@dotdo/postgres 0.1.0

package/dist/readonly/worker.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Read-Only Worker Entry Point
+ *
+ * Cloudflare Worker that serves read-only database requests.
+ * Uses cache-first read path for FREE caching!
+ *
+ * Security guarantees:
+ * - IMPOSSIBLE to write in read-only mode
+ * - SQL parsing to reject INSERT/UPDATE/DELETE
+ * - Worker reads directly from R2 + Cache
+ */
+/**
+ * Environment bindings for the Read-Only Worker
+ */
+export interface ReadOnlyWorkerEnv {
+    /** R2 bucket containing database files */
+    DATABASE_BUCKET: R2Bucket;
+    /** Optional cache binding (uses caches.default if not provided) */
+    CACHE?: Cache;
+    /** Path to the database file in R2 (optional, can be in config) */
+    DATABASE_PATH?: string;
+    /** Cache TTL in seconds (optional) */
+    CACHE_TTL?: string;
+    /** R2 prefix for database files */
+    R2_PREFIX?: string;
+}
+/**
+ * R2 Bucket interface (minimal subset we need)
+ */
+interface R2Bucket {
+    get(key: string): Promise<R2Object | null>;
+    head(key: string): Promise<R2ObjectBody | null>;
+}
+/**
+ * R2 Object interface
+ */
+interface R2Object {
+    body: ReadableStream;
+    arrayBuffer(): Promise<ArrayBuffer>;
+    size: number;
+    etag: string;
+}
+/**
+ * R2 Object body interface
+ */
+interface R2ObjectBody {
+    key: string;
+    size: number;
+}
+/**
+ * Configuration for the Read-Only Worker
+ */
+export interface ReadOnlyWorkerConfig {
+    /** Path to the database file in R2 */
+    databasePath: string;
+    /** R2 prefix for database files (optional) */
+    r2Prefix?: string;
+    /** Whether caching is enabled (default: true) */
+    cacheEnabled?: boolean;
+    /** Cache TTL in seconds (default: 300) */
+    cacheTtlSeconds?: number;
+    /** Use stale-while-revalidate (default: true) */
+    useStale?: boolean;
+}
+/**
+ * Minimal PGLite interface we need
+ */
+export interface PGLiteInterface {
+    query<T = unknown>(sql: string, params?: unknown[], options?: unknown): Promise<{
+        rows: T[];
+        fields?: unknown[];
+        affectedRows?: number;
+    }>;
+    exec(sql: string): Promise<Array<{
+        rows: unknown[];
+        fields?: unknown[];
+    }>>;
+    close(): Promise<void>;
+}
+/**
+ * Read-Only Worker class
+ *
+ * Handles HTTP requests for read-only database access.
+ */
+export declare class ReadOnlyWorker {
+    private readonly pglite;
+    private readonly config;
+    /** @internal Reserved for future read-only enforcement */
+    private readonly _readOnlyConfig;
+    constructor(pglite: PGLiteInterface, config: ReadOnlyWorkerConfig);
+    /**
+     * Execute a query with read-only protection.
+     *
+     * @param sql - The SQL query to execute
+     * @param params - Optional query parameters
+     * @returns The query result
+     * @throws WriteBlockedError if the query is a write operation
+     */
+    handleQuery<T = unknown>(sql: string, params?: unknown[]): Promise<{
+        rows: T[];
+        fields?: unknown[];
+        affectedRows?: number;
+    }>;
+    /**
+     * Handle an HTTP request.
+     *
+     * @param request - The incoming HTTP request
+     * @returns The HTTP response
+     */
+    handleRequest(request: Request): Promise<Response>;
+    /**
+     * Handle a query request.
+     */
+    private handleQueryRequest;
+    /**
+     * Create an error response.
+     */
+    private createErrorResponse;
+    /**
+     * Close the underlying PGLite instance.
+     */
+    close(): Promise<void>;
+}
+/**
+ * Create a Read-Only Worker instance.
