first, CSS fallbacks second, checkpoint handoff as the safety net —
+ * so UI drift degrades to "click it yourself", never to a crash. Drift is
+ * caught by the canary, not by users.
+ *
+ * v1 — selectors written from the documented dashboard flow (Account →
+ * Access Tokens → "Generate new token" → name → token shown once with Copy)
+ * and NOT yet field-verified on the live DOM; every step carries fallbacks
+ * and the checkpoint absorbs whatever drifted. Bump the version on any step
+ * change, as with vercel.ts.
+ */
+export const SUPABASE_TOKENS_URL = 'https://supabase.com/dashboard/account/tokens';
+export const supabaseBootstrapRecipe = {
+    id: 'supabase-bootstrap',
+    version: 1,
+    provider: 'supabase',
+    allowedDomains: ['supabase.com'],
+    login: {
+        url: SUPABASE_TOKENS_URL,
+        // The tokens page shows its generate button only with a live session; a
+        // logged-out visit lands on the sign-in flow where it is absent.
+        loggedInProbe: {
+            role: 'button',
+            name: 'Generate new token',
+            description: 'the Generate new token button on the Access Tokens page',
+        },
+        loggedOutHint: 'Log in to Supabase in the open window (any method — email, GitHub, SSO). ' +
+            'Nothing is watched or recorded while you do; press Continue when you are on the Access Tokens page.',
+    },
+    steps: [
+        { id: 'open-tokens', kind: 'goto', url: SUPABASE_TOKENS_URL },
+        {
+            id: 'open-generate',
+            kind: 'click',
+            target: { role: 'button', name: 'Generate new token', description: 'the Generate new token button' },
+            fallbacks: [
+                { css: 'text=Generate new token', description: 'the Generate new token button (fallback)' },
+                { css: 'text=Generate New Token', description: 'the Generate new token button (fallback 2)' },
+            ],
+        },
+        {
+            id: 'fill-name',
+            kind: 'fill',
+            target: { role: 'textbox', name: 'Name', description: 'the token name field' },
+            fallbacks: [
+                { css: '[role="dialog"] input[type="text"]', description: 'the token name field (fallback)' },
+                { css: 'input[placeholder*="name" i]', description: 'the token name field (fallback 2)' },
+            ],
+            param: 'token_name',
+        },
+        {
+            id: 'submit',
+            kind: 'click',
+            target: { role: 'button', name: 'Generate token', description: 'the Generate token button' },
+            fallbacks: [
+                { css: '[role="dialog"] button[type="submit"]', description: 'the Generate token button (fallback)' },
+                { css: 'text=Generate token', description: 'the Generate token button (fallback 2)' },
+            ],
+        },
+        {
+            // The one-time `sbp_…` value shown after generation, straight DOM → vault.
+            id: 'capture-token',
+            kind: 'capture',
+            // Dialog-scoped first — a wrong grab costs a whole run (vercel field lesson).
+            target: { css: '[role="dialog"] input[readonly]', description: 'the new token value in the dialog' },
+            fallbacks: [
+                { css: '[role="dialog"] code', description: 'the new token value (fallback)' },
+                { css: 'input[readonly]', description: 'the new token value (fallback 2)' },
+                { css: 'code', description: 'the new token value (fallback 3)' },
+            ],
+            secretKey: 'token_value',
+            // DOM shape of the reveal is the least stable part — but every token
+            // reveal has a Copy button. Click it, read the clipboard.
+            copyButton: { role: 'button', name: 'Copy', description: 'the Copy button in the dialog' },
+            copyButtonFallbacks: [
+                { css: '[aria-label="Copy"]', description: 'the Copy button (fallback)' },
+                { css: 'text=Copy', description: 'the Copy button (fallback 2)' },
+            ],
+            timeoutMs: 15_000,
+        },
+    ],
+};
+//# sourceMappingURL=supabase.js.map

