@graphoria/server 0.2.3 → 0.4.0

package/README.md

@@ -76,26 +76,35 @@ await close(); // release database connections
 
 The server reads a small set of environment variables. Every variable has a sensible default except `JWT_SECRET` (or PASETO equivalents) and `ADMIN_SECRET`, both of which are required.
 
-| Variable               | Default                        | Purpose                                                                    |
-| ---------------------- | ------------------------------ | -------------------------------------------------------------------------- |
-| `PORT`                 | `3000`                         | HTTP port for `createBunServer`.                                           |
-| `JWT_SECRET`           | _required_                     | Symmetric secret for JWT signing.                                          |
-| `JWT_EXPIRES_IN`       | `5m`                           | Access-token lifetime.                                                     |
-| `JWT_RT_EXPIRES_IN`    | `7d`                           | Refresh-token lifetime.                                                    |
-| `PASETO_LOCAL_KEY`     | _required for_ `paseto_local`  | XChaCha20-Poly1305 key (`k4.local.…`).                                     |
-| `PASETO_SECRET_KEY`    | _required for_ `paseto_public` | Ed25519 secret (`k4.secret.…`).                                            |
-| `PASETO_PUBLIC_KEY`    | _required for_ `paseto_public` | Ed25519 public (`k4.public.…`).                                            |
-| `ADMIN_SECRET`         | _required_                     | Bypasses RBAC when sent in the admin header.                               |
-| `REDIS_URL`            | `redis://localhost:6379`       | Refresh-token rotation + cache.                                            |
-| `GRAPHQL_API_ENDPOINT` | `/graphql`                     | GraphQL endpoint path.                                                     |
-| `REST_API_PREFIX`      | `/rest`                        | REST API prefix.                                                           |
-| `GRAPHIQL_ENDPOINT`    | `/graphiql`                    | Built-in GraphiQL playground path.                                         |
-| `SCALAR_ENDPOINT`      | `/scalar`                      | Scalar API documentation path.                                             |
-| `OPENAPI_ENDPOINT`     | `/openapi.json`                | OpenAPI document path.                                                     |
-| `CORS_ENABLED`         | `true`                         | Toggle CORS preflight handler.                                             |
-| `MAX_QUERY_DEPTH`      | `0` (disabled)                 | Reject queries deeper than this — guard against abusive nested selections. |
-
-The complete list lives in [`packages/server/src/types/env.ts`](./src/types/env.ts).
+| Variable               | Default                        | Purpose                                                                                        |
+| ---------------------- | ------------------------------ | ---------------------------------------------------------------------------------------------- |
+| `PORT`                 | `3000`                         | HTTP port for `createBunServer`.                                                               |
+| `JWT_SECRET`           | _required_                     | Symmetric secret for JWT signing. Comma-separated list to rotate: first signs, all verify.     |
+| `JWT_EXPIRES_IN`       | `5m`                           | Access-token lifetime.                                                                         |
+| `JWT_RT_EXPIRES_IN`    | `7d`                           | Refresh-token lifetime.                                                                        |
+| `PASETO_LOCAL_KEY`     | _required for_ `paseto_local`  | XChaCha20-Poly1305 key (`k4.local.…`). Comma-separated list to rotate.                         |
+| `PASETO_SECRET_KEY`    | _required for_ `paseto_public` | Ed25519 secret (`k4.secret.…`).                                                                |
+| `PASETO_PUBLIC_KEY`    | _required for_ `paseto_public` | Ed25519 public (`k4.public.…`). Comma-separated list to rotate.                                |
+| `ADMIN_SECRET`         | _required_                     | Bypasses RBAC when sent in the admin header. Comma-separated list to rotate.                   |
+| `CONSOLE_READ_SECRET`  | _(unset)_                      | Opens the console read-only, and nothing else. Comma-separated list to rotate.                 |
+| `CONSOLE_WRITE_SECRET` | _(unset)_                      | Opens the console with queue publish and cron control, and nothing else. Comma-separated.      |
+| `AI_SECRET`            | _(unset)_                      | Opens the REST agent endpoint, and nothing else. Comma-separated list to rotate.               |
+| `AI_MCP_SECRET`        | _(unset)_                      | Opens the MCP gate when `AI_MCP_REQUIRE_ADMIN_SECRET=true`, and nothing else. Comma-separated. |
+| `REDIS_URL`            | `redis://localhost:6379`       | Refresh-token rotation + cache.                                                                |
+| `GRAPHQL_API_ENDPOINT` | `/graphql`                     | GraphQL endpoint path.                                                                         |
+| `REST_API_PREFIX`      | `/rest`                        | REST API prefix.                                                                               |
+| `GRAPHIQL_ENDPOINT`    | `/graphiql`                    | Built-in GraphiQL playground path.                                                             |
+| `SCALAR_ENDPOINT`      | `/scalar`                      | Scalar API documentation path.                                                                 |
+| `OPENAPI_ENDPOINT`     | `/openapi.json`                | OpenAPI document path.                                                                         |
+| `CORS_ENABLED`         | `true`                         | Toggle CORS preflight handler.                                                                 |
+| `MAX_QUERY_DEPTH`      | `8`                            | Reject caller queries deeper than this. `0` disables the limit.                                |
+| `DEFAULT_PAGE_SIZE`    | `100`                          | Page size applied to a list field that asks for no limit. `0` leaves it unbounded.             |
+| `MAX_PAGE_SIZE`        | `1000`                         | Reject a list field asking for more rows than this. `0` removes the ceiling.                   |
+
+The complete list lives in [`packages/server/src/types/env.ts`](./src/types/env.ts). Two more limits
+are not in the table above because they ship **off** — `MAX_QUERY_COST` and `RATE_LIMIT_MAX` — and a
+third, `QUERY_TIMEOUT_MS`, bounds every statement at `10000` ms. All five are documented together in
+[Resource Limits](../../docs/LIMITS.md).
 
