@isaacriehm/cairn 0.1.0

package/dist/uat/probes/integration.js

@@ -0,0 +1,188 @@
+/**
+ * Integration probe — docker-compose orchestration.
+ *
+ * Pipeline:
+ *   1. `docker compose -f <file> up -d <service>` (or up -d if service unset)
+ *   2. Poll ready_check (http or cli) until pass or 60s timeout
+ *   3. Run nested test probe (http or cli)
+ *   4. `docker compose -f <file> down` (always — even on failure)
+ *
+ * Skips when `docker compose` not on PATH OR compose_file doesn't exist.
+ * Operator runs `harness setup:uat-docker` to provision the compose template
+ * and confirm docker availability.
+ */
+import { spawn, spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { logger } from "../../logger.js";
+import { runCliProbe } from "./cli.js";
+import { runHttpProbe } from "./http.js";
+const log = logger("uat.probe.integration");
+function dockerComposeAvailable() {
+    try {
+        const result = spawnSync("docker", ["compose", "--version"], { encoding: "utf8" });
+        return result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function spawnPromise(args) {
+    return new Promise((resolve) => {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), args.timeoutMs ?? 120_000);
+        let stdout = "";
+        let stderr = "";
+        const child = spawn(args.command, args.args, {
+            cwd: args.cwd,
+            signal: ctrl.signal,
+        });
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString("utf8");
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolve({ exitCode: -1, stdout, stderr: stderr + `\n[spawn-error] ${String(err)}` });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            resolve({ exitCode: code ?? -1, stdout, stderr });
+        });
+    });
+}
+async function pollReadyCheck(ready, deadline) {
+    while (Date.now() < deadline) {
+        if (ready.kind === "http") {
+            try {
+                const res = await fetch(ready.url, {
+                    signal: AbortSignal.timeout(ready.timeout_ms ?? 5_000),
+                });
+                if (ready.status === undefined) {
+                    if (res.status >= 200 && res.status < 500)
+                        return { ok: true };
+                }
+                else if (res.status === ready.status) {
+                    return { ok: true };
+                }
+            }
+            catch {
+                // Service not ready yet — continue polling.
+            }
+        }
+        else {
+            const out = await spawnPromise({
+                command: ready.command,
+                args: ready.args,
+                timeoutMs: ready.timeout_ms ?? 5_000,
+            });
+            if (out.exitCode === 0)
+                return { ok: true };
+        }
+        await new Promise((r) => setTimeout(r, 1_000));
+    }
+    return { ok: false, reason: `ready_check timed out` };
+}
+export async function runIntegrationProbe(args) {
+    const startedAt = Date.now();
+    const probe = args.probe;
+    if (!dockerComposeAvailable()) {
+        return {
+            probe_id: probe.id,
+            probe_kind: "integration",
+            passed: false,
+            evidence: "docker compose not on PATH",
+            duration_ms: Date.now() - startedAt,
+            skipped_reason: "docker compose missing — install Docker Desktop or run `harness setup:uat-docker`",
+        };
+    }
+    const composeFile = isAbsolute(probe.compose_file)
+        ? probe.compose_file
+        : join(args.repoRoot ?? process.cwd(), probe.compose_file);
+    if (!existsSync(composeFile)) {
+        return {
+            probe_id: probe.id,
+            probe_kind: "integration",
+            passed: false,
+            evidence: `compose file not found: ${composeFile}`,
+            duration_ms: Date.now() - startedAt,
+            skipped_reason: `compose file ${composeFile} missing — provision via setup:uat-docker`,
+        };
+    }
+    // ── Up ───────────────────────────────────────────────────────────────
+    const up = await spawnPromise({
+        command: "docker",
+        args: ["compose", "-f", composeFile, "up", "-d", probe.service],
+        timeoutMs: 120_000,
+    });
+    if (up.exitCode !== 0) {
+        await teardown(composeFile);
+        return {
+            probe_id: probe.id,
+            probe_kind: "integration",
+            passed: false,
+            evidence: `docker compose up exit=${up.exitCode}; stderr=${up.stderr.slice(0, 200)}`,
+            duration_ms: Date.now() - startedAt,
+            failure_reason: `docker compose up failed: ${up.stderr.slice(0, 400)}`,
+        };
+    }
+    log.info({ probe_id: probe.id, service: probe.service }, "compose up succeeded");
+    // ── Ready check ──────────────────────────────────────────────────────
+    const readyDeadline = Date.now() + 60_000;
+    const ready = await pollReadyCheck(probe.ready_check, readyDeadline);
+    if (!ready.ok) {
+        await teardown(composeFile);
+        return {
+            probe_id: probe.id,
+            probe_kind: "integration",
+            passed: false,
+            evidence: `ready_check failed; service ${probe.service} did not come up`,
+            duration_ms: Date.now() - startedAt,
+            failure_reason: ready.reason ?? "ready_check failed",
+        };
+    }
+    log.info({ probe_id: probe.id }, "ready_check passed");
+    // ── Nested test probe ────────────────────────────────────────────────
+    let testResult;
+    if (probe.test.kind === "http") {
+        testResult = await runHttpProbe({ probe: probe.test });
+    }
+    else if (probe.test.kind === "cli") {
+        testResult = await runCliProbe({ probe: probe.test });
+    }
+    else {
+        await teardown(composeFile);
+        return {
+            probe_id: probe.id,
+            probe_kind: "integration",
+            passed: false,
+            evidence: `nested test probe must be http or cli, got ${probe.test.kind}`,
+            duration_ms: Date.now() - startedAt,
+            failure_reason: "integration probes only nest http/cli probes",
+        };
+    }
+    await teardown(composeFile);
+    return {
+        probe_id: probe.id,
+        probe_kind: "integration",
+        passed: testResult.passed,
+        evidence: `compose ${probe.service} up; test=${testResult.evidence.slice(0, 160)}`,
+        duration_ms: Date.now() - startedAt,
+        ...(testResult.failure_reason !== undefined ? { failure_reason: testResult.failure_reason } : {}),
+    };
+}
+async function teardown(composeFile) {
+    try {
+        await spawnPromise({
+            command: "docker",
+            args: ["compose", "-f", composeFile, "down"],
+            timeoutMs: 60_000,
+        });
+    }
+    catch {
+        // best effort — don't mask the test result
+    }
+}
+//# sourceMappingURL=integration.js.map

