@askdb/studio 0.2.0-beta.4 → 0.2.0-beta.41

package/dist/introspection.js

@@ -0,0 +1,106 @@
+import { basename } from "node:path";
+import { getAskDbRuntimeConfig } from "@askdb/config";
+import { connectorPackageMissingMessage, createConnectorRegistry, introspect, } from "@askdb/introspect";
+import { createOptionalDriverLoader, rethrowDriverImportError } from "@askdb/introspect/kit";
+import { postgresConnectorProvider } from "@askdb/postgres";
+import { mysqlConnectorProvider } from "@askdb/mysql";
+import { sqliteConnectorProvider } from "@askdb/sqlite";
+import { sqlServerConnectorProvider } from "@askdb/sqlserver";
+import { PRISMA_BUILD_APPROVALS } from "./prisma-install.js";
+/**
+ * `@askdb/prisma` is an optional peer of Studio, as of `askdb` (#259). It is imported
+ * only when the config selects the prisma engine, from Studio's install first, then
+ * from the project in the working directory. The CLI registers it the same way.
+ */
+const prismaPackage = createOptionalDriverLoader({
+    packageName: "@askdb/prisma",
+    importDriver: () => import("@askdb/prisma").catch(rethrowDriverImportError),
+    missingMessage: connectorPackageMissingMessage({
+        provider: "prisma",
+        packageName: "@askdb/prisma",
+        allowBuilds: PRISMA_BUILD_APPROVALS,
+    }),
+});
+const connectorRegistry = createConnectorRegistry([
+    postgresConnectorProvider,
+    mysqlConnectorProvider,
+    sqliteConnectorProvider,
+    sqlServerConnectorProvider,
+    { provider: "prisma", load: async () => (await prismaPackage.load()).prismaConnectorProvider },
+]);
+/**
+ * Resolve what a server-side introspection run would do, from the runtime
+ * config alone: the config's provider (its adapter loaded), and the connection its adapter's
+ * `resolveConnection` hook resolves (the same registry call the CLI makes).
+ * Never includes credentials in `sourceLabel` — it is shown in the UI.
+ */
+export async function resolveStudioIntrospectionPlan() {
+    const rt = getAskDbRuntimeConfig();
+    const engine = rt.introspection.provider;
+    if (!connectorRegistry.hasProvider(engine)) {
+        return { ok: false, engine: null, error: `Unsupported introspection provider: ${engine}` };
+    }
+    try {
+        // Imports an optional engine package (`@askdb/prisma`); a missing one is the plan's error.
+        await connectorRegistry.load(engine);
+    }
+    catch (error) {
+        return { ok: false, engine, error: error instanceof Error ? error.message : String(error) };
+    }
+    const connection = resolveConnection(engine);
+    if (!connection.ok)
+        return { ok: false, engine, error: connection.error };
+    return { ok: true, engine, sourceLabel: connection.sourceLabel };
+}
+/**
+ * The engine's adapter resolves its connection from askdb.config/env (the same
+ * hook the CLI uses) and phrases missing-config errors in terms of config keys.
+ */
+function resolveConnection(engine) {
+    return connectorRegistry.resolveConnection(engine, {
+        runtime: getAskDbRuntimeConfig(),
+        surface: "studio",
+    });
+}
+/**
+ * Run introspection server-side into `outDir`, preserving any existing
+ * enrichment markdown (the writer keeps `tables/*.md`, `concepts.md`, and
+ * `tenant-policy.md` when `existingArtifactDir` is supplied — the same
+ * guarantee `askdb introspect` gives).
+ */
+export async function runStudioIntrospection(options) {
+    const plan = await resolveStudioIntrospectionPlan();
+    if (!plan.ok)
+        throw new Error(plan.error);
+    const connection = resolveConnection(plan.engine);
+    if (!connection.ok)
+        throw new Error(connection.error);
+    const schemaId = options.schemaId ?? inferSchemaId(options.outDir);
+    // Resync reads the same schema list `askdb introspect` does (introspection.schemas).
+    const schemas = getAskDbRuntimeConfig().introspection.schemas;
+    const connectorConfig = {
+        provider: plan.engine,
+        ...connection.connection,
+        schemaId,
+        ...(schemas ? { filters: { schemas } } : {}),
+    };
+    const runConfig = connectorRegistry.createConnector(connectorConfig);
+    const connector = runConfig.connector;
+    const result = await introspect(runConfig.input, {
+        outDir: options.outDir,
+        schemaId,
+        existingArtifactDir: options.hasExistingArtifact ? options.outDir : undefined,
+    }, { connector });
+    return {
+        engine: plan.engine,
+        schemaId,
+        tables: result.schema.schemas.reduce((sum, namespace) => sum + namespace.tables.length, 0),
+        warnings: result.warnings.map((warning) => typeof warning === "string" ? warning : JSON.stringify(warning)),
+    };
+}
+function inferSchemaId(path) {
+    const name = basename(path);
+    const inferred = name.endsWith(".schema") ? name.slice(0, -".schema".length) : name;
+    return inferred || "introspected";
+}
+//# sourceMappingURL=introspection.js.map