 ## Configuration helpers
 

package/dist/src/ai/mcp/index.d.ts

@@ -1,14 +1,21 @@
+import type { CapabilityAuthorizer } from "../../authentication/capabilities";
 import type { AnalyzedConfiguration } from "../../configuration";
 import type { CreateMcpServerOptions } from "./create-server";
 export type CreateMCPRoutesOptions = CreateMcpServerOptions & {
     requireAdminSecret?: boolean;
-    adminSecret?: string;
+    /** Decides whether the presented header grants `mcp`; without one the gate never opens. */
+    authorize?: CapabilityAuthorizer;
     adminSecretHeader?: string;
 };
+type RequestServer = {
+    requestIP(req: Request): {
+        address: string;
+    } | null;
+};
 declare const handleMcpGet: (_req: Request) => Promise<Response>;
 declare const handleMcpDelete: (_req: Request) => Promise<Response>;
 export declare const createMCPRoutes: (analyzedConfiguration: AnalyzedConfiguration, options?: CreateMCPRoutesOptions) => {
-    POST: (req: Request) => Promise<Response>;
+    POST: (req: Request, bunServer?: RequestServer) => Promise<Response>;
     GET: typeof handleMcpGet;
     DELETE: typeof handleMcpDelete;
 };

package/dist/src/ai/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/ai/mcp/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAY9D,MAAM,MAAM,sBAAsB,GAAG,sBAAsB,GAAG;IAC5D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AA+CF,QAAA,MAAM,YAAY,SAAgB,OAAO,sBAAqD,CAAC;AAE/F,QAAA,MAAM,eAAe,SAAgB,OAAO,sBAAqD,CAAC;AAElG,eAAO,MAAM,eAAe,0BACH,qBAAqB,YACnC,sBAAsB;IAE/B,IAAI,QAtCQ,OAAO;IAuCnB,GAAG;IACH,MAAM;CACN,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/ai/mcp/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAM9D,MAAM,MAAM,sBAAsB,GAAG,sBAAsB,GAAG;IAC5D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,2FAA2F;IAC3F,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAeF,KAAK,aAAa,GAAG;IAAE,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,CAAC;AA2C7E,QAAA,MAAM,YAAY,SAAgB,OAAO,sBAAqD,CAAC;AAE/F,QAAA,MAAM,eAAe,SAAgB,OAAO,sBAAqD,CAAC;AAElG,eAAO,MAAM,eAAe,0BACH,qBAAqB,YACnC,sBAAsB;IAE/B,IAAI,QA/CQ,OAAO,cAAc,aAAa;IAgD9C,GAAG;IACH,MAAM;CACN,CAAC"}

package/dist/src/ai/tools/core.d.ts

@@ -18,7 +18,7 @@ export type ValidationError = {
         column: number;
     }>;
 };
-export type ValidateQueryFn = (query: string) => {
+export type ValidateQueryFn = (query: string, variables?: Record<string, unknown>) => {
     hasErrors: boolean;
     validationErrors: readonly ValidationError[];
 };
@@ -26,6 +26,11 @@ export type ValidateQueryFn = (query: string) => {
  * Build a query validator for a role. Without a positive depth limit it
  * delegates to the role's own `hasErrors`; with one it layers a depth-limit
  * rule on the standard rule set.
+ *
+ * The cost budget applies on both branches, and there is no MCP-specific
+ * override for it. MCP gets its own depth knob because an agent legitimately
+ * writes deeper queries than an application does; nothing makes the same
+ * argument for asking a database for more rows.
  */
 export declare const makeValidateQuery: (role: RoleEntities, maxQueryDepth?: number) => ValidateQueryFn;
 export type GraphqlExecOutcome = {

package/dist/src/ai/tools/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../../src/ai/tools/core.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAKtE;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC;AAE3C,eAAO,MAAM,YAAY,YACvB,OAAO,EACP,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,CACT,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,eAAO,MAAM,iBAAiB,QACvB,MAAM,SACJ,WAAW,GAAG;IAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;CAAE,KAC9C,UAA6D,CAAC;AAEjE,eAAO,MAAM,yBAAyB,UAAW,MAAM,KAAG,OAKzD,CAAC;AAyJF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,SACrB,YAAY,kBAAkB,MAAM,KAAG,eAU7C,CAAC;AAIJ,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,SACvB,YAAY,iBACH,eAAe,wBACR;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,KAC3E,OAAO,CAAC,kBAAkB,CA0B5B,CAAC;AAIF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SACrB,YAAY,oBACA;IAAE,IAAI,CAAC,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KACvD,cAAc,EA+EhB,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,SACvB,YAAY,kBACF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAA;CAAE,KAClD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IA0G5B,CAAC"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../../src/ai/tools/core.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAOtE;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,CAAC;AAE3C,eAAO,MAAM,YAAY,YACvB,OAAO,EACP,WAAW,EACX,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,CACT,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,eAAO,MAAM,iBAAiB,QACvB,MAAM,SACJ,WAAW,GAAG;IAAE,IAAI,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAA;CAAE,KAC9C,UAA6D,CAAC;AAEjE,eAAO,MAAM,yBAAyB,UAAW,MAAM,KAAG,OAKzD,CAAC;AAyJF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,CAC5B,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,SACrB,YAAY,kBAAkB,MAAM,KAAG,eAwB7C,CAAC;AAIJ,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,SACvB,YAAY,iBACH,eAAe,wBACR;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,KAC3E,OAAO,CAAC,kBAAkB,CA0B5B,CAAC;AAIF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SACrB,YAAY,oBACA;IAAE,IAAI,CAAC,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KACvD,cAAc,EA+EhB,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,SACvB,YAAY,kBACF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAA;CAAE,KAClD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IA0G5B,CAAC"}