+ *
+ * @param pglite - The PGLite instance to wrap
+ * @param config - Worker configuration
+ * @returns A Read-Only Worker instance
+ */
+export declare function createReadOnlyWorker(pglite: PGLiteInterface, config: ReadOnlyWorkerConfig): ReadOnlyWorker;
+/**
+ * Convenience function for handling a single request.
+ *
+ * @param request - The incoming HTTP request
+ * @param pglite - The PGLite instance to use
+ * @param config - Worker configuration
+ * @returns The HTTP response
+ */
+export declare function handleReadOnlyRequest(request: Request, pglite: PGLiteInterface, config: ReadOnlyWorkerConfig): Promise<Response>;
+export {};
+//# sourceMappingURL=worker.d.ts.map

package/dist/readonly/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/readonly/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,eAAe,EAAE,QAAQ,CAAA;IACzB,mEAAmE;IACnE,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,UAAU,QAAQ;IAChB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAC1C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;CAChD;AAED;;GAEG;AACH,UAAU,QAAQ;IAChB,IAAI,EAAE,cAAc,CAAA;IACpB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAA;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,UAAU,YAAY;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,0CAA0C;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,EAClB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC,CAAA;IAC1E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AA6BD;;;;GAIG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAgB;gBAEpC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB;IAejE;;;;;;;OAOG;IACG,WAAW,CAAC,CAAC,GAAG,OAAO,EAC3B,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAUpE;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAsDxD;;OAEG;YACW,kBAAkB;IA+ChC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA6B3B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CAEhB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAGnB"}

package/dist/readonly/worker.js

@@ -0,0 +1,187 @@
+/**
+ * Read-Only Worker Entry Point
+ *
+ * Cloudflare Worker that serves read-only database requests.
+ * Uses cache-first read path for FREE caching!
+ *
+ * Security guarantees:
+ * - IMPOSSIBLE to write in read-only mode
+ * - SQL parsing to reject INSERT/UPDATE/DELETE
+ * - Worker reads directly from R2 + Cache
+ */
+import { createReadOnlyConfig } from './config';
+import { isWriteQuery, WriteBlockedError } from './write-blocker';
+/**
+ * Read-Only Worker class
+ *
+ * Handles HTTP requests for read-only database access.
+ */
+export class ReadOnlyWorker {
+    pglite;
+    config;
+    /** @internal Reserved for future read-only enforcement */
+    _readOnlyConfig;
+    constructor(pglite, config) {
+        this.pglite = pglite;
+        this.config = config;
+        this._readOnlyConfig = createReadOnlyConfig({
+            enabled: true,
+            onWriteAttempt: 'throw',
+            cache: {
+                enabled: config.cacheEnabled ?? true,
+                ttlSeconds: config.cacheTtlSeconds ?? 300,
+                useStale: config.useStale ?? true,
+            },
+        });
+        void this._readOnlyConfig; // Reserved for future read-only enforcement
+    }
+    /**
+     * Execute a query with read-only protection.
+     *
+     * @param sql - The SQL query to execute
+     * @param params - Optional query parameters
+     * @returns The query result
+     * @throws WriteBlockedError if the query is a write operation
+     */
+    async handleQuery(sql, params) {
+        // Check if this is a write query
+        if (isWriteQuery(sql)) {
+            throw new WriteBlockedError(sql);
+        }
+        // Execute the query
+        return this.pglite.query(sql, params, undefined);
+    }
+    /**
+     * Handle an HTTP request.