dist/provisioner/recipes/supabase.js.map

+{"version":3,"file":"supabase.js","sourceRoot":"","sources":["../../../src/provisioner/recipes/supabase.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAEnF,MAAM,CAAC,MAAM,uBAAuB,GAAW;IAC7C,EAAE,EAAE,oBAAoB;IACxB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,CAAC,cAAc,CAAC;IAChC,KAAK,EAAE;QACL,GAAG,EAAE,mBAAmB;QACxB,wEAAwE;QACxE,iEAAiE;QACjE,aAAa,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,yDAAyD;SACvE;QACD,aAAa,EACX,2EAA2E;YAC3E,qGAAqG;KACxG;IACD,KAAK,EAAE;QACL,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE;QAC7D;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,+BAA+B,EAAE;YACpG,SAAS,EAAE;gBACT,EAAE,GAAG,EAAE,yBAAyB,EAAE,WAAW,EAAE,0CAA0C,EAAE;gBAC3F,EAAE,GAAG,EAAE,yBAAyB,EAAE,WAAW,EAAE,4CAA4C,EAAE;aAC9F;SACF;QACD;YACE,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE;YAC9E,SAAS,EAAE;gBACT,EAAE,GAAG,EAAE,oCAAoC,EAAE,WAAW,EAAE,iCAAiC,EAAE;gBAC7F,EAAE,GAAG,EAAE,8BAA8B,EAAE,WAAW,EAAE,mCAAmC,EAAE;aAC1F;YACD,KAAK,EAAE,YAAY;SACpB;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,2BAA2B,EAAE;YAC5F,SAAS,EAAE;gBACT,EAAE,GAAG,EAAE,uCAAuC,EAAE,WAAW,EAAE,sCAAsC,EAAE;gBACrG,EAAE,GAAG,EAAE,qBAAqB,EAAE,WAAW,EAAE,wCAAwC,EAAE;aACtF;SACF;QACD;YACE,2EAA2E;YAC3E,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,SAAS;YACf,8EAA8E;YAC9E,MAAM,EAAE,EAAE,GAAG,EAAE,iCAAiC,EAAE,WAAW,EAAE,mCAAmC,EAAE;YACpG,SAAS,EAAE;gBACT,EAAE,GAAG,EAAE,sBAAsB,EAAE,WAAW,EAAE,gCAAgC,EAAE;gBAC9E,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,kCAAkC,EAAE;gBAC3E,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,kCAAkC,EAAE;aACjE;YACD,SAAS,EAAE,aAAa;YACxB,qEAAqE;YACrE,0DAA0D;YAC1D,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,+BAA+B,EAAE;YAC1F,mBAAmB,EAAE;gBACnB,EAAE,GAAG,EAAE,qBAAqB,EAAE,WAAW,EAAE,4BAA4B,EAAE;gBACzE,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,8BAA8B,EAAE;aAClE;YACD,SAAS,EAAE,MAAM;SAClB;KACF;CACF,CAAC"}

dist/provisioner/supabase-api.d.ts

+/**
+ * Supabase management API client (PROVISIONER spec §1) — everything after
+ * bootstrap is API-by-ID, authenticated with the provisioning credential (a
+ * personal access token, `sbp_…`).
+ *
+ * Endpoint matrix (api.supabase.com v1; canary-checked — see
+ * scripts/canary-supabase.mjs):
+ *   GET    /v1/projects                        → list projects; also the
+ *          cheap validity probe (Vercel's whoami equivalent).
+ *   GET    /v1/projects/{ref}/api-keys?reveal=true
+ *          → every key incl. values: NEW keys ({ type: 'publishable'|'secret',
+ *            id, api_key }) and LEGACY JWTs ({ name: 'anon'|'service_role' }).
+ *   POST   /v1/projects/{ref}/api-keys         → mint a NEW key; body
+ *          { type: 'secret', name, description? } → { id, api_key: 'sb_secret_…' }.
+ *          Per-key deletable — this is what makes per-agent revocation real.
+ *   DELETE /v1/projects/{ref}/api-keys/{id}    → burn by id.
+ * Error shape: { message } (sometimes { error }). Unlike Vercel tokens,
+ * Supabase PATs and secret keys have NO expiry — the burn path is the only
+ * provider-side leash, which is why minted keys must always carry their id.
+ */
+export declare class SupabaseApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export interface SupabaseProject {
+    /** The project ref — also the API-keys path segment and the *.supabase.co host. */
+    id: string;
+    name: string;
+    status?: string;
+}
+export interface SupabaseApiKey {
+    /** Present on NEW-style keys; legacy JWTs have no id and cannot be burned individually. */
+    id?: string;
+    /** Legacy: 'anon' | 'service_role'. New keys: the name given at mint. */
+    name?: string;
+    /** 'legacy' | 'publishable' | 'secret' (absent on some legacy responses). */
+    type?: string;
+    /** The key value — only populated with ?reveal=true or on mint. */
+    api_key?: string;
+}
+/** The project's public URL — not a secret; agents need it beside the key. */
+export declare function supabaseProjectUrl(ref: string): string;
+type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;
+export declare class SupabaseApi {
+    private readonly token;
+    private readonly fetchImpl;
+    constructor(token: string, fetchImpl?: FetchLike);
+    private request;
+    /** Cheap validity probe AND the project roster — one call does both. */
+    listProjects(): Promise<SupabaseProject[]>;
+    /** All keys for a project; reveal=true includes the values (mint-fallback path). */
+    listApiKeys(projectRef: string, reveal: boolean): Promise<SupabaseApiKey[]>;
+    /**
+     * Mint a NEW secret key (`sb_secret_…`) — individually deletable, which is
+     * the whole point. Name constraint observed in docs: lowercase alphanumeric
+     * and underscores (the canary re-verifies).
+     */
+    createSecretKey(projectRef: string, name: string, description?: string): Promise<{
+        id: string;
+        apiKey: string;
+    }>;
+    /** Burn by id. Missing keys count as burned (the goal state is "gone"). */
+    deleteApiKey(projectRef: string, id: string): Promise<'burned' | 'already_gone'>;
+}
+export {};
+//# sourceMappingURL=supabase-api.d.ts.map