package/dist/src/ai/tools/core.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=core.test.d.ts.map

package/dist/src/ai/tools/core.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.test.d.ts","sourceRoot":"","sources":["../../../../src/ai/tools/core.test.ts"],"names":[],"mappings":""}

package/dist/src/analyzeQuery/analyzers/selectionAnalyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"selectionAnalyzer.d.ts","sourceRoot":"","sources":["../../../../src/analyzeQuery/analyzers/selectionAnalyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,KAAK,EAAa,aAAa,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAMtE,eAAO,MAAM,iBAAiB,eAChB,SAAS,aAAa,EAAE,cACxB,iBAAiB,YACnB,cAAc,aACb,aAAa,qBACL,kBAAkB,EAAE,sBACnB,kBAAkB,EAAE,KACvC,iBAAiB,EA2H2B,CAAC"}
+{"version":3,"file":"selectionAnalyzer.d.ts","sourceRoot":"","sources":["../../../../src/analyzeQuery/analyzers/selectionAnalyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,iBAAiB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE3E,OAAO,KAAK,EAAa,aAAa,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAMtE,eAAO,MAAM,iBAAiB,eAChB,SAAS,aAAa,EAAE,cACxB,iBAAiB,YACnB,cAAc,aACb,aAAa,qBACL,kBAAkB,EAAE,sBACnB,kBAAkB,EAAE,KACvC,iBAAiB,EA4H2B,CAAC"}

package/dist/src/analyzeQuery/costLimit.d.ts

@@ -0,0 +1,30 @@
+import { GraphQLError } from "graphql";
+import type { DocumentNode, GraphQLSchema } from "graphql";
+/**
+ * Page bounds the estimate is drawn against. `maxPageSize` is carried, not read:
+ * a resolved limit above it is rejected at execution, so the walk never has to
+ * clamp — but the estimator needs it the day that ordering changes.
+ */
+export type CostPageLimits = {
+    defaultPageSize: number;
+    maxPageSize: number;
+};
+/**
+ * Estimate how many rows a document asks a database for, before executing it.
+ *
+ * Every field costs 1 for itself plus the cost of its children multiplied by the
+ * page size it requests — the `limit` argument for a list field, resolved through
+ * `variables`, falling back to `defaultPageSize`; 1 for anything that returns a
+ * single row. Fragment spreads are expanded, so moving a fan-out into a fragment
+ * does not hide it.
+ *
+ * A document carrying several operations is scored by its most expensive one:
+ * a request executes one of them.
+ */
+export declare const estimateQueryCost: (document: DocumentNode, schema: GraphQLSchema, variables: Record<string, unknown>, pageLimits: CostPageLimits) => number;
+/**
+ * Reject a document whose estimated cost exceeds `maxCost`. Returns `null` when
+ * it is within budget.
+ */
+export declare const checkQueryCost: (document: DocumentNode, schema: GraphQLSchema, variables: Record<string, unknown>, pageLimits: CostPageLimits, maxCost: number) => GraphQLError | null;
+//# sourceMappingURL=costLimit.d.ts.map

package/dist/src/analyzeQuery/costLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"costLimit.d.ts","sourceRoot":"","sources":["../../../src/analyzeQuery/costLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA2B,MAAM,SAAS,CAAC;AAEhE,OAAO,KAAK,EACV,YAAY,EAGZ,aAAa,EAId,MAAM,SAAS,CAAC;AAKjB;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AA4KF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,aAClB,YAAY,UACd,aAAa,aACV,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cACtB,cAAc,KACzB,MAA0E,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,cAAc,aACf,YAAY,UACd,aAAa,aACV,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cACtB,cAAc,WACjB,MAAM,KACd,YAAY,GAAG,IAWjB,CAAC"}

package/dist/src/analyzeQuery/costLimit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=costLimit.test.d.ts.map

package/dist/src/analyzeQuery/costLimit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"costLimit.test.d.ts","sourceRoot":"","sources":["../../../src/analyzeQuery/costLimit.test.ts"],"names":[],"mappings":""}

package/dist/src/analyzeQuery/depthLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"depthLimit.d.ts","sourceRoot":"","sources":["../../../src/analyzeQuery/depthLimit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,UAAU,EAGV,iBAAiB,EAClB,MAAM,SAAS,CAAC;AA6EjB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,aACd,MAAM,eACP,iBAAiB,KAAG,UAuB7B,CAAC"}
+{"version":3,"file":"depthLimit.d.ts","sourceRoot":"","sources":["../../../src/analyzeQuery/depthLimit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAW,UAAU,EAA0B,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAgE9F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,aACd,MAAM,eACP,iBAAiB,KAAG,UAuB7B,CAAC"}

package/dist/src/analyzeQuery/fragments.d.ts

@@ -0,0 +1,6 @@
+import type { DocumentNode, FragmentDefinitionNode } from "graphql";
+/**
+ * Collect all fragment definitions from a document.
+ */
+export declare const collectFragments: (document: DocumentNode) => Map<string, FragmentDefinitionNode>;
+//# sourceMappingURL=fragments.d.ts.map