package/dist/uat/probes/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../../src/uat/probes/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,GAAG,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAE5C,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAK3B;IACC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;QACxE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;YAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAsC,EACtC,QAAgB;IAEhB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;oBACjC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC;iBACvD,CAAC,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC/B,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;wBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACjE,CAAC;qBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBACtB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC;gBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK;aACrC,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAGzC;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAEzB,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;QAC9B,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,4BAA4B;YACtC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnC,cAAc,EACZ,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC;QAChD,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,2BAA2B,WAAW,EAAE;YAClD,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnC,cAAc,EAAE,gBAAgB,WAAW,2CAA2C;SACvF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC;QAC5B,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC;QAC/D,SAAS,EAAE,OAAO;KACnB,CAAC,CAAC;IACH,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5B,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,0BAA0B,EAAE,CAAC,QAAQ,YAAY,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACpF,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnC,cAAc,EAAE,6BAA6B,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAEjF,wEAAwE;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5B,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,+BAA+B,KAAK,CAAC,OAAO,kBAAkB;YACxE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnC,cAAc,EAAE,KAAK,CAAC,MAAM,IAAI,oBAAoB;SACrD,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAEvD,wEAAwE;IACxE,IAAI,UAA0B,CAAC;IAC/B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,UAAU,GAAG,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrC,UAAU,GAAG,MAAM,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5B,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,8CAA+C,KAAK,CAAC,IAAyB,CAAC,IAAI,EAAE;YAC/F,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACnC,cAAc,EAAE,8CAA8C;SAC/D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE5B,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,WAAW,KAAK,CAAC,OAAO,aAAa,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;QAClF,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACnC,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClG,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,WAAmB;IACzC,IAAI,CAAC;QACH,MAAM,YAAY,CAAC;YACjB,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC;YAC5C,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC"}