package/dist/introspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.js","sourceRoot":"","sources":["../src/introspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,UAAU,GAMX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,aAAa,GAAG,0BAA0B,CAAC;IAC/C,WAAW,EAAE,eAAe;IAC5B,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC3E,cAAc,EAAE,8BAA8B,CAAC;QAC7C,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE,sBAAsB;KACpC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;IAChD,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,0BAA0B;IAC1B,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,uBAAuB,EAAE;CAC/F,CAAC,CAAC;AAMH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;IAClD,MAAM,EAAE,GAAG,qBAAqB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAwB,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC;IAC9D,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,uCAAuC,MAAM,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC;QACH,2FAA2F;QAC3F,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAA2B;IACpD,OAAO,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,EAAE;QACjD,OAAO,EAAE,qBAAqB,EAAE;QAChC,OAAO,EAAE,QAAQ;KAClB,CAAC,CAAC;AACL,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAI5C;IACC,MAAM,IAAI,GAAG,MAAM,8BAA8B,EAAE,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,qFAAqF;IACrF,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC;IAC9D,MAAM,eAAe,GAAoB;QACvC,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,GAAG,UAAU,CAAC,UAAU;QACxB,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,SAAS,CAAC,SAA+B,CAAC;IAE5D,MAAM,MAAM,GAAqB,MAAM,UAAU,CAC/C,SAAS,CAAC,KAAK,EACf;QACE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ;QACR,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC9E,EACD,EAAE,SAAS,EAAE,CACd,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAChE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,OAAO,QAAQ,IAAI,cAAc,CAAC;AACpC,CAAC"}

package/dist/package-manager.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Package-manager helpers shared by the setup wizard (`setup.ts`) and the
+ * execute-driver install endpoint (`server.ts`).
+ *
+ * Only allowlisted package names ever reach these helpers — never
+ * browser-supplied strings — but {@link packageManagerSpawnSpec} re-checks
+ * every argument anyway because Windows needs `shell: true` (see below).
+ */
+export type PackageManager = "pnpm" | "npm" | "yarn" | "bun";
+/** The package manager implied by a lockfile directly inside `dir`, if any. */
+export declare function lockfilePackageManager(dir: string): PackageManager | null;
+/**
+ * Arguments that add `packages` as dependencies with the given package manager.
+ * `allowBuilds` are dependencies whose install scripts pnpm must be told to run
+ * (`--allow-build=<name>`; pnpm 11 exits 1 on an unapproved one). npm and Yarn
+ * run install scripts, and Bun skips untrusted ones without failing, so only
+ * pnpm gets them.
+ */
+export declare function packageManagerAddArgs(pm: PackageManager, packages: readonly string[], allowBuilds?: readonly string[]): string[];
+/**
+ * The build approvals to pass `pm` in `dir`: `allowBuilds`, or none for a pnpm older
+ * than 10.4.0, whose `add` rejects `--allow-build` (pnpm 9 runs install scripts, and
+ * 10.0 to 10.3 skip unapproved ones without failing). A pnpm whose version can't be
+ * read keeps them. `askdb init` applies the same rule (`apps/cli/src/init.ts`).
+ */
+export declare function supportedBuildApprovals(pm: PackageManager, dir: string, allowBuilds: readonly string[]): string[];
+/** Human-readable install command, e.g. `pnpm add pg`. */
+export declare function formatInstallCommand(pm: PackageManager, packages: readonly string[], allowBuilds?: readonly string[]): string;
+export type PackageManagerSpawnSpec = {
+    command: string;
+    args: string[];
+    shell: boolean;
+};
+/**
+ * How to spawn a package manager on this platform.
+ *
+ * On Windows, package managers are `.cmd` shims, and Node refuses to spawn
+ * `.cmd`/`.bat` files without a shell (EINVAL since Node 18.20.2 / 20.12.2,
+ * CVE-2024-27980). So Windows gets `shell: true` with the bare command name.
+ * Arguments are validated against a strict allowlist pattern first, so the
+ * shell never sees anything it could interpret.
+ */
+export declare function packageManagerSpawnSpec(pm: PackageManager, args: readonly string[], platform?: NodeJS.Platform): PackageManagerSpawnSpec;
+//# sourceMappingURL=package-manager.d.ts.map