package/dist/src/analyzeQuery/fragments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragments.d.ts","sourceRoot":"","sources":["../../../src/analyzeQuery/fragments.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,gBAAgB,aAAc,YAAY,KAAG,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAU3F,CAAC"}

package/dist/src/authentication/capabilities.d.ts

@@ -0,0 +1,18 @@
+import type { Env } from "../types/env";
+export type Capability = "console:read" | "console:write" | "ai" | "mcp";
+/** `superset` is true when the admin secret, not a scoped credential, matched. */
+export type CapabilityGrant = {
+    superset: boolean;
+};
+export type CapabilityAuthorizer = (candidate: string | null, capability: Capability) => CapabilityGrant | null;
+type WarnLog = {
+    warn: (obj: object, msg: string) => void;
+};
+/**
+ * Decides whether a presented secret grants a capability. The admin secret
+ * grants all of them and is reported as the superset so the caller can tell
+ * the two apart; it is also logged, since a scoped credential would have done.
+ */
+export declare const createCapabilityAuthorizer: (env: Env, log?: WarnLog) => CapabilityAuthorizer;
+export {};
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/src/authentication/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/authentication/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAKxC,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,IAAI,GAAG,KAAK,CAAC;AAEzE,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpD,MAAM,MAAM,oBAAoB,GAAG,CACjC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,UAAU,EAAE,UAAU,KACnB,eAAe,GAAG,IAAI,CAAC;AAE5B,KAAK,OAAO,GAAG;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,CAAC;AAiB5D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAChC,GAAG,QACH,OAAO,KACX,oBAaF,CAAC"}

package/dist/src/authentication/capabilities.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capabilities.test.d.ts.map

package/dist/src/authentication/capabilities.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.test.d.ts","sourceRoot":"","sources":["../../../src/authentication/capabilities.test.ts"],"names":[],"mappings":""}

package/dist/src/authentication/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/authentication/jwt.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAsBpG,YAAY,EAAE,yBAAyB,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAEvE,MAAM,MAAM,eAAe,GAAG,UAAU,GACtC,yBAAyB,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAKJ,eAAO,MAAM,gBAAgB,QACtB,GAAG,4BACkB,eAAe,KACxC,YAkLF,CAAC"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/authentication/jwt.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAWpG,YAAY,EAAE,yBAAyB,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC;AAEvE,MAAM,MAAM,eAAe,GAAG,UAAU,GACtC,yBAAyB,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAKJ,eAAO,MAAM,gBAAgB,QACtB,GAAG,4BACkB,eAAe,KACxC,YAoMF,CAAC"}

package/dist/src/authentication/paseto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paseto.d.ts","sourceRoot":"","sources":["../../../src/authentication/paseto.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAA0D,YAAY,EAAE,MAAM,SAAS,CAAC;AA0CpG,KAAK,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErC,eAAO,MAAM,mBAAmB,QACzB,GAAG,QACF,UAAU,4BACU,eAAe,KACxC,YA0MF,CAAC"}
+{"version":3,"file":"paseto.d.ts","sourceRoot":"","sources":["../../../src/authentication/paseto.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAA0D,YAAY,EAAE,MAAM,SAAS,CAAC;AA+BpG,KAAK,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC;AAErC,eAAO,MAAM,mBAAmB,QACzB,GAAG,QACF,UAAU,4BACU,eAAe,KACxC,YAgOF,CAAC"}

package/dist/src/authentication/secrets.d.ts

@@ -0,0 +1,9 @@
+export declare const safeCompare: (a: string, b: string) => boolean;
+/**
+ * True when `candidate` equals any entry of a rotating secret set. The first
+ * entry is the current secret; a match further along means a caller still
+ * holds a previous one, which is logged so the operator knows when it is safe
+ * to drop it.
+ */
+export declare const matchesAnySecret: (candidate: string | null, secrets: string[]) => boolean;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/src/authentication/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/authentication/secrets.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,WAAW,MAAO,MAAM,KAAK,MAAM,KAAG,OASlD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,cAAe,MAAM,GAAG,IAAI,WAAW,MAAM,EAAE,KAAG,OAO9E,CAAC"}

package/dist/src/authentication/secrets.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secrets.test.d.ts.map

package/dist/src/authentication/secrets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.test.d.ts","sourceRoot":"","sources":["../../../src/authentication/secrets.test.ts"],"names":[],"mappings":""}

package/dist/src/config/types/auth.d.ts

@@ -92,6 +92,10 @@ export declare const RolePermissionZod: z.ZodDefault<z.ZodObject<{
     operations: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"ALL">]>>>;
     remoteSchemas: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"ALL">]>>>;
     remoteREST: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"ALL">]>>>;
+    rateLimit: z.ZodOptional<z.ZodObject<{
+        max: z.ZodNumber;
+        windowMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
 }, z.core.$strict>>;
 export type RolePermission = z.input<typeof RolePermissionZod>;
 /**
@@ -123,6 +127,10 @@ export declare const AuthConfigZod: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         operations: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"ALL">]>>>;
         remoteSchemas: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"ALL">]>>>;
         remoteREST: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"ALL">]>>>;
+        rateLimit: z.ZodOptional<z.ZodObject<{
+            max: z.ZodNumber;
+            windowMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>>>>;
 }, z.core.$strict>>>;
 export type AuthConfig = z.input<typeof AuthConfigZod>;

package/dist/src/config/types/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/config/types/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;EAO5B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;kBAG3B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,KAAK,EACL,MAAM,EACN,IAAI,EACJ,SAAS,EACT,SAAS,EACT,aAAa,EACb,UAAU,CACF,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKjE,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAMjE;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;kBAO7B,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;mBA4C1B,CAAC;AAEL,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAM/D;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAuBtB,CAAC;AAEL,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/config/types/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;EAO5B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;kBAG3B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,KAAK,EACL,MAAM,EACN,IAAI,EACJ,SAAS,EACT,SAAS,EACT,aAAa,EACb,UAAU,CACF,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKjE,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAMjE;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;kBAO7B,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;mBAmD1B,CAAC;AAEL,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAM/D;;GAEG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAuBtB,CAAC;AAEL,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/src/config/types/db.d.ts