package/dist/uat/probes/sql/config.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Load `.harness/config/probes/sql.yaml`.
+ *
+ * Path resolution:
+ *   1. <repoRoot>/.harness/config/probes/sql.yaml — project override
+ *   2. (no fallback; missing config = no sql connections)
+ *
+ * Returns an empty `connections` map when the file is missing so callers
+ * can produce a clean "no such connection" error instead of throwing on
+ * read.
+ */
+import type { SqlConnectionsConfig } from "./types.js";
+export declare function sqlConfigPath(repoRoot: string): string;
+export declare function loadSqlConnections(repoRoot: string): SqlConnectionsConfig;

package/dist/uat/probes/sql/config.js

@@ -0,0 +1,57 @@
+/**
+ * Load `.harness/config/probes/sql.yaml`.
+ *
+ * Path resolution:
+ *   1. <repoRoot>/.harness/config/probes/sql.yaml — project override
+ *   2. (no fallback; missing config = no sql connections)
+ *
+ * Returns an empty `connections` map when the file is missing so callers
+ * can produce a clean "no such connection" error instead of throwing on
+ * read.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+export function sqlConfigPath(repoRoot) {
+    return join(repoRoot, ".harness", "config", "probes", "sql.yaml");
+}
+export function loadSqlConnections(repoRoot) {
+    const path = sqlConfigPath(repoRoot);
+    if (!existsSync(path))
+        return { connections: {} };
+    const raw = parseYaml(readFileSync(path, "utf8"));
+    const connectionsRaw = (raw["connections"] ?? {});
+    const connections = {};
+    for (const [key, value] of Object.entries(connectionsRaw)) {
+        if (typeof value !== "object" || value === null)
+            continue;
+        const v = value;
+        const driver = v["driver"];
+        if (driver === "sqlite" && typeof v["file"] === "string") {
+            connections[key] = { driver: "sqlite", file: v["file"] };
+        }
+        else if (driver === "postgres" && typeof v["host"] === "string" && typeof v["database"] === "string") {
+            connections[key] = {
+                driver: "postgres",
+                host: v["host"],
+                database: v["database"],
+                ...(typeof v["port"] === "number" ? { port: v["port"] } : {}),
+                ...(typeof v["user_env"] === "string" ? { user_env: v["user_env"] } : {}),
+                ...(typeof v["password_env"] === "string" ? { password_env: v["password_env"] } : {}),
+                ...(typeof v["ssl"] === "boolean" ? { ssl: v["ssl"] } : {}),
+            };
+        }
+        else if (driver === "mysql" && typeof v["host"] === "string" && typeof v["database"] === "string") {
+            connections[key] = {
+                driver: "mysql",
+                host: v["host"],
+                database: v["database"],
+                ...(typeof v["port"] === "number" ? { port: v["port"] } : {}),
+                ...(typeof v["user_env"] === "string" ? { user_env: v["user_env"] } : {}),
+                ...(typeof v["password_env"] === "string" ? { password_env: v["password_env"] } : {}),
+            };
+        }
+    }
+    return { connections };
+}
+//# sourceMappingURL=config.js.map

package/dist/uat/probes/sql/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/uat/probes/sql/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAG1C,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;IAC7E,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC7E,MAAM,WAAW,GAAkC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,CAAC;aAAM,IAAI,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;YACvG,WAAW,CAAC,GAAG,CAAC,GAAG;gBACjB,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;gBACvB,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpG,WAAW,CAAC,GAAG,CAAC,GAAG;gBACjB,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;gBACvB,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC"}