dist/provisioner/supabase-api.d.ts.map

+{"version":3,"file":"supabase-api.d.ts","sourceRoot":"","sources":["../../src/provisioner/supabase-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,qBAAa,gBAAiB,SAAQ,KAAK;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIrD;AAED,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,2FAA2F;IAC3F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAExE,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,SAAiB;YAGjC,OAAO;IAoBrB,wEAAwE;IAClE,YAAY,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAUhD,oFAAoF;IAC9E,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAOjF;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAYtH,2EAA2E;IACrE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;CASvF"}

dist/provisioner/supabase-api.js

+/**
+ * Supabase management API client (PROVISIONER spec §1) — everything after
+ * bootstrap is API-by-ID, authenticated with the provisioning credential (a
+ * personal access token, `sbp_…`).
+ *
+ * Endpoint matrix (api.supabase.com v1; canary-checked — see
+ * scripts/canary-supabase.mjs):
+ *   GET    /v1/projects                        → list projects; also the
+ *          cheap validity probe (Vercel's whoami equivalent).
+ *   GET    /v1/projects/{ref}/api-keys?reveal=true
+ *          → every key incl. values: NEW keys ({ type: 'publishable'|'secret',
+ *            id, api_key }) and LEGACY JWTs ({ name: 'anon'|'service_role' }).
+ *   POST   /v1/projects/{ref}/api-keys         → mint a NEW key; body
+ *          { type: 'secret', name, description? } → { id, api_key: 'sb_secret_…' }.
+ *          Per-key deletable — this is what makes per-agent revocation real.
+ *   DELETE /v1/projects/{ref}/api-keys/{id}    → burn by id.
+ * Error shape: { message } (sometimes { error }). Unlike Vercel tokens,
+ * Supabase PATs and secret keys have NO expiry — the burn path is the only
+ * provider-side leash, which is why minted keys must always carry their id.
+ */
+const API = 'https://api.supabase.com';
+export class SupabaseApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(`Supabase API ${status}: ${message}`);
+        this.status = status;
+        this.name = 'SupabaseApiError';
+    }
+}
+/** The project's public URL — not a secret; agents need it beside the key. */
+export function supabaseProjectUrl(ref) {
+    return `https://${ref}.supabase.co`;
+}
+export class SupabaseApi {
+    token;
+    fetchImpl;
+    constructor(token, fetchImpl = fetch) {
+        this.token = token;
+        this.fetchImpl = fetchImpl;
+    }
+    async request(method, path, body) {
+        const res = await this.fetchImpl(`${API}${path}`, {
+            method,
+            headers: {
+                Authorization: `Bearer ${this.token}`,
+                ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+            },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+        });
+        const json = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            const message = (typeof json.message === 'string' && json.message) ||
+                (typeof json.error === 'string' && json.error) ||
+                res.statusText;
+            throw new SupabaseApiError(res.status, message);
+        }
+        return json;
+    }
+    /** Cheap validity probe AND the project roster — one call does both. */
+    async listProjects() {
+        const json = await this.request('GET', '/v1/projects');
+        if (!Array.isArray(json))
+            throw new SupabaseApiError(200, 'projects response is not an array');
+        return json.map((p) => ({
+            id: String(p.id ?? ''),
+            name: String(p.name ?? ''),
+            status: typeof p.status === 'string' ? p.status : undefined,
+        }));
+    }
+    /** All keys for a project; reveal=true includes the values (mint-fallback path). */
+    async listApiKeys(projectRef, reveal) {
+        const q = reveal ? '?reveal=true' : '';
+        const json = await this.request('GET', `/v1/projects/${encodeURIComponent(projectRef)}/api-keys${q}`);
+        if (!Array.isArray(json))
+            throw new SupabaseApiError(200, 'api-keys response is not an array');
+        return json;
+    }
+    /**
+     * Mint a NEW secret key (`sb_secret_…`) — individually deletable, which is
+     * the whole point. Name constraint observed in docs: lowercase alphanumeric
+     * and underscores (the canary re-verifies).
+     */
+    async createSecretKey(projectRef, name, description) {
+        const json = await this.request('POST', `/v1/projects/${encodeURIComponent(projectRef)}/api-keys`, { type: 'secret', name, ...(description ? { description } : {}) });
+        if (!json.id || !json.api_key) {
+            throw new SupabaseApiError(200, 'create-key response missing id/api_key');
+        }
+        return { id: json.id, apiKey: json.api_key };
+    }
+    /** Burn by id. Missing keys count as burned (the goal state is "gone"). */
+    async deleteApiKey(projectRef, id) {
+        try {
+            await this.request('DELETE', `/v1/projects/${encodeURIComponent(projectRef)}/api-keys/${encodeURIComponent(id)}`);
+            return 'burned';
+        }
+        catch (err) {
+            if (err instanceof SupabaseApiError && err.status === 404)
+                return 'already_gone';
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=supabase-api.js.map

