@gizmodata/hardcharger-mcp 0.0.0 → 2.0.0

package/dist/sql-guard.js

@@ -0,0 +1,460 @@
+// Read-only classification and result-limit wrapping for SQL text.
+//
+// This is defense in depth, not the security boundary: the Hardcharger
+// user's database-level role/privileges are the real boundary (see the
+// README). The classifier is deliberately conservative — anything it
+// cannot confidently classify as a read is rejected when writes are
+// disabled.
+/** Leading keywords that are always reads and can be wrapped in a subquery. */
+const WRAPPABLE_READ_KEYWORDS = new Set([
+    "SELECT",
+    "FROM", // DuckDB FROM-first syntax
+    "VALUES",
+    "SHOW",
+    "DESCRIBE",
+    "DESC",
+    "SUMMARIZE",
+    "TABLE", // `TABLE t` is shorthand for SELECT * FROM t
+]);
+/** Leading keywords that are reads but cannot be used as a subquery. */
+// USE only changes the session's search path (no data access), so it is
+// allowed in read-only mode.
+const UNWRAPPABLE_READ_KEYWORDS = new Set(["EXPLAIN", "PRAGMA", "USE"]);
+/** Everything here is a write / side-effecting statement. */
+const WRITE_KEYWORDS = new Set([
+    "INSERT",
+    "UPDATE",
+    "DELETE",
+    "MERGE",
+    "UPSERT",
+    "REPLACE",
+    "TRUNCATE",
+    "CREATE",
+    "DROP",
+    "ALTER",
+    "RENAME",
+    "COPY",
+    "EXPORT",
+    "IMPORT",
+    "ATTACH",
+    "DETACH",
+    "INSTALL",
+    "FORCE", // FORCE INSTALL / FORCE CHECKPOINT
+    "LOAD",
+    "SET",
+    "RESET",
+    "CALL",
+    "BEGIN",
+    "START",
+    "COMMIT",
+    "ROLLBACK",
+    "ABORT",
+    "END",
+    "CHECKPOINT",
+    "VACUUM",
+    "ANALYZE",
+    "GRANT",
+    "REVOKE",
+    "KILL",
+    "COMMENT",
+    "PIVOT",
+    "UNPIVOT",
+]);
+// PIVOT/UNPIVOT are reads in DuckDB, but they are rewritten by the
+// binder into multiple internal statements and cannot be prepared with
+// parameters or reliably wrapped; treat them as unclassifiable rather
+// than as writes.
+WRITE_KEYWORDS.delete("PIVOT");
+WRITE_KEYWORDS.delete("UNPIVOT");
+/**
+ * Removes SQL comments (`-- ...`, `/* ... *\/` with nesting) while
+ * preserving string literals, quoted identifiers and dollar-quoted
+ * strings. Comments are replaced by a single space so offsets stay
+ * meaningful for error messages.
+ */
+export function stripComments(sql) {
+    let out = "";
+    let i = 0;
+    const n = sql.length;
+    while (i < n) {
+        const ch = sql[i];
+        const next = sql[i + 1];
+        if (ch === "'") {
+            // single-quoted string with '' escapes
+            let j = i + 1;
+            while (j < n) {
+                if (sql[j] === "'") {
+                    if (sql[j + 1] === "'") {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            out += sql.slice(i, j + 1);
+            i = j + 1;
+            continue;
+        }
+        if (ch === '"') {
+            let j = i + 1;
+            while (j < n) {
+                if (sql[j] === '"') {
+                    if (sql[j + 1] === '"') {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            out += sql.slice(i, j + 1);
+            i = j + 1;
+            continue;
+        }
+        if (ch === "$") {
+            // dollar-quoted string: $tag$ ... $tag$
+            const m = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i));
+            if (m) {
+                const delim = m[0];
+                const end = sql.indexOf(delim, i + delim.length);
+                const stop = end === -1 ? n : end + delim.length;
+                out += sql.slice(i, stop);
+                i = stop;
+                continue;
+            }
+        }
+        if (ch === "-" && next === "-") {
+            let j = i + 2;
+            while (j < n && sql[j] !== "\n")
+                j++;
+            out += " ";
+            i = j;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            let depth = 1;
+            let j = i + 2;
+            while (j < n && depth > 0) {
+                if (sql[j] === "/" && sql[j + 1] === "*") {
+                    depth++;
+                    j += 2;
+                }
+                else if (sql[j] === "*" && sql[j + 1] === "/") {