package/dist/uat/probes/sql/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SQL driver dispatcher.
+ *
+ * Loads `.harness/config/probes/sql.yaml`, resolves the SqlProbe's
+ * `connection` key to a typed connection config, and routes the query
+ * to the matching driver.
+ */
+import type { SqlConnection, SqlDriver, SqlQueryResult } from "./types.js";
+import { mysqlDriver } from "./mysql.js";
+import { pgDriver } from "./pg.js";
+import { sqliteDriver } from "./sqlite.js";
+export type { SqlConnection, SqlConnectionsConfig, SqlDriver, SqlDriverKind, SqlQueryResult, SqliteConnection, PostgresConnection, MysqlConnection } from "./types.js";
+export { loadSqlConnections, sqlConfigPath } from "./config.js";
+export { sqliteDriver, pgDriver, mysqlDriver };
+export interface ResolveConnectionResult {
+    connection: SqlConnection;
+    driver: SqlDriver;
+}
+export declare class SqlConnectionMissingError extends Error {
+    constructor(key: string);
+}
+/** Look up a connection by key + driver from the project config. */
+export declare function resolveConnection(repoRoot: string, key: string): ResolveConnectionResult | null;
+/** Run a query through the dispatcher. Throws on missing connection or driver error. */
+export declare function runQuery(args: {
+    repoRoot: string;
+    connectionKey: string;
+    sql: string;
+}): Promise<SqlQueryResult>;

package/dist/uat/probes/sql/index.js

@@ -0,0 +1,43 @@
+/**
+ * SQL driver dispatcher.
+ *
+ * Loads `.harness/config/probes/sql.yaml`, resolves the SqlProbe's
+ * `connection` key to a typed connection config, and routes the query
+ * to the matching driver.
+ */
+import { loadSqlConnections } from "./config.js";
+import { mysqlDriver } from "./mysql.js";
+import { pgDriver } from "./pg.js";
+import { sqliteDriver } from "./sqlite.js";
+export { loadSqlConnections, sqlConfigPath } from "./config.js";
+export { sqliteDriver, pgDriver, mysqlDriver };
+const DRIVERS = {
+    sqlite: sqliteDriver,
+    postgres: pgDriver,
+    mysql: mysqlDriver,
+};
+export class SqlConnectionMissingError extends Error {
+    constructor(key) {
+        super(`sql connection "${key}" not configured — add it to .harness/config/probes/sql.yaml or run \`harness setup:uat-sql\``);
+        this.name = "SqlConnectionMissingError";
+    }
+}
+/** Look up a connection by key + driver from the project config. */
+export function resolveConnection(repoRoot, key) {
+    const config = loadSqlConnections(repoRoot);
+    const connection = config.connections[key];
+    if (!connection)
+        return null;
+    const driver = DRIVERS[connection.driver];
+    if (!driver)
+        return null;
+    return { connection, driver };
+}
+/** Run a query through the dispatcher. Throws on missing connection or driver error. */
+export async function runQuery(args) {
+    const resolved = resolveConnection(args.repoRoot, args.connectionKey);
+    if (!resolved)
+        throw new SqlConnectionMissingError(args.connectionKey);
+    return resolved.driver.query(resolved.connection, args.sql);
+}
+//# sourceMappingURL=index.js.map

package/dist/uat/probes/sql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/uat/probes/sql/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAE/C,MAAM,OAAO,GAA8B;IACzC,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,WAAW;CACnB,CAAC;AAOF,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,GAAW;QACrB,KAAK,CACH,mBAAmB,GAAG,+FAA+F,CACtH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,GAAW;IAC7D,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAI9B;IACC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC"}

package/dist/uat/probes/sql/mysql.d.ts

@@ -0,0 +1,12 @@
+/**
+ * MySQL SQL probe driver — live.
+ *
+ * Lazy-loads `mysql2/promise`. Adopting projects opt in via
+ * `harness setup:uat-sql --driver mysql --install`.
+ *
+ * READ-ONLY by contract — the upstream regex gate rejects mutating
+ * queries. We also issue `SET SESSION TRANSACTION READ ONLY` before the
+ * query as defense-in-depth.
+ */
+import type { SqlDriver } from "./types.js";
+export declare const mysqlDriver: SqlDriver;