dist/provisioner/supabase-api.js.map

+{"version":3,"file":"supabase-api.js","sourceRoot":"","sources":["../../src/provisioner/supabase-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,GAAG,GAAG,0BAA0B,CAAC;AAEvC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACpB;IAArB,YAAqB,MAAc,EAAE,OAAe;QAClD,KAAK,CAAC,gBAAgB,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC;QADzB,WAAM,GAAN,MAAM,CAAQ;QAEjC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAoBD,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,WAAW,GAAG,cAAc,CAAC;AACtC,CAAC;AAID,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,KAAa,EACb,YAAuB,KAAK;QAD5B,UAAK,GAAL,KAAK,CAAQ;QACb,cAAS,GAAT,SAAS,CAAmB;IAC5C,CAAC;IAEI,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,EAAE;YAChD,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;gBACrC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GACX,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC;gBAClD,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;gBAC9C,GAAG,CAAC,UAAU,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAU,KAAK,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QAC/F,OAAQ,IAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACtB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,WAAW,CAAC,UAAkB,EAAE,MAAe;QACnD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAU,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QAC/F,OAAO,IAAwB,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,IAAY,EAAE,WAAoB;QAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,MAAM,EACN,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,WAAW,EACzD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAClE,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,EAAU;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAClH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,cAAc,CAAC;YACjF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

dist/cli/connect.d.ts

 /**
  * based connect <provider> — the Provisioner front door (spec §3).
  *
- * v1 provider: vercel. Consent-first, window always visible, checkpoint
- * handoffs instead of crashes, assisted-paste as the floor. Where it cannot
- * run (no display — cloud sandboxes), it says exactly what to do instead.
+ * Providers: vercel, supabase. Consent-first, window always visible,
+ * checkpoint handoffs instead of crashes, assisted-paste as the floor. Where
+ * it cannot run (no display — cloud sandboxes), it says exactly what to do
+ * instead.
  */
 export declare function cmdConnect(args: string[], dir: string | undefined): Promise<void>;
 //# sourceMappingURL=connect.d.ts.map

dist/cli/connect.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/cli/connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmCH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAyEvF"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/cli/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAoCH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAiFvF"}

dist/cli/connect.js

 /**
  * based connect <provider> — the Provisioner front door (spec §3).
  *
- * v1 provider: vercel. Consent-first, window always visible, checkpoint
- * handoffs instead of crashes, assisted-paste as the floor. Where it cannot
- * run (no display — cloud sandboxes), it says exactly what to do instead.
+ * Providers: vercel, supabase. Consent-first, window always visible,
+ * checkpoint handoffs instead of crashes, assisted-paste as the floor. Where
+ * it cannot run (no display — cloud sandboxes), it says exactly what to do
+ * instead.
  */
@@ -12,3 +13,4 @@ import { Keyring } from '../keyring.js';
 import { connectVercel } from '../provisioner/connect.js';
-const PROVIDERS = ['vercel'];
+import { connectSupabase } from '../provisioner/connect-supabase.js';
+const PROVIDERS = ['vercel', 'supabase'];
 function cliHooks() {
@@ -40,7 +42,10 @@ return {
 export async function cmdConnect(args, dir) {
-    const flags = parseFlags(args, { value: ['agent', 'days'] });
+    const flags = parseFlags(args, { value: ['agent', 'days', 'project'] });
     const provider = flags.positional[0];
     if (!provider || !PROVIDERS.includes(provider)) {
-        throw new CliError(`Usage: based connect <${PROVIDERS.join('|')}> [--agent <ref>] [--days <n>]`);
+        throw new CliError(`Usage: based connect <${PROVIDERS.join('|')}> [--agent <ref>] [--days <n>] [--project <ref>]`);
     }
+    if (flags.values['project'] && provider !== 'supabase') {
+        throw new CliError('--project applies to supabase only (which project to mint the key for).');
+    }
     if (!process.stdin.isTTY) {
@@ -80,3 +85,3 @@ // §2: no headless provisioning, ever. Same message the driver uses, so a
     }
-    const result = await connectVercel({
+    const deps = {
         kr,
@@ -96,10 +101,17 @@ owner,
         },
-    }, { agentRef, agentName, expiryDays: days });
+    };
+    const result = provider === 'supabase'
+        ? await connectSupabase(deps, { agentRef, agentName, expiryDays: days, projectRef: flags.values['project'] })
+        : await connectVercel(deps, { agentRef, agentName, expiryDays: days });
     console.log('');
     console.log('✓ Connected.');
-    console.log(`  Token     ${result.tokenName}`);
+    console.log(`  Key       ${result.tokenName}`);
     console.log(`  For       ${agentName} (${result.agentId})`);
     console.log(`  Reach     ${result.scope}`);
-    console.log(`  Expires   ${result.expiresAt}`);
+    console.log(`  Expires   ${result.expiresAt}${provider === 'supabase' ? ' (the grant — Supabase keys have no provider-side expiry; the kill switch burns by id)' : ''}`);
     console.log(`  Vaulted   ${result.credential.credential_id} · grant ${result.grantId}`);
+    if (provider === 'supabase') {
+        const s = result;
+        console.log(`  Project   ${s.projectRef} — set SUPABASE_URL=${s.projectUrl} beside the key (the URL is not a secret).`);
+    }
     console.log(result.browserRan
@@ -106,0 +118,0 @@ ? '  The browser ran once to set up provisioning — future connects are API-only, ~10 seconds.'