package/dist/package-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.d.ts","sourceRoot":"","sources":["../src/package-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7D,+EAA+E;AAC/E,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,cAAc,EAClB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,WAAW,GAAE,SAAS,MAAM,EAAO,GAClC,MAAM,EAAE,CAIV;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAMjH;AAQD,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,cAAc,EAClB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,WAAW,GAAE,SAAS,MAAM,EAAO,GAClC,MAAM,CAER;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAQF;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,cAAc,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,uBAAuB,CAUzB"}

package/dist/package-manager.js

@@ -0,0 +1,86 @@
+/**
+ * Package-manager helpers shared by the setup wizard (`setup.ts`) and the
+ * execute-driver install endpoint (`server.ts`).
+ *
+ * Only allowlisted package names ever reach these helpers — never
+ * browser-supplied strings — but {@link packageManagerSpawnSpec} re-checks
+ * every argument anyway because Windows needs `shell: true` (see below).
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+/** The package manager implied by a lockfile directly inside `dir`, if any. */
+export function lockfilePackageManager(dir) {
+    if (existsSync(join(dir, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(join(dir, "bun.lockb")) || existsSync(join(dir, "bun.lock")))
+        return "bun";
+    if (existsSync(join(dir, "yarn.lock")))
+        return "yarn";
+    if (existsSync(join(dir, "package-lock.json")))
+        return "npm";
+    return null;
+}
+/**
+ * Arguments that add `packages` as dependencies with the given package manager.
+ * `allowBuilds` are dependencies whose install scripts pnpm must be told to run
+ * (`--allow-build=<name>`; pnpm 11 exits 1 on an unapproved one). npm and Yarn
+ * run install scripts, and Bun skips untrusted ones without failing, so only
+ * pnpm gets them.
+ */
+export function packageManagerAddArgs(pm, packages, allowBuilds = []) {
+    if (pm === "npm")
+        return ["install", "--save", ...packages];
+    if (pm === "pnpm")
+        return ["add", ...allowBuilds.map((name) => `--allow-build=${name}`), ...packages];
+    return ["add", ...packages];
+}
+/**
+ * The build approvals to pass `pm` in `dir`: `allowBuilds`, or none for a pnpm older
+ * than 10.4.0, whose `add` rejects `--allow-build` (pnpm 9 runs install scripts, and
+ * 10.0 to 10.3 skip unapproved ones without failing). A pnpm whose version can't be
+ * read keeps them. `askdb init` applies the same rule (`apps/cli/src/init.ts`).
+ */
+export function supportedBuildApprovals(pm, dir, allowBuilds) {
+    if (pm !== "pnpm" || allowBuilds.length === 0)
+        return [...allowBuilds];
+    const match = /^(\d+)\.(\d+)\./.exec(pnpmVersion(dir) ?? "");
+    if (!match)
+        return [...allowBuilds];
+    const [major, minor] = [Number(match[1]), Number(match[2])];
+    return major > 10 || (major === 10 && minor >= 4) ? [...allowBuilds] : [];
+}
+function pnpmVersion(dir) {
+    const { command, args, shell } = packageManagerSpawnSpec("pnpm", ["--version"]);
+    const result = spawnSync(command, args, { cwd: dir, encoding: "utf8", shell, stdio: ["ignore", "pipe", "ignore"], timeout: 15_000 });
+    return result.status === 0 ? result.stdout.trim() : null;
+}
+/** Human-readable install command, e.g. `pnpm add pg`. */
+export function formatInstallCommand(pm, packages, allowBuilds = []) {
+    return [pm, ...packageManagerAddArgs(pm, packages, allowBuilds)].join(" ");
+}
+// npm package names (optionally scoped, optionally with a version/range suffix),
+// simple `--flag` arguments, and pnpm's `--allow-build=<package name>`. Nothing a
+// shell would interpret.
+const SAFE_ARG = /^(?:--[a-z][a-z-]*|--allow-build=(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*|(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*(?:@[a-z0-9.^~<>=*_-]+)?|add|install)$/i;
+/**
+ * How to spawn a package manager on this platform.
+ *
+ * On Windows, package managers are `.cmd` shims, and Node refuses to spawn
+ * `.cmd`/`.bat` files without a shell (EINVAL since Node 18.20.2 / 20.12.2,
+ * CVE-2024-27980). So Windows gets `shell: true` with the bare command name.
+ * Arguments are validated against a strict allowlist pattern first, so the
+ * shell never sees anything it could interpret.
+ */
+export function packageManagerSpawnSpec(pm, args, platform = process.platform) {
+    for (const arg of args) {
+        if (!SAFE_ARG.test(arg)) {
+            throw new Error(`Refusing to pass unsafe argument to ${pm}: ${JSON.stringify(arg)}`);
+        }
+    }
+    if (platform === "win32") {
+        return { command: pm, args: [...args], shell: true };
+    }
+    return { command: pm, args: [...args], shell: false };
+}
+//# sourceMappingURL=package-manager.js.map