+                    depth--;
+                    j += 2;
+                }
+                else {
+                    j++;
+                }
+            }
+            out += " ";
+            i = j;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+/** Tokenizes comment-stripped SQL into words, punctuation and literals. */
+function tokenize(sql) {
+    const tokens = [];
+    let i = 0;
+    const n = sql.length;
+    while (i < n) {
+        const ch = sql[i];
+        if (/\s/.test(ch)) {
+            i++;
+            continue;
+        }
+        if (ch === "'") {
+            let j = i + 1;
+            while (j < n) {
+                if (sql[j] === "'") {
+                    if (sql[j + 1] === "'") {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            tokens.push({ text: sql.slice(i, j + 1), kind: "string", start: i });
+            i = j + 1;
+            continue;
+        }
+        if (ch === '"') {
+            let j = i + 1;
+            while (j < n) {
+                if (sql[j] === '"') {
+                    if (sql[j + 1] === '"') {
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                j++;
+            }
+            tokens.push({ text: sql.slice(i, j + 1), kind: "quoted", start: i });
+            i = j + 1;
+            continue;
+        }
+        if (ch === "$") {
+            const m = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/.exec(sql.slice(i));
+            if (m) {
+                const delim = m[0];
+                const end = sql.indexOf(delim, i + delim.length);
+                const stop = end === -1 ? n : end + delim.length;
+                tokens.push({ text: sql.slice(i, stop), kind: "string", start: i });
+                i = stop;
+                continue;
+            }
+        }
+        const word = /^[A-Za-z_][A-Za-z0-9_$]*/.exec(sql.slice(i));
+        if (word) {
+            tokens.push({ text: word[0].toUpperCase(), kind: "word", start: i });
+            i += word[0].length;
+            continue;
+        }
+        tokens.push({ text: ch, kind: "punct", start: i });
+        i++;
+    }
+    return tokens;
+}
+/**
+ * Number of parameters a statement expects: `?` placeholders, or the highest
+ * `$n` index, counted outside strings, quoted identifiers and comments.
+ */
+export function countPlaceholders(sql) {
+    const tokens = tokenize(stripComments(sql));
+    let question = 0;
+    let dollarMax = 0;
+    for (let i = 0; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t.kind !== "punct")
+            continue;
+        if (t.text === "?") {
+            question++;
+            continue;
+        }
+        if (t.text === "$") {
+            // Digits are tokenized one per punct token; take the contiguous run after `$`.
+            let digits = "";
+            let pos = t.start + 1;
+            for (let j = i + 1; j < tokens.length && tokens[j].kind === "punct" && /\d/.test(tokens[j].text) && tokens[j].start === pos; j++) {
+                digits += tokens[j].text;
+                pos++;
+            }
+            if (digits)
+                dollarMax = Math.max(dollarMax, Number(digits));
+        }
+    }
+    return Math.max(question, dollarMax);
+}
+/**
+ * Splits SQL into top-level statements on semicolons that are outside
+ * strings, quoted identifiers and comments. Empty statements (e.g. from a
+ * trailing semicolon) are dropped.
+ */
+export function splitStatements(sql) {
+    const stripped = stripComments(sql);
+    const tokens = tokenize(stripped);
+    const statements = [];
+    let start = 0;
+    for (const t of tokens) {
+        if (t.kind === "punct" && t.text === ";") {
+            const piece = stripped.slice(start, t.start).trim();
+            if (piece)
+                statements.push(piece);
+            start = t.start + 1;
+        }
+    }
+    const tail = stripped.slice(start).trim();
+    if (tail)
+        statements.push(tail);
+    return statements;
+}
+/**
+ * Returns the statement with comments removed and any trailing
+ * semicolons stripped, ready to be wrapped in a subquery.