+     *
+     * @param request - The incoming HTTP request
+     * @returns The HTTP response
+     */
+    async handleRequest(request) {
+        const url = new URL(request.url);
+        const path = url.pathname;
+        // Common headers for all responses
+        const headers = {
+            'Content-Type': 'application/json',
+            'X-Read-Only': 'true',
+        };
+        try {
+            // Health check endpoint
+            if (path === '/health' && request.method === 'GET') {
+                return new Response(JSON.stringify({
+                    status: 'ok',
+                    mode: 'read-only',
+                    database: this.config.databasePath,
+                }), { status: 200, headers });
+            }
+            // Query endpoint
+            if (path === '/query') {
+                if (request.method !== 'POST') {
+                    return new Response(JSON.stringify({
+                        error: true,
+                        code: 'METHOD_NOT_ALLOWED',
+                        message: 'Only POST method is allowed for /query',
+                    }), { status: 405, headers });
+                }
+                return await this.handleQueryRequest(request, headers);
+            }
+            // 404 for unknown routes
+            return new Response(JSON.stringify({
+                error: true,
+                code: 'NOT_FOUND',
+                message: `Route ${path} not found`,
+            }), { status: 404, headers });
+        }
+        catch (error) {
+            // Handle unexpected errors
+            return this.createErrorResponse(error, headers);
+        }
+    }
+    /**
+     * Handle a query request.
+     */
+    async handleQueryRequest(request, headers) {
+        // Parse request body
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return new Response(JSON.stringify({
+                error: true,
+                code: 'INVALID_JSON',
+                message: 'Invalid JSON in request body',
+            }), { status: 400, headers });
+        }
+        // Validate request
+        if (!body.sql || typeof body.sql !== 'string') {
+            return new Response(JSON.stringify({
+                error: true,
+                code: 'INVALID_REQUEST',
+                message: 'Missing or invalid sql field in request',
+            }), { status: 400, headers });
+        }
+        // Execute query
+        try {
+            const result = await this.handleQuery(body.sql, body.params);
+            return new Response(JSON.stringify({
+                rows: result.rows,
+                fields: result.fields,
+                affectedRows: result.affectedRows,
+            }), { status: 200, headers });
+        }
+        catch (error) {
+            return this.createErrorResponse(error, headers);
+        }
+    }
+    /**
+     * Create an error response.
+     */
+    createErrorResponse(error, headers) {
+        if (error instanceof WriteBlockedError) {
+            return new Response(JSON.stringify({
+                error: true,
+                code: error.code,
+                message: error.message,
+                details: {
+                    blockedQuery: error.query.substring(0, 100),
+                },
+            }), { status: 400, headers });
+        }
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        return new Response(JSON.stringify({
+            error: true,
+            code: 'INTERNAL_ERROR',
+            message,
+        }), { status: 500, headers });
+    }
+    /**
+     * Close the underlying PGLite instance.
+     */
+    async close() {
+        return this.pglite.close();
+    }
+}
+/**
+ * Create a Read-Only Worker instance.
+ *
+ * @param pglite - The PGLite instance to wrap
+ * @param config - Worker configuration
+ * @returns A Read-Only Worker instance
+ */
+export function createReadOnlyWorker(pglite, config) {
+    return new ReadOnlyWorker(pglite, config);
+}
+/**
+ * Convenience function for handling a single request.
+ *
+ * @param request - The incoming HTTP request
+ * @param pglite - The PGLite instance to use
+ * @param config - Worker configuration
+ * @returns The HTTP response
+ */
+export async function handleReadOnlyRequest(request, pglite, config) {
+    const worker = new ReadOnlyWorker(pglite, config);
+    return worker.handleRequest(request);
+}
+//# sourceMappingURL=worker.js.map