package/dist/uat/probes/sql/mysql.js

@@ -0,0 +1,96 @@
+/**
+ * MySQL SQL probe driver — live.
+ *
+ * Lazy-loads `mysql2/promise`. Adopting projects opt in via
+ * `harness setup:uat-sql --driver mysql --install`.
+ *
+ * READ-ONLY by contract — the upstream regex gate rejects mutating
+ * queries. We also issue `SET SESSION TRANSACTION READ ONLY` before the
+ * query as defense-in-depth.
+ */
+import { logger } from "../../../logger.js";
+const log = logger("uat.probe.sql.mysql");
+let cachedPromise;
+async function loadMysql() {
+    if (cachedPromise !== undefined)
+        return cachedPromise;
+    try {
+        const mod = (await import(
+        /* @vite-ignore */ "mysql2/promise").catch(async () => (await import(/* @vite-ignore */ "mysql2").catch(() => null))));
+        if (!mod) {
+            cachedPromise = null;
+            return null;
+        }
+        if (mod.promise) {
+            cachedPromise = mod.promise;
+            return mod.promise;
+        }
+        if (mod.default?.promise) {
+            cachedPromise = mod.default.promise;
+            return mod.default.promise;
+        }
+        if (mod.createConnection) {
+            cachedPromise = { createConnection: mod.createConnection };
+            return cachedPromise;
+        }
+        cachedPromise = null;
+        return null;
+    }
+    catch {
+        cachedPromise = null;
+        return null;
+    }
+}
+export const mysqlDriver = {
+    kind: "mysql",
+    async query(connection, sql) {
+        if (connection.driver !== "mysql") {
+            throw new Error(`mysql driver received non-mysql connection: ${connection.driver}`);
+        }
+        const promise = await loadMysql();
+        if (!promise) {
+            throw new Error("mysql2 client not installed — run `pnpm add -D mysql2` then re-run `harness setup:uat-sql --driver mysql`");
+        }
+        const conn = connection;
+        const user = conn.user_env ? process.env[conn.user_env] : undefined;
+        const password = conn.password_env ? process.env[conn.password_env] : undefined;
+        const config = {
+            host: conn.host,
+            database: conn.database,
+            connectTimeout: 30_000,
+        };
+        if (conn.port !== undefined)
+            config.port = conn.port;
+        if (user !== undefined)
+            config.user = user;
+        if (password !== undefined)
+            config.password = password;
+        const client = await promise.createConnection(config);
+        try {
+            // Defense-in-depth read-only session.
+            try {
+                await client.query("SET SESSION TRANSACTION READ ONLY");
+            }
+            catch {
+                // Best effort — older MySQL may not support; the regex gate is
+                // primary protection.
+            }
+            const [rowsRaw] = await client.query(sql);
+            const rows = Array.isArray(rowsRaw)
+                ? rowsRaw
+                : [];
+            log.debug({ host: conn.host, database: conn.database, rowcount: rows.length }, "mysql query complete");
+            const out = { rowcount: rows.length, rows };
+            return out;
+        }
+        finally {
+            try {
+                await client.end();
+            }
+            catch {
+                // best effort
+            }
+        }
+    },
+};
+//# sourceMappingURL=mysql.js.map

package/dist/uat/probes/sql/mysql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mysql.js","sourceRoot":"","sources":["../../../../src/uat/probes/sql/mysql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAO5C,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAwB1C,IAAI,aAA8C,CAAC;AAEnD,KAAK,UAAU,SAAS;IACtB,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM;QACvB,kBAAkB,CAAC,gBAA0B,CAC9C,CAAC,KAAK,CACL,KAAK,IAAI,EAAE,CACT,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,QAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAwB,CACjG,CAAwB,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,aAAa,GAAG,IAAI,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;YACpC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7B,CAAC;QACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzB,aAAa,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC3D,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,aAAa,GAAG,IAAI,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,IAAI,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAc;IACpC,IAAI,EAAE,OAAO;IACb,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG;QACzB,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,UAA6B,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,MAAM,GAOR;YACF,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,MAAM;SACvB,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrD,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,sCAAsC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;gBAC/D,sBAAsB;YACxB,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,IAAI,GAA8B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC5D,CAAC,CAAE,OAAqC;gBACxC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,KAAK,CACP,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EACnE,sBAAsB,CACvB,CAAC;YACF,MAAM,GAAG,GAAmB,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/uat/probes/sql/pg.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Postgres SQL probe driver — live.
+ *
+ * Lazy-loads `pg` so the harness package install stays lean. Adopting
+ * projects opt in via `harness setup:uat-sql --driver postgres --install`,
+ * which adds `pg` to their devDeps + writes a connection template to
+ * `.harness/config/probes/sql.yaml`.
+ *
+ * Connection credentials live in env vars referenced from the YAML
+ * (`user_env: PGUSER`, `password_env: PGPASSWORD`) — never literal in
+ * config files. Per operator preference: secrets in env, host/port/db in
+ * YAML.
+ *
+ * READ-ONLY by contract — the upstream `runSqlProbe` regex gate rejects
+ * any query that doesn't start with SELECT/WITH/SHOW/EXPLAIN/PRAGMA. We
+ * also wrap each query in a `BEGIN READ ONLY ... ROLLBACK` cycle as
+ * defense-in-depth so a bug elsewhere can't accidentally mutate.
+ */
+import type { SqlDriver } from "./types.js";
+export declare const pgDriver: SqlDriver;