+ */
+export function normalizeStatement(sql) {
+    return stripComments(sql).trim().replace(/;+\s*$/u, "").trim();
+}
+/** Index of the token that closes the parenthesis opened at `open`. */
+function matchParen(tokens, open) {
+    let depth = 0;
+    for (let i = open; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t.kind !== "punct")
+            continue;
+        if (t.text === "(")
+            depth++;
+        else if (t.text === ")") {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+/**
+ * Given tokens starting at a `WITH`, returns the index of the first token
+ * of the main statement that follows the CTE list, or -1 if the CTE list
+ * cannot be parsed.
+ */
+function skipCteList(tokens, withIndex) {
+    let i = withIndex + 1;
+    if (tokens[i]?.text === "RECURSIVE")
+        i++;
+    for (;;) {
+        // cte name
+        const name = tokens[i];
+        if (!name || (name.kind !== "word" && name.kind !== "quoted"))
+            return -1;
+        i++;
+        // optional column list
+        if (tokens[i]?.kind === "punct" && tokens[i].text === "(") {
+            const close = matchParen(tokens, i);
+            if (close === -1)
+                return -1;
+            i = close + 1;
+        }
+        if (tokens[i]?.text !== "AS")
+            return -1;
+        i++;
+        if (tokens[i]?.text === "NOT")
+            i++;
+        if (tokens[i]?.text === "MATERIALIZED")
+            i++;
+        if (!(tokens[i]?.kind === "punct" && tokens[i].text === "("))
+            return -1;
+        const close = matchParen(tokens, i);
+        if (close === -1)
+            return -1;
+        i = close + 1;
+        if (tokens[i]?.kind === "punct" && tokens[i].text === ",") {
+            i++;
+            continue;
+        }
+        return i < tokens.length ? i : -1;
+    }
+}
+/**
+ * Classifies a single SQL statement by its leading keyword, looking
+ * through leading parentheses and CTE lists to find the statement that
+ * actually executes.
+ */
+export function classifyStatement(sql) {
+    const tokens = tokenize(stripComments(sql));
+    let i = 0;
+    let sawWith = false;
+    for (let guard = 0; guard < 64 && i < tokens.length; guard++) {
+        const t = tokens[i];
+        if (t.kind === "punct" && t.text === "(") {
+            // `(SELECT ...) UNION (SELECT ...)` — classify the inner statement.
+            i++;
+            continue;
+        }
+        if (t.kind !== "word") {
+            return { kind: "unknown", keyword: t.text, wrappable: false };
+        }
+        if (t.text === "WITH") {
+            sawWith = true;
+            const main = skipCteList(tokens, i);
+            if (main === -1) {
+                return { kind: "unknown", keyword: "WITH", wrappable: false };
+            }
+            i = main;
+            continue;
+        }
+        if (WRAPPABLE_READ_KEYWORDS.has(t.text)) {
+            return { kind: "read", keyword: sawWith ? "WITH" : t.text, wrappable: true };
+        }
+        if (UNWRAPPABLE_READ_KEYWORDS.has(t.text)) {
+            if (t.text === "PRAGMA") {
+                // `PRAGMA name` / `PRAGMA fn(args)` are reads; `PRAGMA x = y` mutates settings.
+                const hasAssignment = tokens
+                    .slice(i + 1)
+                    .some((tok) => tok.kind === "punct" && tok.text === "=");
+                if (hasAssignment) {
+                    return { kind: "write", keyword: "PRAGMA", wrappable: false };
+                }
+            }
+            if (t.text === "EXPLAIN") {
+                // EXPLAIN of a write is a read (it never executes), but keep it
+                // conservative: classify the explained statement instead.
+                let j = i + 1;
+                if (tokens[j]?.text === "ANALYZE")
+                    j++;
+                if (tokens[j]?.kind === "punct" && tokens[j].text === "(") {
+                    // EXPLAIN (FORMAT ...) options
+                    const close = matchParen(tokens, j);
+                    if (close !== -1)
+                        j = close + 1;
+                }
+                const inner = classifyStatement(stripComments(sql).slice(tokens[j]?.start ?? sql.length));
+                return { kind: inner.kind, keyword: "EXPLAIN", wrappable: false };
+            }
+            return { kind: "read", keyword: t.text, wrappable: false };
+        }
+        if (WRITE_KEYWORDS.has(t.text)) {
+            return { kind: "write", keyword: t.text, wrappable: false };
+        }
+        return { kind: "unknown", keyword: t.text, wrappable: false };
+    }
+    return { kind: "unknown", keyword: "", wrappable: false };
+}
+export class SqlGuardError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SqlGuardError";
+    }
+}
+/**
+ * Validates that `sql` is exactly one statement and, when writes are
+ * disabled, that it is a read. Throws {@link SqlGuardError} otherwise.