package/dist/readonly/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/readonly/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAoGjE;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACR,MAAM,CAAiB;IACvB,MAAM,CAAsB;IAC7C,0DAA0D;IACzC,eAAe,CAAgB;IAEhD,YAAY,MAAuB,EAAE,MAA4B;QAC/D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,eAAe,GAAG,oBAAoB,CAAC;YAC1C,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,OAAO;YACvB,KAAK,EAAE;gBACL,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;gBACpC,UAAU,EAAE,MAAM,CAAC,eAAe,IAAI,GAAG;gBACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;aAClC;SACF,CAAC,CAAA;QACF,KAAK,IAAI,CAAC,eAAe,CAAA,CAAC,4CAA4C;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CACf,GAAW,EACX,MAAkB;QAElB,iCAAiC;QACjC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;QAED,oBAAoB;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgB;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;QAEzB,mCAAmC;QACnC,MAAM,OAAO,GAAG;YACd,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,MAAM;SACtB,CAAA;QAED,IAAI,CAAC;YACH,wBAAwB;YACxB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACnD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;oBACb,MAAM,EAAE,IAAI;oBACZ,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;iBACnC,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAA;YACH,CAAC;YAED,iBAAiB;YACjB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC9B,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;wBACb,KAAK,EAAE,IAAI;wBACX,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,wCAAwC;qBAC7B,CAAC,EACvB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAA;gBACH,CAAC;gBAED,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACxD,CAAC;YAED,yBAAyB;YACzB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,SAAS,IAAI,YAAY;aACd,CAAC,EACvB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,2BAA2B;YAC3B,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAC9B,OAAgB,EAChB,OAA+B;QAE/B,qBAAqB;QACrB,IAAI,IAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,8BAA8B;aACnB,CAAC,EACvB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAA;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,yCAAyC;aAC9B,CAAC,EACvB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAA;QACH,CAAC;QAED,gBAAgB;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YAC5D,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;aACb,CAAC,EACvB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,KAAc,EACd,OAA+B;QAE/B,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACvC,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE;oBACP,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;iBAC5C;aACmB,CAAC,EACvB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;QACxE,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,gBAAgB;YACtB,OAAO;SACa,CAAC,EACvB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAA;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IAC5B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAuB,EACvB,MAA4B;IAE5B,OAAO,IAAI,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,MAAuB,EACvB,MAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjD,OAAO,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;AACtC,CAAC"}

package/dist/readonly/write-blocker.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Write Blocking Middleware
+ *
+ * Rejects all write operations in read-only deployment mode.
+ * Security feature to ensure writes are impossible.
+ */
+import type { ReadOnlyConfig } from './config';
+/**
+ * SQL patterns that indicate a write operation.
+ * These patterns are case-insensitive and match at the start of a query
+ * (after trimming whitespace).
+ *
+ * SECURITY: This list must be exhaustive to prevent ANY data modification.
+ */
+export declare const SQL_WRITE_PATTERNS: RegExp[];
+/**
+ * Check if a SQL query is a write operation.
+ *
+ * @param sql - The SQL query to check
+ * @returns true if the query would modify data
+ */
+export declare function isWriteQuery(sql: string): boolean;
+/**
+ * Error thrown when a write operation is blocked in read-only mode.
+ */
+export declare class WriteBlockedError extends Error {
+    /** The blocked SQL query */
+    readonly query: string;
+    /** PostgreSQL SQLSTATE code for read-only transaction */
+    readonly code: string;
+    /** Error name */
+    readonly name: string;
+    constructor(query: string);
+}
+/**
+ * Write blocker function type.
+ * Returns the query if allowed, null if ignored, or throws if blocked.
+ */
+export type WriteBlockerFn = (sql: string) => string | null;
+/**
+ * Create a write blocker function based on configuration.
+ *
+ * @param config - Read-only configuration
+ * @returns A function that checks and potentially blocks write queries
+ */
+export declare function createWriteBlocker(config: ReadOnlyConfig): WriteBlockerFn;
+//# sourceMappingURL=write-blocker.d.ts.map

package/dist/readonly/write-blocker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-blocker.d.ts","sourceRoot":"","sources":["../../src/readonly/write-blocker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,EAyEtC,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAcjD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IAEtB,yDAAyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAU;IAE/B,iBAAiB;IACjB,SAAkB,IAAI,EAAE,MAAM,CAAsB;gBAExC,KAAK,EAAE,MAAM;CAI1B;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;AAE3D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CA8BzE"}

package/dist/readonly/write-blocker.js

@@ -0,0 +1,136 @@
+/**
+ * Write Blocking Middleware
+ *
+ * Rejects all write operations in read-only deployment mode.
+ * Security feature to ensure writes are impossible.
+ */
+/**
+ * SQL patterns that indicate a write operation.
+ * These patterns are case-insensitive and match at the start of a query
+ * (after trimming whitespace).