@@ -157,6 +157,7 @@ export declare const MSSQLConnectionOptionsZod: z.ZodObject<{
         max: z.ZodDefault<z.ZodNumber>;
         min: z.ZodDefault<z.ZodNumber>;
         idleTimeout: z.ZodDefault<z.ZodNumber>;
+        acquireTimeout: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
     connectionTimeout: z.ZodDefault<z.ZodNumber>;
     requestTimeout: z.ZodDefault<z.ZodNumber>;
@@ -255,6 +256,7 @@ export declare const DatabaseConnectionZod: z.ZodObject<{
             max: z.ZodDefault<z.ZodNumber>;
             min: z.ZodDefault<z.ZodNumber>;
             idleTimeout: z.ZodDefault<z.ZodNumber>;
+            acquireTimeout: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strict>>;
         connectionTimeout: z.ZodDefault<z.ZodNumber>;
         requestTimeout: z.ZodDefault<z.ZodNumber>;

package/dist/src/config/types/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../../src/config/types/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAe5C,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC;AAMpD,4EAA4E;AAC5E,eAAO,MAAM,gCAAgC,YAC3C,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,EACT,aAAa,CACL,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;kBAkBlC,CAAC;AAEJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM7E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;kBAM/B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMrE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAO/B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMrE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBlC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAM3E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;kBAuBrC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;kBA4BpC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAO/E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,GACpF,GAAG,GACH,CAAC,SAAS,OAAO,GACf,cAAc,GACd,KAAK,CAAC;AAEZ;;;GAGG;AACH,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,CAC3E,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC,KACrC,OAAO,CAAC;AAEb;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,CACpE,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC,EACxC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,KAClB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,GACnF,uBAAuB,GACvB,CAAC,SAAS,OAAO,GACf,sBAAsB,GACtB,KAAK,CAAC;AAMZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyBhC,CAAC;AAQH;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC,YAAY,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI;IAClE,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAC;IACR,+BAA+B;IAC/B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACxC,iEAAiE;IACjE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC;CACjD,CAAC;AAMF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;KAC7B,CAAC,IAAI,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC;CACvC,CAAC,YAAY,CAAC,CAAC"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../../src/config/types/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAe5C,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC;AAMpD,4EAA4E;AAC5E,eAAO,MAAM,gCAAgC,YAC3C,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,EACT,aAAa,CACL,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;kBAkBlC,CAAC;AAEJ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM7E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;kBAM/B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMrE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAO/B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMrE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmBlC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAM3E;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;kBAuBrC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;kBAmCpC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAO/E;;;GAGG;AACH,MAAM,MAAM,yBAAyB,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,GACpF,GAAG,GACH,CAAC,SAAS,OAAO,GACf,cAAc,GACd,KAAK,CAAC;AAEZ;;;GAGG;AACH,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,CAC3E,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC,KACrC,OAAO,CAAC;AAEb;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,CACpE,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC,EACxC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC,KAClB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,GACnF,uBAAuB,GACvB,CAAC,SAAS,OAAO,GACf,sBAAsB,GACtB,KAAK,CAAC;AAMZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAyBhC,CAAC;AAQH;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC,YAAY,CAAC,CAAC;AAErF;;GAEG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI;IAClE,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAC;IACR,+BAA+B;IAC/B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACxC,iEAAiE;IACjE,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC;CACjD,CAAC;AAMF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;KAC7B,CAAC,IAAI,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC;CACvC,CAAC,YAAY,CAAC,CAAC"}

package/dist/src/config/types/operation.d.ts

@@ -103,6 +103,7 @@ export declare const OperationZod: z.ZodObject<{
         updateAgeOnHas: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         ttlAutopurge: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     }, z.core.$strict>>;
+    timeout: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 export type Operation = z.input<typeof OperationZod>;
 export declare const OperationsZod: z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -142,6 +143,7 @@ export declare const OperationsZod: z.ZodRecord<z.ZodString, z.ZodObject<{
         updateAgeOnHas: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         ttlAutopurge: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     }, z.core.$strict>>;
+    timeout: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>>;
 export type Operations = z.input<typeof OperationsZod>;
 /**
@@ -232,6 +234,8 @@ export type BaseOperation<TInput, TOutput, TInitData> = {
     graphql?: OperationGraphQLConfig;
     /** Cache configuration */
     cache?: OperationCacheConfig;
+    /** Statement timeout in milliseconds. Overrides `QUERY_TIMEOUT_MS` for this operation. */
+    timeout?: number;
 };
 /**
  * Query-based operation - executes a GraphQL query