+ */
+export function guardStatement(sql, allowWrites) {
+    if (typeof sql !== "string" || !sql.trim()) {
+        throw new SqlGuardError("SQL statement is empty.");
+    }
+    const statements = splitStatements(sql);
+    if (statements.length === 0) {
+        throw new SqlGuardError("SQL statement is empty (only comments/semicolons).");
+    }
+    if (statements.length > 1) {
+        throw new SqlGuardError(`Only one SQL statement per call is allowed (found ${statements.length}). ` +
+            "Split the statements into separate calls.");
+    }
+    const single = normalizeStatement(statements[0]);
+    const classification = classifyStatement(single);
+    if (!allowWrites) {
+        if (classification.kind === "write") {
+            throw new SqlGuardError(`Statement type ${classification.keyword} is not allowed: this server is read-only ` +
+                "(HARDCHARGER_ALLOW_WRITES is not enabled). Only SELECT/WITH/FROM/VALUES/SHOW/" +
+                "DESCRIBE/SUMMARIZE/EXPLAIN/PRAGMA (read)/USE statements are permitted.");
+        }
+        if (classification.kind === "unknown") {
+            throw new SqlGuardError(`Unable to classify statement starting with "${classification.keyword || single.slice(0, 20)}" ` +
+                "as read-only; this server is read-only (HARDCHARGER_ALLOW_WRITES is not enabled). " +
+                "Rewrite it as a SELECT/WITH query.");
+        }
+    }
+    return { sql: single, classification };
+}
+/** Alias used by the query wrapper so it never collides with user aliases. */
+export const WRAPPER_ALIAS = "hardcharger_mcp_q";
+/**
+ * Wraps a read statement so the server enforces the row cap:
+ * `SELECT * FROM (<sql>) AS hardcharger_mcp_q LIMIT <limit>`.
+ * The caller must pass a normalized (comment-free, no trailing `;`) statement.
+ */
+export function wrapWithLimit(sql, limit) {
+    if (!Number.isInteger(limit) || limit < 1) {
+        throw new SqlGuardError(`Row limit must be a positive integer (got ${limit}).`);
+    }
+    return `SELECT * FROM (\n${sql}\n) AS ${WRAPPER_ALIAS} LIMIT ${limit}`;
+}
+//# sourceMappingURL=sql-guard.js.map

package/dist/sql-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-guard.js","sourceRoot":"","sources":["../src/sql-guard.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,YAAY;AAgBZ,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,QAAQ;IACR,MAAM,EAAE,2BAA2B;IACnC,QAAQ;IACR,MAAM;IACN,UAAU;IACV,MAAM;IACN,WAAW;IACX,OAAO,EAAE,6CAA6C;CACvD,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,6BAA6B;AAC7B,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAExE,6DAA6D;AAC7D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,SAAS;IACT,UAAU;IACV,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO,EAAE,mCAAmC;IAC5C,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,UAAU;IACV,OAAO;IACP,KAAK;IACL,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;IACT,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,kBAAkB;AAClB,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC/B,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAYjC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,KAAK,GAAG,EAAG,CAAC;YAChB,uCAAuC;YACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACnB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACnB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,wCAAwC;YACxC,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;gBACjD,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC1B,CAAC,GAAG,IAAI,CAAC;gBACT,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACrC,GAAG,IAAI,GAAG,CAAC;YACX,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACzC,KAAK,EAAE,CAAC;oBACR,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;qBAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAChD,KAAK,EAAE,CAAC;oBACR,CAAC,IAAI,CAAC,CAAC;gBACT,CAAC;qBAAM,CAAC;oBACN,CAAC,EAAE,CAAC;gBACN,CAAC;YACH,CAAC;YACD,GAAG,IAAI,GAAG,CAAC;YACX,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACnB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACnB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;wBACvB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;gBACjD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpE,CAAC,GAAG,IAAI,CAAC;gBACT,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACrE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACjC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACnB,+EAA+E;YAC/E,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YACtB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBACjI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzB,GAAG,EAAE,CAAC;YACR,CAAC;YACD,IAAI,MAAM;gBAAE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,KAAK;gBAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACjE,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CAAC,MAAe,EAAE,IAAY;IAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACjC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAe,EAAE,SAAiB;IACrD,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;IACtB,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,WAAW;QAAE,CAAC,EAAE,CAAC;IACzC,SAAS,CAAC;QACR,WAAW;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,EAAE,CAAC;QACJ,uBAAuB;QACvB,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpC,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YAC5B,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC,EAAE,CAAC;QACJ,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK;YAAE,CAAC,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,cAAc;YAAE,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QAC5B,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YAC1D,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACzC,oEAAoE;YACpE,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAChE,CAAC;YACD,CAAC,GAAG,IAAI,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,gFAAgF;gBAChF,MAAM,aAAa,GAAG,MAAM;qBACzB,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;qBACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;gBAC3D,IAAI,aAAa,EAAE,CAAC;oBAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBAChE,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,0DAA0D;gBAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS;oBAAE,CAAC,EAAE,CAAC;gBACvC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC1D,+BAA+B;oBAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBACpC,IAAI,KAAK,KAAK,CAAC,CAAC;wBAAE,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;gBAClC,CAAC;gBACD,MAAM,KAAK,GAAG,iBAAiB,CAC7B,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CACzD,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACpE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAQD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,WAAoB;IAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,aAAa,CAAC,yBAAyB,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,oDAAoD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CACrB,qDAAqD,UAAU,CAAC,MAAM,KAAK;YACzE,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,IAAI,cAAc,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CACrB,kBAAkB,cAAc,CAAC,OAAO,4CAA4C;gBAClF,+EAA+E;gBAC/E,wEAAwE,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,aAAa,CACrB,+CAA+C,cAAc,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;gBAC9F,oFAAoF;gBACpF,oCAAoC,CACvC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,KAAa;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,aAAa,CAAC,6CAA6C,KAAK,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,oBAAoB,GAAG,UAAU,aAAa,UAAU,KAAK,EAAE,CAAC;AACzE,CAAC"}

package/dist/sso.d.ts

@@ -0,0 +1,29 @@
+import { type BrowserSignInFlow, type BrowserSignInPoll, type BrowserSignInTarget } from "@gizmodata/hardcharger";
+import type { HardchargerConnection } from "./connection.js";
+/** The two Warp SQL calls a sign-in makes; replaceable in tests. */
+export interface BrowserSignInCalls {
+    start(target: BrowserSignInTarget): Promise<BrowserSignInFlow>;
+    poll(target: BrowserSignInTarget, flow: BrowserSignInFlow): Promise<BrowserSignInPoll>;
+}
+export interface SsoOptions {
+    waitSeconds: number;
+    /** Overrides the server's poll interval (tests). */
+    pollIntervalMs?: number;
+    /** Test hook: replaces the browser opener. */
+    openUrl?: (url: string) => Promise<void>;
+    /** Test hook: replaces the Warp SQL browser sign-in calls. */
+    calls?: BrowserSignInCalls;
+}
+export interface SsoOutcome {
+    status: "complete" | "pending" | "unavailable" | "error";
+    message: string;
+    authUrl?: string;
+}
+/**
+ * Opens a URL in the user's browser without any extra dependency: the command in
+ * HARDCHARGER_BROWSER when set (run with the URL as its one argument, no shell; the
+ * Hardcharger CLI's variable of the same meaning), else the platform's default opener.