+ *
+ * SECURITY: This list must be exhaustive to prevent ANY data modification.
+ */
+export const SQL_WRITE_PATTERNS = [
+    // DML write operations
+    /^\s*INSERT\s+INTO\b/i,
+    /^\s*INSERT\s+/i, // Some dialects allow INSERT without INTO
+    /^\s*UPDATE\s+/i,
+    /^\s*DELETE\s+FROM\b/i,
+    /^\s*DELETE\s+/i, // DELETE without FROM (e.g., DELETE users WHERE...)
+    /^\s*MERGE\s+/i, // SQL MERGE (upsert) statement
+    // DDL operations
+    /^\s*CREATE\s+/i,
+    /^\s*ALTER\s+/i,
+    /^\s*DROP\s+/i,
+    /^\s*TRUNCATE\s+/i,
+    /^\s*COMMENT\s+ON\b/i, // COMMENT ON TABLE/COLUMN modifies metadata
+    /^\s*RENAME\s+/i, // PostgreSQL RENAME
+    // Permission changes
+    /^\s*GRANT\s+/i,
+    /^\s*REVOKE\s+/i,
+    // Maintenance operations that modify data
+    /^\s*VACUUM\b/i,
+    /^\s*REINDEX\s+/i,
+    /^\s*CLUSTER\s+/i, // CLUSTER rewrites table data
+    /^\s*REFRESH\s+MATERIALIZED\s+VIEW\b/i, // Modifies materialized view data
+    /^\s*ANALYZE\b/i, // Updates statistics (can be considered write)
+    // COPY FROM (imports data)
+    /^\s*COPY\s+\S+\s+FROM\b/i,
+    // COMMIT can commit pending writes
+    /^\s*COMMIT\b/i,
+    // Savepoint manipulation (could be used to commit partial writes)
+    /^\s*SAVEPOINT\b/i,
+    /^\s*RELEASE\s+SAVEPOINT\b/i,
+    // Transaction control that could affect data
+    /^\s*PREPARE\s+TRANSACTION\b/i, // Two-phase commit
+    /^\s*COMMIT\s+PREPARED\b/i,
+    /^\s*ROLLBACK\s+PREPARED\b/i,
+    // Lock operations (could be used to interfere with reads)
+    /^\s*LOCK\s+TABLE\b/i,
+    /^\s*LOCK\s+/i,
+    // Extension and procedure modifications
+    /^\s*CREATE\s+OR\s+REPLACE\b/i,
+    // DO blocks can execute arbitrary SQL including writes
+    /^\s*DO\s+/i,
+    // CALL can invoke procedures that write data
+    /^\s*CALL\s+/i,
+    // EXECUTE can run prepared statements that write
+    /^\s*EXECUTE\s+/i,
+    // NOTIFY/LISTEN can be used for side effects
+    /^\s*NOTIFY\b/i,
+    // DISCARD can affect session state
+    /^\s*DISCARD\s+/i,
+    // SECURITY LABEL modifies labels
+    /^\s*SECURITY\s+LABEL\b/i,
+    // LOAD loads external modules
+    /^\s*LOAD\b/i,
+    // CTE with write operations (WITH ... UPDATE/INSERT/DELETE)
+    /^\s*WITH\s+[\s\S]*?\b(UPDATE|INSERT|DELETE)\b/i,
+];
+/**
+ * Check if a SQL query is a write operation.
+ *
+ * @param sql - The SQL query to check
+ * @returns true if the query would modify data
+ */
+export function isWriteQuery(sql) {
+    if (!sql || !sql.trim()) {
+        return false;
+    }
+    const trimmed = sql.trim();
+    for (const pattern of SQL_WRITE_PATTERNS) {
+        if (pattern.test(trimmed)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Error thrown when a write operation is blocked in read-only mode.
+ */
+export class WriteBlockedError extends Error {
+    /** The blocked SQL query */
+    query;
+    /** PostgreSQL SQLSTATE code for read-only transaction */
+    code = '25006';
+    /** Error name */
+    name = 'WriteBlockedError';
+    constructor(query) {
+        super(`Write operation blocked: database is in read-only mode`);
+        this.query = query;
+    }
+}
+/**
+ * Create a write blocker function based on configuration.