package/dist/src/config/types/operation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation.d.ts","sourceRoot":"","sources":["../../../../src/config/types/operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,IAAI,MAAM,SAAS,MAAM,GACrD,OAAO,GAEP,MAAM,SAAS;IAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,KAAK,MAAM,OAAO,CAAA;CAAE,GAC9D,OAAO,GACP,OAAO,CAAC;AAMd;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;kBAMjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;kBAQlC,CAAC;AAMH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEzE;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAM3E,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmCtB,CAAC;AAEJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAAqC,CAAC;AAEhE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,CAC9B,MAAM,GAAG,YAAY,EACrB,WAAW,GAAG,OAAO,EACrB,YAAY,GAAG,OAAO,EACtB,KAAK,GAAG,OAAO,IACb;IACF,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAAI;IACnD,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CAAC,OAAO,GAAG,OAAO,IAAI;IAC9C,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,CAAC,WAAW,GAAG,OAAO,IAAI;IAEpD,QAAQ,EAAE,CAAC,OAAO,GAAG,OAAO,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEhC,GAAG,CAAC,EAAE,GAAG,KACN,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtC,SAAS,EAAE,GAAG,CAAC;IAEf,MAAM,EAAE,GAAG,CAAC;IACZ;;;OAGG;IACH,UAAU,EAAE,WAAW,CAAC;CACzB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,SAAS,GAAG,OAAO,IAAI,CACnD,OAAO,EAAE,gBAAgB,KACtB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,0BAA0B,CACpC,MAAM,GAAG,YAAY,EACrB,SAAS,GAAG,OAAO,EACnB,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAClC,CACF,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC,EACrC,QAAQ,EAAE,SAAS,GAAG,SAAS,KAC5B,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,CAAC,OAAO,GAAG,OAAO,IAAI,CACzD,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAClC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,gBAAgB,CAAC,MAAM,GAAG,YAAY,EAAE,OAAO,GAAG,OAAO,EAAE,WAAW,GAAG,OAAO,IAAI,CAC9F,OAAO,EAAE,gBAAgB,CAAC,WAAW,CAAC,EACtC,KAAK,EAAE,MAAM,KACV,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI;IACtD,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,0DAA0D;IAC1D,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACpC,aAAa,CAAC,EAAE,0BAA0B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,YAAY,CAAC,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC;KACnD,CAAC;IACF,kCAAkC;IAClC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,0DAA0D;IAC1D,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,0BAA0B;IAC1B,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,MAAM,GAAG,YAAY,EACrB,OAAO,GAAG,OAAO,EACjB,SAAS,GAAG,OAAO,IACjB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG;IAC9C,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,CAC1B,MAAM,GAAG,YAAY,EACrB,OAAO,GAAG,OAAO,EACjB,SAAS,GAAG,OAAO,EACnB,WAAW,GAAG,OAAO,IACnB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG;IAC9C,wCAAwC;IACxC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,8BAA8B;IAC9B,OAAO,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;CACzD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,MAAM,GAAG,YAAY,EACrB,OAAO,GAAG,OAAO,EACjB,SAAS,GAAG,OAAO,EACnB,WAAW,GAAG,OAAO,IAEnB,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAC1C,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC"}
+{"version":3,"file":"operation.d.ts","sourceRoot":"","sources":["../../../../src/config/types/operation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,IAAI,MAAM,SAAS,MAAM,GACrD,OAAO,GAEP,MAAM,SAAS;IAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,KAAK,MAAM,OAAO,CAAA;CAAE,GAC9D,OAAO,GACP,OAAO,CAAC;AAMd;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;kBAMjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;kBAQlC,CAAC;AAMH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEzE;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAM3E,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqCtB,CAAC;AAEJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAAqC,CAAC;AAEhE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,CAC9B,MAAM,GAAG,YAAY,EACrB,WAAW,GAAG,OAAO,EACrB,YAAY,GAAG,OAAO,EACtB,KAAK,GAAG,OAAO,IACb;IACF,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,IAAI,CAAC,EAAE,KAAK,CAAC;CACd,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAAI;IACnD,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CAAC,OAAO,GAAG,OAAO,IAAI;IAC9C,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,CAAC,WAAW,GAAG,OAAO,IAAI;IAEpD,QAAQ,EAAE,CAAC,OAAO,GAAG,OAAO,EAC1B,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEhC,GAAG,CAAC,EAAE,GAAG,KACN,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtC,SAAS,EAAE,GAAG,CAAC;IAEf,MAAM,EAAE,GAAG,CAAC;IACZ;;;OAGG;IACH,UAAU,EAAE,WAAW,CAAC;CACzB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,SAAS,GAAG,OAAO,IAAI,CACnD,OAAO,EAAE,gBAAgB,KACtB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,0BAA0B,CACpC,MAAM,GAAG,YAAY,EACrB,SAAS,GAAG,OAAO,EACnB,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAClC,CACF,OAAO,EAAE,oBAAoB,CAAC,MAAM,CAAC,EACrC,QAAQ,EAAE,SAAS,GAAG,SAAS,KAC5B,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,CAAC,OAAO,GAAG,OAAO,IAAI,CACzD,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAClC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,gBAAgB,CAAC,MAAM,GAAG,YAAY,EAAE,OAAO,GAAG,OAAO,EAAE,WAAW,GAAG,OAAO,IAAI,CAC9F,OAAO,EAAE,gBAAgB,CAAC,WAAW,CAAC,EACtC,KAAK,EAAE,MAAM,KACV,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI;IACtD,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,6EAA6E;IAC7E,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,0DAA0D;IAC1D,KAAK,CAAC,EAAE;QACN,IAAI,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACpC,aAAa,CAAC,EAAE,0BAA0B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,YAAY,CAAC,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC;KACnD,CAAC;IACF,kCAAkC;IAClC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,0DAA0D;IAC1D,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,0BAA0B;IAC1B,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,MAAM,GAAG,YAAY,EACrB,OAAO,GAAG,OAAO,EACjB,SAAS,GAAG,OAAO,IACjB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG;IAC9C,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,CAC1B,MAAM,GAAG,YAAY,EACrB,OAAO,GAAG,OAAO,EACjB,SAAS,GAAG,OAAO,EACnB,WAAW,GAAG,OAAO,IACnB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG;IAC9C,wCAAwC;IACxC,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,8BAA8B;IAC9B,OAAO,EAAE,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;CACzD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,CACxB,MAAM,GAAG,YAAY,EACrB,OAAO,GAAG,OAAO,EACjB,SAAS,GAAG,OAAO,EACnB,WAAW,GAAG,OAAO,IAEnB,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAC1C,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC"}