+ */
+export declare function openInBrowser(url: string, env?: NodeJS.ProcessEnv): Promise<void>;
+/** Runs (or resumes) the browser sign-in flow for a connection. */
+export declare function runSsoLogin(connection: HardchargerConnection, options: SsoOptions): Promise<SsoOutcome>;

package/dist/sso.js

@@ -0,0 +1,145 @@
+// Optional browser sign-in through the server's identity provider (enabled with
+// HARDCHARGER_ENABLE_SSO=true): Warp SQL browser sign-in (§4.3, capability oauth_browser), on
+// the server's own Warp SQL port, through @gizmodata/hardcharger:
+//
+//   startBrowserSignIn  POST {uri}/v1/auth/oauth/flows        -> flow id, poll secret, authorize URL
+//   open the authorize URL in the user's browser
+//   pollBrowserSignIn   POST {uri}/v1/auth/oauth/flows/{id}   -> pending | complete (the server's
+//                                                                own access token) | failed (a code)
+//
+// The access token lives in process memory only, and is used as is: when it expires, call
+// login_sso again.
+import { spawn } from "node:child_process";
+import { HardchargerError, HardchargerErrorCode, pollBrowserSignIn, startBrowserSignIn, } from "@gizmodata/hardcharger";
+const pendingSessions = new WeakMap();
+const warpCalls = {
+    start: (target) => startBrowserSignIn(target),
+    poll: (target, flow) => pollBrowserSignIn({ ...target, flow }),
+};
+/**
+ * Opens a URL in the user's browser without any extra dependency: the command in
+ * HARDCHARGER_BROWSER when set (run with the URL as its one argument, no shell; the
+ * Hardcharger CLI's variable of the same meaning), else the platform's default opener.
+ */
+export function openInBrowser(url, env = process.env) {
+    return new Promise((resolve, reject) => {
+        let cmd;
+        let args;
+        const browser = env.HARDCHARGER_BROWSER?.trim();
+        if (browser) {
+            cmd = browser;
+            args = [url];
+        }
+        else if (process.platform === "darwin") {
+            cmd = "open";
+            args = [url];
+        }
+        else if (process.platform === "win32") {
+            cmd = "rundll32";
+            args = ["url.dll,FileProtocolHandler", url];
+        }
+        else {
+            cmd = "xdg-open";
+            args = [url];
+        }
+        try {
+            const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+            child.on("error", reject);
+            child.on("spawn", () => {
+                child.unref();
+                resolve();
+            });
+        }
+        catch (err) {
+            reject(err);
+        }
+    });
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function unavailable(uri, why) {
+    return {
+        status: "unavailable",
+        message: `The Hardcharger server at ${uri} offers no browser sign-in (${why}). It is offered only when the ` +
+            "server is started with --oauth-client-id (and its identity provider settings); otherwise configure " +
+            "a password, token or client certificate.",
+    };
+}
+const code = (err) => (err instanceof HardchargerError ? err.code : undefined);
+/** A flow the server no longer knows, or one past its expiry: start a new one. */
+function stale(session) {
+    const expires = Date.parse(session.flow.expiresAt);
+    const now = Date.now();
+    return now - session.startedAt > 10 * 60 * 1000 || (!Number.isNaN(expires) && now >= expires);
+}
+/** Runs (or resumes) the browser sign-in flow for a connection. */
+export async function runSsoLogin(connection, options) {
+    const calls = options.calls ?? warpCalls;
+    const openUrl = options.openUrl ?? openInBrowser;
+    const target = connection.signInTarget();
+    const redact = (err) => connection.redact(err instanceof Error ? err.message : String(err));
+    let session = pendingSessions.get(connection);
+    if (!session || stale(session)) {
+        let flow;
+        try {
+            flow = await calls.start(target);
+        }
+        catch (err) {
+            const c = code(err);
+            if (c === HardchargerErrorCode.notImplemented || c === HardchargerErrorCode.notFound) {
+                return unavailable(connection.config.uri, `${c}: ${redact(err)}`);
+            }
+            if (c === HardchargerErrorCode.clientTransportError)
+                return unavailable(connection.config.uri, redact(err));
+            throw err;
+        }
+        session = { flow, startedAt: Date.now() };
+        pendingSessions.set(connection, session);
+        try {
+            await openUrl(flow.authorizeUrl);
+        }
+        catch {
+            // The URL is returned in the message so the user can open it manually.