package/dist/package-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-manager.js","sourceRoot":"","sources":["../src/package-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAkB,EAClB,QAA2B,EAC3B,cAAiC,EAAE;IAEnC,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC5D,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC;IACtG,OAAO,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAkB,EAAE,GAAW,EAAE,WAA8B;IACrG,IAAI,EAAE,KAAK,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,KAAK,GAAG,EAAE,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,uBAAuB,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACrI,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,oBAAoB,CAClC,EAAkB,EAClB,QAA2B,EAC3B,cAAiC,EAAE;IAEnC,OAAO,CAAC,EAAE,EAAE,GAAG,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7E,CAAC;AAQD,iFAAiF;AACjF,kFAAkF;AAClF,yBAAyB;AACzB,MAAM,QAAQ,GACZ,2KAA2K,CAAC;AAE9K;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAkB,EAClB,IAAuB,EACvB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC"}

package/dist/prisma-install.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The builds pnpm must approve to install `@askdb/prisma`, an optional peer (#259):
+ * `@prisma/engines` has a postinstall script, and pnpm 11 exits 1 on an unapproved one.
+ * Read by guided setup's install plan and the introspection plan's missing-package hint, so the two stay in step. `askdb init`'s copy is `apps/cli/src/prisma-install.ts`.
+ */
+export declare const PRISMA_BUILD_APPROVALS: readonly string[];
+//# sourceMappingURL=prisma-install.d.ts.map

package/dist/prisma-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-install.d.ts","sourceRoot":"","sources":["../src/prisma-install.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAwB,CAAC"}

package/dist/prisma-install.js

@@ -0,0 +1,7 @@
+/**
+ * The builds pnpm must approve to install `@askdb/prisma`, an optional peer (#259):
+ * `@prisma/engines` has a postinstall script, and pnpm 11 exits 1 on an unapproved one.
+ * Read by guided setup's install plan and the introspection plan's missing-package hint, so the two stay in step. `askdb init`'s copy is `apps/cli/src/prisma-install.ts`.
+ */
+export const PRISMA_BUILD_APPROVALS = ["@prisma/engines"];
+//# sourceMappingURL=prisma-install.js.map

package/dist/prisma-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-install.js","sourceRoot":"","sources":["../src/prisma-install.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/request-guard.d.ts