dist/cli/connect.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/cli/connect.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAG1D,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,CAAC;AAE7B,SAAS,QAAQ;IACf,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACzB,OAAO,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO;YAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,OAAO;YACV,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAuB;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACnG,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACnF,MAAM,IAAI,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC;IAEhC,6DAA6D;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,mDAAmD,CAAC,CAAC;;YACrG,MAAM,IAAI,QAAQ,CAAC,oEAAoE,CAAC,CAAC;IAChG,CAAC;IACD,0EAA0E;IAC1E,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QACjF,MAAM,IAAI,QAAQ,CAChB,kBAAkB,QAAQ,wBAAwB,KAAK,KAAK;YAC5D,2FAA2F;YAC3F,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;IAE3G,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC;QACE,EAAE;QACF,KAAK;QACL,KAAK,EAAE,QAAQ,EAAE;QACjB,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;YACjF,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,+HAA+H,CAAC,CAAC;YAC7I,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,oDAAoD,CAAC,CAAC;YACnF,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAC1B,CAAC;KACF,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAC1C,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,eAAe,SAAS,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,UAAU,CAAC,aAAa,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU;QAC3B,CAAC,CAAC,4FAA4F;QAC9F,CAAC,CAAC,wEAAwE,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/cli/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGrE,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAEzC,SAAS,QAAQ;IACf,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACjD,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACzB,OAAO,CAAC,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO;YAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,OAAO;YACV,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAuB;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,QAAQ,CAAC,yBAAyB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QACvD,MAAM,IAAI,QAAQ,CAAC,yEAAyE,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACnF,MAAM,IAAI,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC;IAEhC,6DAA6D;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;aAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,QAAQ,CAAC,mDAAmD,CAAC,CAAC;;YACrG,MAAM,IAAI,QAAQ,CAAC,oEAAoE,CAAC,CAAC;IAChG,CAAC;IACD,0EAA0E;IAC1E,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;QACjF,MAAM,IAAI,QAAQ,CAChB,kBAAkB,QAAQ,wBAAwB,KAAK,KAAK;YAC5D,2FAA2F;YAC3F,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;IAE3G,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,kCAAkC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,IAAI,GAAG;QACX,EAAE;QACF,KAAK;QACL,KAAK,EAAE,QAAQ,EAAE;QACjB,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;YACjF,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,OAAe,EAAE,EAAE;YACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,+HAA+H,CAAC,CAAC;YAC7I,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,oDAAoD,CAAC,CAAC;YACnF,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAC1B,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,QAAQ,KAAK,UAAU;QACpC,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7G,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,eAAe,SAAS,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,SAAS,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,wFAAwF,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzK,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,UAAU,CAAC,aAAa,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAqD,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,UAAU,uBAAuB,CAAC,CAAC,UAAU,4CAA4C,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU;QAC3B,CAAC,CAAC,4FAA4F;QAC9F,CAAC,CAAC,wEAAwE,CAAC,CAAC;AAChF,CAAC"}

dist/cli/grants.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/cli/grants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrF;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAYtF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDpF;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BxF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBvF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAapF"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/cli/grants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrF;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAYtF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DpF;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BxF;AAED,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBvF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAapF"}

dist/cli/grants.js

@@ -79,6 +79,11 @@ /**
         const { burnVercelTokensForAgent } = await import('../provisioner/connect.js');
-        const burns = await burnVercelTokensForAgent({ kr, owner: kr.ownerKeypair() }, [...new Set(revokedCredIds)]);
+        const { burnSupabaseKeysForAgent } = await import('../provisioner/connect-supabase.js');
+        const ids = [...new Set(revokedCredIds)];
+        const burns = [
+            ...(await burnVercelTokensForAgent({ kr, owner: kr.ownerKeypair() }, ids)),
+            ...(await burnSupabaseKeysForAgent({ kr, owner: kr.ownerKeypair() }, ids)),
+        ];
         if (burns.length > 0) {
             console.log('');
-            console.log('Provider-side burn (Vercel):');
+            console.log('Provider-side burn:');
             for (const b of burns) {
@@ -85,0 +90,0 @@ const mark = b.result === 'burned' || b.result === 'already_gone' ? '✓' : '⚠';