+ *
+ * @param config - Read-only configuration
+ * @returns A function that checks and potentially blocks write queries
+ */
+export function createWriteBlocker(config) {
+    return (sql) => {
+        // If read-only mode is disabled, allow everything
+        if (!config.enabled) {
+            return sql;
+        }
+        // Check if this is a write query
+        if (!isWriteQuery(sql)) {
+            return sql;
+        }
+        // Handle write attempt based on configuration
+        switch (config.onWriteAttempt) {
+            case 'throw':
+                throw new WriteBlockedError(sql);
+            case 'ignore':
+                return null;
+            case 'log':
+                // In a real implementation, we would log here
+                // console.warn(`[read-only] Blocked write query: ${sql.substring(0, 100)}...`)
+                return null;
+            default:
+                // Default to throw for safety
+                throw new WriteBlockedError(sql);
+        }
+    };
+}
+//# sourceMappingURL=write-blocker.js.map

package/dist/readonly/write-blocker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-blocker.js","sourceRoot":"","sources":["../../src/readonly/write-blocker.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,uBAAuB;IACvB,sBAAsB;IACtB,gBAAgB,EAAE,0CAA0C;IAC5D,gBAAgB;IAChB,sBAAsB;IACtB,gBAAgB,EAAE,oDAAoD;IACtE,eAAe,EAAE,+BAA+B;IAEhD,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,qBAAqB,EAAE,4CAA4C;IACnE,gBAAgB,EAAE,oBAAoB;IAEtC,qBAAqB;IACrB,eAAe;IACf,gBAAgB;IAEhB,0CAA0C;IAC1C,eAAe;IACf,iBAAiB;IACjB,iBAAiB,EAAE,8BAA8B;IACjD,sCAAsC,EAAE,kCAAkC;IAC1E,gBAAgB,EAAE,+CAA+C;IAEjE,2BAA2B;IAC3B,0BAA0B;IAE1B,mCAAmC;IACnC,eAAe;IAEf,kEAAkE;IAClE,kBAAkB;IAClB,4BAA4B;IAE5B,6CAA6C;IAC7C,8BAA8B,EAAE,mBAAmB;IACnD,0BAA0B;IAC1B,4BAA4B;IAE5B,0DAA0D;IAC1D,qBAAqB;IACrB,cAAc;IAEd,wCAAwC;IACxC,8BAA8B;IAE9B,uDAAuD;IACvD,YAAY;IAEZ,6CAA6C;IAC7C,cAAc;IAEd,iDAAiD;IACjD,iBAAiB;IAEjB,6CAA6C;IAC7C,eAAe;IAEf,mCAAmC;IACnC,iBAAiB;IAEjB,iCAAiC;IACjC,yBAAyB;IAEzB,8BAA8B;IAC9B,aAAa;IAEb,4DAA4D;IAC5D,gDAAgD;CACjD,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAE1B,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,4BAA4B;IACnB,KAAK,CAAQ;IAEtB,yDAAyD;IAChD,IAAI,GAAW,OAAO,CAAA;IAE/B,iBAAiB;IACC,IAAI,GAAW,mBAAmB,CAAA;IAEpD,YAAY,KAAa;QACvB,KAAK,CAAC,wDAAwD,CAAC,CAAA;QAC/D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;CACF;AAQD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IACvD,OAAO,CAAC,GAAW,EAAiB,EAAE;QACpC,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,8CAA8C;QAC9C,QAAQ,MAAM,CAAC,cAAc,EAAE,CAAC;YAC9B,KAAK,OAAO;gBACV,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAA;YAElC,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAA;YAEb,KAAK,KAAK;gBACR,8CAA8C;gBAC9C,+EAA+E;gBAC/E,OAAO,IAAI,CAAA;YAEb;gBACE,8BAA8B;gBAC9B,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}