@@ -0,0 +1,44 @@
+import type { IncomingMessage } from "node:http";
+/**
+ * Request guard for the Studio local server.
+ *
+ * Studio's API can execute SQL against the configured database and write
+ * schema files, so it must not be drivable by arbitrary web pages the
+ * developer happens to visit. Three layers, applied before routing:
+ *
+ * 1. Host allowlist (every request, including static assets) — defeats DNS
+ *    rebinding: a page on `evil.example` that rebinds to 127.0.0.1 still sends
+ *    `Host: evil.example:<port>`.
+ * 2. Origin + content-type checks on state-changing `/api/*` requests —
+ *    cross-site `fetch`/form posts carry a foreign `Origin`, and requiring
+ *    `application/json` forces a CORS preflight that Studio never answers.
+ * 3. A per-launch random session token, embedded in the served `index.html`
+ *    and required on every `/api/*` request as `x-askdb-studio-token`. A
+ *    cross-origin page can't read `index.html`, so it can't learn the token.
+ */
+export declare const STUDIO_TOKEN_HEADER = "x-askdb-studio-token";
+export declare const STUDIO_TOKEN_META_NAME = "askdb-studio-token";
+export type GuardFailure = {
+    status: 403 | 415;
+    message: string;
+};
+export declare function createStudioSessionToken(): string;
+/** Hosts that mean "listen on every interface". */
+export declare function isWildcardHost(host: string | undefined): boolean;
+/** True for hosts only reachable from this machine. */
+export declare function isLoopbackHost(host: string | undefined): boolean;
+/**
+ * Host allowlist. Accepts `localhost`, `127.0.0.1`, `[::1]`, and the explicitly
+ * configured listen host (or, for wildcard binds, this machine's interface
+ * addresses) — and only on the port the connection actually arrived on.
+ */
+export declare function checkHost(req: IncomingMessage, listenHost: string | undefined): GuardFailure | null;
+/**
+ * `/api/*` checks: same-origin `Origin` on state-changing requests, the
+ * per-launch session token, and a JSON content type on requests with a body.
+ * Call after {@link checkHost} has passed.
+ */
+export declare function checkApiRequest(req: IncomingMessage, sessionToken: string): GuardFailure | null;
+/** Insert the session-token `<meta>` tag into the served `index.html`. */
+export declare function injectSessionToken(html: string, sessionToken: string): string;
+//# sourceMappingURL=request-guard.d.ts.map

package/dist/request-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-guard.d.ts","sourceRoot":"","sources":["../src/request-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGjD;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAC1D,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAIhE;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAShE;AAgDD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAenG;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA2B/F;AA4BD,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAG7E"}