+        }
+    }
+    const pollIntervalMs = options.pollIntervalMs ?? session.flow.pollIntervalS * 1000;
+    const deadline = Date.now() + options.waitSeconds * 1000;
+    while (Date.now() < deadline) {
+        let poll;
+        try {
+            poll = await calls.poll(target, session.flow);
+        }
+        catch (err) {
+            pendingSessions.delete(connection);
+            const c = code(err);
+            if (c === HardchargerErrorCode.flowNotFound) {
+                return { status: "error", message: "The sign-in expired or was already used. Call login_sso again." };
+            }
+            // A failed flow throws its code (access_denied, identity_provider_error,
+            // invalid_credentials, ...) with no HTTP status: report it with the code.
+            const why = redact(err).replace(/^browser sign-in failed: /iu, "");
+            return { status: "error", message: `Browser sign-in failed: ${c !== undefined && !why.includes(c) ? `${why} (${c})` : why}` };
+        }
+        if (poll.state === "complete") {
+            pendingSessions.delete(connection);
+            await connection.useCredentials({ accessToken: poll.accessToken });
+            try {
+                await connection.query("SELECT 1");
+            }
+            catch (err) {
+                return { status: "error", message: `Signed in, but connecting with the access token failed: ${redact(err)}` };
+            }
+            return {
+                status: "complete",
+                message: "Signed in with SSO. Subsequent queries use your Hardcharger access token (call login_sso again when it expires).",
+            };
+        }
+        await sleep(Math.max(0, Math.min(pollIntervalMs, deadline - Date.now())));
+    }
+    return {
+        status: "pending",
+        authUrl: session.flow.authorizeUrl,
+        message: "Waiting for you to finish signing in. A browser window should have opened; if not, open this URL: " +
+            `${session.flow.authorizeUrl}\nThen call login_sso again to complete the sign-in.`,
+    };
+}
+//# sourceMappingURL=sso.js.map

package/dist/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","sourceRoot":"","sources":["../src/sso.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,8FAA8F;AAC9F,kEAAkE;AAClE,EAAE;AACF,qGAAqG;AACrG,iDAAiD;AACjD,kGAAkG;AAClG,qGAAqG;AACrG,EAAE;AACF,0FAA0F;AAC1F,mBAAmB;AAEnB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAIL,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AA+BhC,MAAM,eAAe,GAAG,IAAI,OAAO,EAAyC,CAAC;AAE7E,MAAM,SAAS,GAAuB;IACpC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;CAC/D,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC7E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,GAAW,CAAC;QAChB,IAAI,IAAc,CAAC;QACnB,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;QAChD,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,GAAG,OAAO,CAAC;YACd,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzC,GAAG,GAAG,MAAM,CAAC;YACb,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,GAAG,GAAG,UAAU,CAAC;YACjB,IAAI,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,UAAU,CAAC;YACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpE,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,OAAO;QACL,MAAM,EAAE,aAAa;QACrB,OAAO,EACL,6BAA6B,GAAG,+BAA+B,GAAG,iCAAiC;YACnG,qGAAqG;YACrG,0CAA0C;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAAY,EAAsB,EAAE,CAAC,CAAC,GAAG,YAAY,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAE5G,kFAAkF;AAClF,SAAS,KAAK,CAAC,OAAuB;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC;AAChG,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAiC,EAAE,OAAmB;IACtF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAErG,IAAI,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,IAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,oBAAoB,CAAC,cAAc,IAAI,CAAC,KAAK,oBAAoB,CAAC,QAAQ,EAAE,CAAC;gBACrF,OAAO,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,CAAC,KAAK,oBAAoB,CAAC,oBAAoB;gBAAE,OAAO,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5G,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1C,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IACzD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,oBAAoB,CAAC,YAAY,EAAE,CAAC;gBAC5C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;YACxG,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAChI,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC9B,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnC,MAAM,UAAU,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,2DAA2D,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAChH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,UAAU;gBAClB,OAAO,EAAE,kHAAkH;aAC5H,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;QAClC,OAAO,EACL,oGAAoG;YACpG,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,sDAAsD;KACrF,CAAC;AACJ,CAAC"}