package/dist/src/config/types/operation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=operation.test.d.ts.map

package/dist/src/config/types/operation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation.test.d.ts","sourceRoot":"","sources":["../../../../src/config/types/operation.test.ts"],"names":[],"mappings":""}

package/dist/src/configuration/crossReferences.d.ts

@@ -0,0 +1,27 @@
+import type { Configuration } from "../types/configuration";
+import type { ProcedureResolver, TableResolver } from "../types/db";
+/**
+ * Everything the configuration is allowed to point at that only exists once the
+ * databases have been introspected.
+ */
+export type KnownEntities = {
+    tables: TableResolver[];
+    storedProcedures: ProcedureResolver[];
+    /**
+     * Every table name a database reported, keyed by database name and recorded
+     * *before* exclusions are applied. `excludedTables` names are absent from
+     * `tables` by construction, so they cannot be resolved against it.
+     */
+    tableNamesByDatabase: Record<string, string[]>;
+};
+/**
+ * Every name a configuration points at that resolves to nothing, with the config
+ * path that carries it. Returns them all rather than throwing on the first, so a
+ * misconfigured deployment is fixed in one pass.
+ *
+ * A permission naming something that does not exist fails closed — the role
+ * simply loses the entity — which is why these never surfaced on their own: the
+ * rule the operator wrote silently does not apply.
+ */
+export declare const collectCrossReferenceErrors: (configuration: Configuration, known: KnownEntities) => string[];
+//# sourceMappingURL=crossReferences.d.ts.map

package/dist/src/configuration/crossReferences.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crossReferences.d.ts","sourceRoot":"","sources":["../../../src/configuration/crossReferences.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKpE;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAChD,CAAC;AA+GF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,kBACvB,aAAa,SACrB,aAAa,KACnB,MAAM,EAmMR,CAAC"}

package/dist/src/configuration/crossReferences.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=crossReferences.test.d.ts.map

package/dist/src/configuration/crossReferences.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crossReferences.test.d.ts","sourceRoot":"","sources":["../../../src/configuration/crossReferences.test.ts"],"names":[],"mappings":""}