package/dist/request-guard.js

@@ -0,0 +1,170 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { networkInterfaces } from "node:os";
+/**
+ * Request guard for the Studio local server.
+ *
+ * Studio's API can execute SQL against the configured database and write
+ * schema files, so it must not be drivable by arbitrary web pages the
+ * developer happens to visit. Three layers, applied before routing:
+ *
+ * 1. Host allowlist (every request, including static assets) — defeats DNS
+ *    rebinding: a page on `evil.example` that rebinds to 127.0.0.1 still sends
+ *    `Host: evil.example:<port>`.
+ * 2. Origin + content-type checks on state-changing `/api/*` requests —
+ *    cross-site `fetch`/form posts carry a foreign `Origin`, and requiring
+ *    `application/json` forces a CORS preflight that Studio never answers.
+ * 3. A per-launch random session token, embedded in the served `index.html`
+ *    and required on every `/api/*` request as `x-askdb-studio-token`. A
+ *    cross-origin page can't read `index.html`, so it can't learn the token.
+ */
+export const STUDIO_TOKEN_HEADER = "x-askdb-studio-token";
+export const STUDIO_TOKEN_META_NAME = "askdb-studio-token";
+export function createStudioSessionToken() {
+    return randomBytes(32).toString("hex");
+}
+/** Hosts that mean "listen on every interface". */
+export function isWildcardHost(host) {
+    if (host === undefined)
+        return false;
+    const h = host.trim().toLowerCase();
+    return h === "" || h === "0.0.0.0" || h === "::" || h === "[::]";
+}
+/** True for hosts only reachable from this machine. */
+export function isLoopbackHost(host) {
+    if (host === undefined)
+        return true;
+    const h = host.trim().toLowerCase();
+    return (h === "localhost" ||
+        h === "::1" ||
+        h === "[::1]" ||
+        /^127(?:\.\d{1,3}){3}$/.test(h));
+}
+// A Host header is `hostname[:port]` — nothing else. Rejecting userinfo, paths,
+// and whitespace up front matters because `new URL("http://" + host)` would
+// happily parse `evil@127.0.0.1` as hostname 127.0.0.1.
+const HOST_HEADER_PATTERN = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Parse a Host header into its normalized `hostname` / `host` / numeric port. */
+function parseHostHeader(value) {
+    if (!HOST_HEADER_PATTERN.test(value))
+        return null;
+    try {
+        const url = new URL(`http://${value}`);
+        return { hostname: url.hostname, host: url.host, port: url.port === "" ? 80 : Number(url.port) };
+    }
+    catch {
+        return null;
+    }
+}
+/** Normalize a bare host/IP the same way `URL` normalizes a Host header's hostname. */
+function normalizeHostname(host) {
+    const trimmed = host.trim();
+    if (trimmed === "")
+        return null;
+    const bracketed = trimmed.includes(":") && !trimmed.startsWith("[") ? `[${trimmed}]` : trimmed;
+    try {
+        return new URL(`http://${bracketed}`).hostname;
+    }
+    catch {
+        return null;
+    }
+}
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+function isAllowedHostname(hostname, listenHost) {
+    if (LOOPBACK_HOSTNAMES.has(hostname))
+        return true;
+    if (listenHost === undefined)
+        return false;
+    if (isWildcardHost(listenHost)) {
+        // Bound to every interface: accept this machine's own interface addresses
+        // (e.g. the LAN IP the CLI prints). IP literals can't be DNS-rebound.
+        for (const entries of Object.values(networkInterfaces())) {
+            for (const entry of entries ?? []) {
+                if (normalizeHostname(entry.address) === hostname)
+                    return true;
+            }
+        }
+        return false;
+    }
+    return normalizeHostname(listenHost) === hostname;
+}
+/**
+ * Host allowlist. Accepts `localhost`, `127.0.0.1`, `[::1]`, and the explicitly
+ * configured listen host (or, for wildcard binds, this machine's interface
+ * addresses) — and only on the port the connection actually arrived on.
+ */
+export function checkHost(req, listenHost) {
+    const raw = req.headers.host;
+    const parsed = typeof raw === "string" ? parseHostHeader(raw) : null;
+    if (!parsed ||
+        parsed.port !== req.socket.localPort ||
+        !isAllowedHostname(parsed.hostname, listenHost)) {
+        return {
+            status: 403,
+            message: "Studio rejected this request: unrecognized Host header. Open Studio via http://127.0.0.1:<port> or http://localhost:<port>.",
+        };
+    }
+    return null;
+}
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+/**
+ * `/api/*` checks: same-origin `Origin` on state-changing requests, the
+ * per-launch session token, and a JSON content type on requests with a body.
+ * Call after {@link checkHost} has passed.
+ */
+export function checkApiRequest(req, sessionToken) {
+    const method = (req.method ?? "GET").toUpperCase();
+    if (!SAFE_METHODS.has(method)) {
+        const origin = req.headers.origin;
+        if (origin !== undefined && !isSameOrigin(origin, req.headers.host)) {
+            return { status: 403, message: "Studio rejected this request: cross-origin requests are not allowed." };
+        }
+    }
+    if (!tokenMatches(req.headers[STUDIO_TOKEN_HEADER], sessionToken)) {
+        return {
+            status: 403,
+            message: "Studio rejected this request: missing or invalid session token. Reload Studio in the browser (the token changes every launch).",
+        };
+    }
+    if (!SAFE_METHODS.has(method) && (method !== "DELETE" || hasRequestBody(req))) {
+        const contentType = req.headers["content-type"];
+        const mediaType = typeof contentType === "string" ? contentType.split(";")[0].trim().toLowerCase() : "";
+        if (mediaType !== "application/json") {
+            return { status: 415, message: "Studio API requests must use Content-Type: application/json." };
+        }
+    }
+    return null;
+}
+function isSameOrigin(origin, hostHeader) {
+    if (typeof origin !== "string" || typeof hostHeader !== "string")
+        return false;
+    const host = parseHostHeader(hostHeader);
+    if (!host)
+        return false;
+    try {
+        const url = new URL(origin);
+        return url.protocol === "http:" && url.host === host.host;
+    }
+    catch {
+        // Includes `Origin: null` (sandboxed iframes, file://, some redirects).
+        return false;
+    }
+}
+function tokenMatches(provided, expected) {
+    if (typeof provided !== "string")
+        return false;
+    const a = Buffer.from(provided, "utf8");
+    const b = Buffer.from(expected, "utf8");
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function hasRequestBody(req) {
+    const length = req.headers["content-length"];
+    if (length !== undefined && Number(length) > 0)
+        return true;
+    return req.headers["transfer-encoding"] !== undefined;
+}
+/** Insert the session-token `<meta>` tag into the served `index.html`. */
+export function injectSessionToken(html, sessionToken) {
+    const tag = `<meta name="${STUDIO_TOKEN_META_NAME}" content="${sessionToken}" />`;
+    return html.includes("</head>") ? html.replace("</head>", `    ${tag}\n  </head>`) : `${tag}\n${html}`;
+}
+//# sourceMappingURL=request-guard.js.map