dist/cli/grants.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/cli/grants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EACpD,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,GAChF,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAEvE,SAAS,oBAAoB,CAC3B,MAA8B,EAC9B,QAAsB;IAEtB,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,WAAW,CAAC,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,WAAW,CAAC,qBAAqB,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1H,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,WAAW,CAAC,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,WAAW,CAAC,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,QAAQ,EAAE,GAAG,CAAC,sBAAsB,CAAC;QAAE,WAAW,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACnF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc,EAAE,GAAuB;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,2IAA2I,CAAC,CAAC;IAClK,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,KAAK,mBAAmB,CAAC,WAAW,CAAC,IAAI,kDAAkD,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,GAAuB;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IAElF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,QAAQ,eAAe,KAAK,SAAS,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzG,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,0CAA0C,CAAC,CAAC;IAE9E,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,4DAA4D,CAAC,CAAC;IACnG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,iBAAiB,CAAC,MAAM,iBAAiB,OAAO,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACrH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,oBAAoB,EAAE,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB;SAC5C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,GAAuB;IACvE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAe,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACtG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC;YACR,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC9E,OAAO,CAAC,UAAU;YAClB,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;YACrC,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,KAAK,IAAI,GAAG;YACpB,OAAO,CAAC,MAAM;YACd,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;YAC9B,OAAO,CAAC,IAAI,IAAI,GAAG;SACpB,CAAC,CAAC;IACL,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAuB;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC,sIAAsI,CAAC,CAAC;IAC7J,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,cAAc,CAChD,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAChG,CAAC;IAEF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,QAAQ,MAAM,KAAK,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IAEpF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3F,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,OAAO,CAAC,GAAG,CACT,aAAa,OAAO,CAAC,UAAU,aAAa,OAAO,CAAC,QAAQ,OAAO;QACnE,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/cli/grants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EACpD,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,GAChF,MAAM,aAAa,CAAC;AAErB,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAEvE,SAAS,oBAAoB,CAC3B,MAA8B,EAC9B,QAAsB;IAEtB,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,WAAW,CAAC,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9F,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,WAAW,CAAC,qBAAqB,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1H,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,WAAW,CAAC,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,WAAW,CAAC,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,QAAQ,EAAE,GAAG,CAAC,sBAAsB,CAAC;QAAE,WAAW,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACnF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAc,EAAE,GAAuB;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,2IAA2I,CAAC,CAAC;IAClK,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAEtF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzF,OAAO,CAAC,GAAG,CAAC,KAAK,mBAAmB,CAAC,WAAW,CAAC,IAAI,kDAAkD,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,GAAuB;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IAElF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,QAAQ,eAAe,KAAK,SAAS,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzG,oBAAoB,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,0CAA0C,CAAC,CAAC;IAE9E,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,OAAO,4DAA4D,CAAC,CAAC;IACnG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,iBAAiB,CAAC,MAAM,iBAAiB,OAAO,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QACrH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,oBAAoB,EAAE,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,iBAAiB;SAC5C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAC/E,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,MAAM,wBAAwB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,GAAG,CAAC,MAAM,wBAAwB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;SAC3E,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IACxF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,GAAuB;IACvE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAe,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACtG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC;YACR,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC9E,OAAO,CAAC,UAAU;YAClB,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;YACrC,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,KAAK,IAAI,GAAG;YACpB,OAAO,CAAC,MAAM;YACd,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC;YAC9B,OAAO,CAAC,IAAI,IAAI,GAAG;SACpB,CAAC,CAAC;IACL,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc,EAAE,GAAuB;IACtE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC,sIAAsI,CAAC,CAAC;IAC7J,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,cAAc,CAChD,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAChG,CAAC;IAEF,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,QAAQ,MAAM,KAAK,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzD,IAAI,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IAEpF,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3F,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACzB,OAAO,CAAC,GAAG,CACT,aAAa,OAAO,CAAC,UAAU,aAAa,OAAO,CAAC,QAAQ,OAAO;QACnE,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpG,CAAC;AACJ,CAAC"}

dist/cli/index.js

@@ -42,5 +42,5 @@ /**
 Credentials:
-  connect <provider> [--agent <ref>] [--days <n>]
+  connect <provider> [--agent <ref>] [--days <n>] [--project <ref>]
                                         Mint a scoped token for an agent — browser once to
-                                        set up provisioning, then API-only (v1: vercel)
+                                        set up provisioning, then API-only (vercel, supabase)
   add <label> [--provider <p>] [--env <VAR>] [--scope <s>] [--rotation <note>]
@@ -47,0 +47,0 @@ [--provider-key-id <id>] [--value <secret>]

dist/cli/sync.d.ts

@@ -15,5 +15,7 @@ /**
 /** Runs the Provisioner for one agent; injected so tests never need a browser. */
-export type ProvisionRunner = (keyring: Keyring, agentId: string) => Promise<{
+export type ProvisionRunner = (keyring: Keyring, agentId: string, provider: string) => Promise<{
     credentialId: string;
 }>;
+/** Providers the daemon can provision on this machine (the console's "Do it for me"). */
+export declare const PROVISIONABLE: string[];
 /**
@@ -20,0 +22,0 @@ * Connect cards (onboarding Move 3): pull browser-sealed provider tokens,

dist/cli/sync.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/cli/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAgB,MAAM,eAAe,CAAC;AAOtD,OAAO,EAAE,aAAa,EAAuB,MAAM,qBAAqB,CAAC;AAQzE,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CpF;AAwCD,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA8BvG;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,SAAS,GAAE,eAAwC,GAClD,OAAO,CAAC,MAAM,CAAC,CA0FjB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BtG;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAsEpF"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/cli/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAgB,MAAM,eAAe,CAAC;AAOtD,OAAO,EAAE,aAAa,EAAuB,MAAM,qBAAqB,CAAC;AAQzE,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CpF;AAwCD,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEzH,yFAAyF;AACzF,eAAO,MAAM,aAAa,UAAyB,CAAC;AAoCpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,aAAa,EACrB,SAAS,GAAE,eAAwC,GAClD,OAAO,CAAC,MAAM,CAAC,CA0FjB;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BtG;AAED,iGAAiG;AACjG,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAOzF;AAED,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAsEpF"}

dist/cli/sync.js

@@ -104,5 +104,6 @@ /**
 }
-const defaultProvisionRunner = async (keyring, agentId) => {
-    const { connectVercel } = await import('../provisioner/connect.js');
-    const result = await connectVercel({
+/** Providers the daemon can provision on this machine (the console's "Do it for me"). */
+export const PROVISIONABLE = ['vercel', 'supabase'];
+const defaultProvisionRunner = async (keyring, agentId, provider) => {
+    const deps = {
         kr: keyring,
@@ -117,3 +118,13 @@ owner: keyring.ownerKeypair(),
         pasteFallback: async () => null,
-    }, { agentRef: agentId, agentName: keyring.vault().identities[agentId]?.name });
+    };
+    const opts = { agentRef: agentId, agentName: keyring.vault().identities[agentId]?.name };
+    if (provider === 'supabase') {
+        // No --project in a daemon run: the sole project auto-picks; multi-project
+        // accounts fail with the roster, which the console shows as the reason.
+        const { connectSupabase } = await import('../provisioner/connect-supabase.js');
+        const result = await connectSupabase(deps, opts);
+        return { credentialId: result.credential.credential_id };
+    }
+    const { connectVercel } = await import('../provisioner/connect.js');
+    const result = await connectVercel(deps, opts);
     return { credentialId: result.credential.credential_id };
@@ -177,7 +188,7 @@ };
             try {
-                if (conn.provider !== 'vercel') {
+                if (!PROVISIONABLE.includes(conn.provider)) {
                     throw new Error(`automatic setup for "${conn.provider}" is not available yet — paste a token on the card instead`);
                 }
                 console.log(`▶ ${display}: automatic setup for ${shortAgentId(conn.agent_id)} — a browser window may open here (first time only)…`);
-                const { credentialId } = await provision(keyring, conn.agent_id);
+                const { credentialId } = await provision(keyring, conn.agent_id, conn.provider);
                 pendingResolves.set(conn.id, credentialId);
@@ -184,0 +195,0 @@ await client.resolveConnection(conn.id, { daemonCredentialId: credentialId });