package/dist/src/configuration/getSchemas/index.d.ts

@@ -22,11 +22,41 @@ export declare const getHandlers: (entities: MergedEntities, gqlEntities: GetGQL
                 _no_data: string;
             };
         };
-        hasErrors: (query: string) => {
+        hasErrors: (query: string, options?: {
+            enforceDepthLimit?: boolean;
+            enforceCostLimit?: boolean;
+            variables?: Record<string, unknown>;
+        }) => {
             hasErrors: boolean;
             validationErrors: readonly import("graphql").GraphQLError[];
         };
-        handler: (query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext) => Promise<{
+        handler: (query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+            enforcePageLimits?: boolean;
+            timeoutMs?: number;
+        }) => Promise<{
+            data: any;
+        }>;
+        operatorQuery: (query: Parameters<(query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+            enforcePageLimits?: boolean;
+            timeoutMs?: number;
+        }) => Promise<{
+            data: any;
+        }>>[0], variables?: Parameters<(query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+            enforcePageLimits?: boolean;
+            timeoutMs?: number;
+        }) => Promise<{
+            data: any;
+        }>>[1], req?: Parameters<(query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+            enforcePageLimits?: boolean;
+            timeoutMs?: number;
+        }) => Promise<{
+            data: any;
+        }>>[2], session?: Parameters<(query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+            enforcePageLimits?: boolean;
+            timeoutMs?: number;
+        }) => Promise<{
+            data: any;
+        }>>[3], timeoutMs?: number) => Promise<{
             data: any;
         }>;
     };
@@ -52,11 +82,41 @@ export declare const getSchema: (entityOfRole: EntitiesOfRole, auth?: Auth | nul
                     _no_data: string;
                 };
             };
-            hasErrors: (query: string) => {
+            hasErrors: (query: string, options?: {
+                enforceDepthLimit?: boolean;
+                enforceCostLimit?: boolean;
+                variables?: Record<string, unknown>;
+            }) => {
                 hasErrors: boolean;
                 validationErrors: readonly import("graphql").GraphQLError[];
             };
-            handler: (query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext) => Promise<{
+            handler: (query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+                enforcePageLimits?: boolean;
+                timeoutMs?: number;
+            }) => Promise<{
+                data: any;
+            }>;
+            operatorQuery: (query: Parameters<(query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+                enforcePageLimits?: boolean;
+                timeoutMs?: number;
+            }) => Promise<{
+                data: any;
+            }>>[0], variables?: Parameters<(query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+                enforcePageLimits?: boolean;
+                timeoutMs?: number;
+            }) => Promise<{
+                data: any;
+            }>>[1], req?: Parameters<(query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+                enforcePageLimits?: boolean;
+                timeoutMs?: number;
+            }) => Promise<{
+                data: any;
+            }>>[2], session?: Parameters<(query: string | import("../../analyzeQuery/types").AnalysisResult, variables?: Record<string, unknown>, req?: Bun.BunRequest, session?: import("../../utils/sessionVariables").SessionContext, options?: {
+                enforcePageLimits?: boolean;
+                timeoutMs?: number;
+            }) => Promise<{
+                data: any;
+            }>>[3], timeoutMs?: number) => Promise<{
                 data: any;
             }>;
         };
@@ -128,6 +188,7 @@ export declare const getSchema: (entityOfRole: EntitiesOfRole, auth?: Auth | nul
                     max: number;
                     min: number;
                     idleTimeout: number;
+                    acquireTimeout: number;
                 };
                 connectionTimeout: number;
                 requestTimeout: number;
@@ -236,6 +297,7 @@ export declare const getSchema: (entityOfRole: EntitiesOfRole, auth?: Auth | nul
                     max: number;
                     min: number;
                     idleTimeout: number;
+                    acquireTimeout: number;
                 };
                 connectionTimeout: number;
                 requestTimeout: number;
@@ -439,6 +501,7 @@ export declare const getSchema: (entityOfRole: EntitiesOfRole, auth?: Auth | nul
             updateAgeOnHas: boolean;
             ttlAutopurge: boolean;
         } | undefined;
+        timeout?: number | undefined;
     }>;
     resolverRegistry: import("../../types/resolver").ResolverRegistry;
     getResolverSource: (resolverName: string) => import("./mergeEntities").EntitySource | undefined;
@@ -485,7 +548,6 @@ export declare const getSchema: (entityOfRole: EntitiesOfRole, auth?: Auth | nul
     };
     isVirtualColumn: (table: string, column: string) => import("../../types/configuration").VirtualColumn | undefined;
     columnSqlName: (table: string, fieldName: string) => string;
-    getColumnTypeForOpenApi: (table: string, column: string) => string;
 };
 export type GetSchemaReturn = ReturnType<typeof getSchema>;
 export declare const getSchemas: (tablesAndStoredProceduresForRole: Record<string, EntitiesOfRole>, auth: Auth, gqlSuperadminHandler: HandleGraphQLRequest) => Record<string, {
@@ -552,6 +614,7 @@ export declare const getSchemas: (tablesAndStoredProceduresForRole: Record<strin
                     max: number;
                     min: number;
                     idleTimeout: number;
+                    acquireTimeout: number;
                 };
                 connectionTimeout: number;
                 requestTimeout: number;
@@ -660,6 +723,7 @@ export declare const getSchemas: (tablesAndStoredProceduresForRole: Record<strin
                     max: number;
                     min: number;
                     idleTimeout: number;
+                    acquireTimeout: number;
                 };
                 connectionTimeout: number;
                 requestTimeout: number;
@@ -863,6 +927,7 @@ export declare const getSchemas: (tablesAndStoredProceduresForRole: Record<strin
             updateAgeOnHas: boolean;
             ttlAutopurge: boolean;
         } | undefined;
+        timeout?: number | undefined;
     }>;
     resolverRegistry: import("../../types/resolver").ResolverRegistry;
     getResolverSource: (resolverName: string) => import("./mergeEntities").EntitySource | undefined;
@@ -909,7 +974,6 @@ export declare const getSchemas: (tablesAndStoredProceduresForRole: Record<strin
     };
     isVirtualColumn: (table: string, column: string) => import("../../types/configuration").VirtualColumn | undefined;
     columnSqlName: (table: string, fieldName: string) => string;
-    getColumnTypeForOpenApi: (table: string, column: string) => string;
 } & {
     typeDefs: string;
     schema: GraphQLSchema;

package/dist/src/configuration/getSchemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/configuration/getSchemas/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOtD,eAAO,MAAM,sBAAsB,WAAY,aAAa,yCAAoC,CAAC;AAEjG,eAAO,MAAM,cAAc,mBAAoB,cAAc,YAAW,OAAO;;;;CAO9E,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAErE,eAAO,MAAM,WAAW,aACZ,cAAc,eACX,oBAAoB,SAC3B,IAAI,GAAG,IAAI,yBACK,oBAAoB,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CAQlD,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAErF,eAAO,MAAM,SAAS,iBACN,cAAc,SACtB,IAAI,GAAG,IAAI,yBACK,oBAAoB,GAAG,IAAI,cACtC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWnB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AAE3D,eAAO,MAAM,UAAU,qCACa,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,QAC1D,IAAI,wBACY,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAM1B,8BAA8B;EAS/C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/configuration/getSchemas/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAOtD,eAAO,MAAM,sBAAsB,WAAY,aAAa,yCAAoC,CAAC;AAEjG,eAAO,MAAM,cAAc,mBAAoB,cAAc,YAAW,OAAO;;;;CAO9E,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC;AAErE,eAAO,MAAM,WAAW,aACZ,cAAc,eACX,oBAAoB,SAC3B,IAAI,GAAG,IAAI,yBACK,oBAAoB,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQlD,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC;AAErF,eAAO,MAAM,SAAS,iBACN,cAAc,SACtB,IAAI,GAAG,IAAI,yBACK,oBAAoB,GAAG,IAAI,cACtC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWnB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;AAE3D,eAAO,MAAM,UAAU,qCACa,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,QAC1D,IAAI,wBACY,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAM1B,8BAA8B;EAS/C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC"}