package/dist/request-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-guard.js","sourceRoot":"","sources":["../src/request-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAI3D,MAAM,UAAU,wBAAwB;IACtC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,CAAC;AACnE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,CACL,CAAC,KAAK,WAAW;QACjB,CAAC,KAAK,KAAK;QACX,CAAC,KAAK,OAAO;QACb,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,iDAAiD,CAAC;AAE9E,kFAAkF;AAClF,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/F,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE,SAAS,iBAAiB,CAAC,QAAgB,EAAE,UAA8B;IACzE,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,sEAAsE;QACtE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACzD,KAAK,MAAM,KAAK,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;gBAClC,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,UAA8B;IAC5E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS;QACpC,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC/C,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EACL,6HAA6H;SAChI,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAoB,EAAE,YAAoB;IACxE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,sEAAsE,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,OAAO,EACL,gIAAgI;SACnI,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;YACrC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;QAClG,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,MAAyB,EAAE,UAA8B;IAC7E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/E,MAAM,IAAI,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAuC,EAAE,QAAgB;IAC7E,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,YAAoB;IACnE,MAAM,GAAG,GAAG,eAAe,sBAAsB,cAAc,YAAY,MAAM,CAAC;IAClF,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,IAAI,EAAE,CAAC;AACzG,CAAC"}

package/dist/server.d.ts

@@ -1,14 +1,32 @@
-import { createServer } from "node:http";
-import { createPgvectorStore } from "@askdb/rag/stores/pgvector";
+import { type Server } from "node:http";
+import { createPgvectorStore } from "@askdb/rag";
 import { type Workspace } from "@askdb/enrich";
-import type { StudioWorkspaceDto } from "./shared/api.js";
+import type { SetupReason, StudioWorkspaceDto } from "./shared/api.js";
+/** @internal Tests only — serve client assets from another directory. */
+export declare function setStudioClientDirForTests(dir: string | undefined): void;
 export type StudioOptions = {
     schema: string;
     host?: string;
     port?: number;
+    /**
+     * Start in setup mode instead of failing: `"no-config"` when no
+     * `askdb.config.*` was found, `"no-artifact"` when the config exists but the
+     * schema artifact hasn't been introspected yet. The browser wizard walks the
+     * user through the missing steps and flips the server to ready.
+     */
+    setupReason?: SetupReason | null;
+};
+export type StudioServer = Server & {
+    /**
+     * Per-launch session token. Every `/api/*` request must send it as the
+     * `x-askdb-studio-token` header; the browser app reads it from a `<meta>`
+     * tag injected into the served `index.html`.
+     */
+    readonly sessionToken: string;
 };
-export type StudioServer = ReturnType<typeof createServer>;
 export declare function setStudioPgvectorStoreFactoryForTests(factory: typeof createPgvectorStore | undefined): void;
 export declare function createStudioServer(options: StudioOptions): StudioServer;
 export declare function serializeWorkspace(workspace: Workspace): StudioWorkspaceDto;
+/** Largest JSON request body Studio accepts. */
+export declare const MAX_JSON_BODY_BYTES: number;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAmCpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAYL,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAOV,kBAAkB,EAEnB,MAAM,iBAAiB,CAAC;AAIzB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AAyD3D,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,OAAO,mBAAmB,GAAG,SAAS,GAC9C,IAAI,CAEN;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAkEvE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,kBAAkB,CAuC3E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAyCjG,OAAO,EAQL,mBAAmB,EAUpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAcL,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAYV,WAAW,EAKX,kBAAkB,EAGnB,MAAM,iBAAiB,CAAC;AA+BzB,yEAAyE;AACzE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAExE;AAMD,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG;IAClC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAsEF,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,OAAO,mBAAmB,GAAG,SAAS,GAC9C,IAAI,CAEN;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAuKvE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,kBAAkB,CA+C3E;AAwsDD,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,QAAc,CAAC"}