dist/cli/sync.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/cli/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGrE,SAAS,OAAO,CAAC,KAAqD;IACpE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,6BAA6B,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAE/F,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,UAAU,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;QAClE,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;IACjE,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE;YACtC,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,YAAY,EAAE,CAAC,CAAC,cAAc;YAC9B,IAAI,EAAE,KAAK;YACX,OAAO;YACP,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;SAClC,CAAC,CAAC;QACH,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,oEAAoE,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;AAElD;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;YACzE,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,2CAA2C,CAAC,CAAC;YAClE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACtD,OAAO,UAAU,CAAC,CAAC,8DAA8D;QACnF,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO;YAC/B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,kDAAkD,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,OAAO;YACV,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAKD,MAAM,sBAAsB,GAAoB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IACzE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE;QAC7B,KAAK,EAAE,iBAAiB,EAAE;QAC1B,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;YACjF,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,mEAAmE;QACnE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KAChC,EACD,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAC5E,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;AAC3D,CAAC,CAAC;AAEF,8EAA8E;AAC9E,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,+EAA+E,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,MAAqB,EACrB,YAA6B,sBAAsB;IAEnD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAErC,mEAAmE;IACnE,KAAK,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC;YACzE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC,CAAC,iDAAiD,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;QAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS,CAAC,2CAA2C;QAEvF,kEAAkE;QAClE,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAM,GAAa,CAAC,OAAO,eAAe,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,iEAAiE;QACjE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,QAAQ,4DAA4D,CAAC,CAAC;gBACrH,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,yBAAyB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;gBACpI,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;gBAC3C,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC9E,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,gBAAgB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;oBAClC,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;oBAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;oBACvC,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC7D,CAAC;oBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,2DAA2D,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YAC7F,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC7C,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE;gBACpD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;aACrD,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClB,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9E,yEAAyE;YACzE,qEAAqE;YACrE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YACvD,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;YAC1F,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,gBAAgB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;gBACvC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,2DAA2D,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAgB,EAAE,MAAqB;IACnF,IAAI,QAA2D,CAAC;IAChE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,CAAC,iCAAiC;IAC7C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,qCAAqC,QAAQ,CAAC,MAAM,oEAAoE,CAAC,CAAC;QAC1J,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,YAAsB,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpG,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACnG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,eAAe,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAqB;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,QAAQ,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,KAAc,EAAiB,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC;oBAC7C,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtE,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;YACtG,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,GAAG,YAAY,YAAY,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/F,QAAQ,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;gBACtD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxD,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,sCAAuC,SAAmB,CAAC,OAAO,GAAG,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,cAAc,QAAQ,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,wBAAwB,YAAY,0BAA0B,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,eAAgB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/cli/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGrE,SAAS,OAAO,CAAC,KAAqD;IACpE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,6BAA6B,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;IAE/F,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,UAAU,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;QAClE,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;IACjE,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE;YACtC,YAAY,EAAE,CAAC,CAAC,aAAa;YAC7B,YAAY,EAAE,CAAC,CAAC,cAAc;YAC9B,IAAI,EAAE,KAAK;YACX,OAAO;YACP,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;SAClC,CAAC,CAAC;QACH,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,oEAAoE,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;AAElD;;;;;GAKG;AACH,SAAS,iBAAiB;IACxB,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI;YAChB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;YACzE,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,2CAA2C,CAAC,CAAC;YAClE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACtD,OAAO,UAAU,CAAC,CAAC,8DAA8D;QACnF,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO;YAC/B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,kDAAkD,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,OAAO;YACV,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC;AAKD,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAEpD,MAAM,sBAAsB,GAAoB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IACnF,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE;QAC7B,KAAK,EAAE,iBAAiB,EAAE;QAC1B,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,qCAAqC,CAAC,CAAC;YACjF,OAAO,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,mEAAmE;QACnE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KAChC,CAAC;IACF,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;IACzF,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjD,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;AAC3D,CAAC,CAAC;AAEF,8EAA8E;AAC9E,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,+EAA+E,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,MAAqB,EACrB,YAA6B,sBAAsB;IAEnD,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAErC,mEAAmE;IACnE,KAAK,MAAM,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC;YACzE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC,CAAC,iDAAiD,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;QAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS,CAAC,2CAA2C;QAEvF,kEAAkE;QAClE,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAM,GAAa,CAAC,OAAO,eAAe,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,iEAAiE;QACjE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,QAAQ,4DAA4D,CAAC,CAAC;gBACrH,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,yBAAyB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CAAC;gBACpI,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChF,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;gBAC3C,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC9E,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,gBAAgB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;oBAClC,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;oBAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;oBACvC,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC7D,CAAC;oBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,2DAA2D,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YAC7F,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC7C,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE;gBACpD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;aACrD,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClB,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9E,yEAAyE;YACzE,qEAAqE;YACrE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YACvD,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;YAC1F,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,gBAAgB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;gBACvC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,2DAA2D,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAgB,EAAE,MAAqB;IACnF,IAAI,QAA2D,CAAC;IAChE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,CAAC,iCAAiC;IAC7C,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CACvD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,qCAAqC,QAAQ,CAAC,MAAM,oEAAoE,CAAC,CAAC;QAC1J,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,YAAsB,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpG,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACnG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,EAAE,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,oFAAoF,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,uBAAwB,GAAa,CAAC,OAAO,eAAe,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,MAAqB;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAuB;IACnE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,QAAQ,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,KAAc,EAAiB,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;QAC9C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC;oBAC7C,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC,CAAC;gBACH,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtE,OAAO,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,QAAQ,MAAM,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;YACtG,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,GAAG,YAAY,YAAY,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/F,QAAQ,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC,CAAC;gBACtD,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxD,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,OAAO,CAAC,GAAG,CAAC,sCAAuC,SAAmB,CAAC,OAAO,GAAG,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,cAAc,QAAQ,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,wBAAwB,YAAY,0BAA0B,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,eAAgB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAC5B,CAAC"}

package.json

 {
   "name": "@basedagents/keyring",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Scoped, revocable credentials bound to cryptographic agent identities — local-first encrypted vault, identity-bound grants, short-lived leases, signed access log",
@@ -5,0 +5,0 @@ "type": "module",

README.md

@@ -116,2 +116,3 @@ # @basedagents/keyring
 | `based init` | The one-command onboarding: vault + agent identity + MCP config + browser link (see Quick start); `--bare` for vault-only |
+| `based connect <provider>` | Mint a scoped provider key for an agent — browser once to set up provisioning, API-only after (vercel, supabase; `--project <ref>` picks the Supabase project) |
 | `based add <label>` | Add a credential — hidden prompt, stdin, or `--value` |
@@ -118,0 +119,0 @@ | `based update-secret <cred>` | Replace a secret (e.g. after manual rotation); re-seals to owner + active grantees |

New alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 5 instances

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 4 instances

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

1477264

3.67%

Number of package files

177

7.27%

Lines of code

28015

2.36%

Number of lines in readme file

247

0.41%

Worsened metrics

Number of low supply chain risk alerts

39

2.63%

Number of medium supply chain risk alerts

14

7.69%

No dependency changes