package/dist/uat/probes/sql/pg.js

@@ -0,0 +1,102 @@
+/**
+ * Postgres SQL probe driver — live.
+ *
+ * Lazy-loads `pg` so the harness package install stays lean. Adopting
+ * projects opt in via `harness setup:uat-sql --driver postgres --install`,
+ * which adds `pg` to their devDeps + writes a connection template to
+ * `.harness/config/probes/sql.yaml`.
+ *
+ * Connection credentials live in env vars referenced from the YAML
+ * (`user_env: PGUSER`, `password_env: PGPASSWORD`) — never literal in
+ * config files. Per operator preference: secrets in env, host/port/db in
+ * YAML.
+ *
+ * READ-ONLY by contract — the upstream `runSqlProbe` regex gate rejects
+ * any query that doesn't start with SELECT/WITH/SHOW/EXPLAIN/PRAGMA. We
+ * also wrap each query in a `BEGIN READ ONLY ... ROLLBACK` cycle as
+ * defense-in-depth so a bug elsewhere can't accidentally mutate.
+ */
+import { logger } from "../../../logger.js";
+const log = logger("uat.probe.sql.pg");
+let cachedCtor;
+async function loadPg() {
+    if (cachedCtor !== undefined)
+        return cachedCtor;
+    try {
+        const mod = (await import(
+        /* @vite-ignore */ "pg").catch(() => null));
+        if (!mod) {
+            cachedCtor = null;
+            return null;
+        }
+        const ctor = mod.Client ?? mod.default?.Client ?? null;
+        cachedCtor = ctor;
+        return ctor;
+    }
+    catch {
+        cachedCtor = null;
+        return null;
+    }
+}
+export const pgDriver = {
+    kind: "postgres",
+    async query(connection, sql) {
+        if (connection.driver !== "postgres") {
+            throw new Error(`pg driver received non-postgres connection: ${connection.driver}`);
+        }
+        const Ctor = await loadPg();
+        if (!Ctor) {
+            throw new Error("pg client not installed — run `pnpm add -D pg @types/pg` then re-run `harness setup:uat-sql --driver postgres`");
+        }
+        const conn = connection;
+        const user = conn.user_env ? process.env[conn.user_env] : undefined;
+        const password = conn.password_env ? process.env[conn.password_env] : undefined;
+        const config = {
+            host: conn.host,
+            database: conn.database,
+            statement_timeout: 30_000,
+        };
+        if (conn.port !== undefined)
+            config.port = conn.port;
+        if (user !== undefined)
+            config.user = user;
+        if (password !== undefined)
+            config.password = password;
+        if (conn.ssl === true)
+            config.ssl = true;
+        const client = new Ctor(config);
+        try {
+            await client.connect();
+            // Defense-in-depth: read-only transaction wrapper. Any DDL/DML the
+            // gate misses is forced to roll back. SELECT works inside RO.
+            await client.query("BEGIN TRANSACTION READ ONLY");
+            let result;
+            try {
+                result = await client.query(sql);
+            }
+            finally {
+                try {
+                    await client.query("ROLLBACK");
+                }
+                catch {
+                    // best effort
+                }
+            }
+            log.debug({ host: conn.host, database: conn.database, rowcount: result.rows.length }, "pg query complete");
+            const out = {
+                rowcount: result.rowCount ?? result.rows.length,
+                rows: result.rows,
+            };
+            return out;
+        }
+        finally {
+            try {
+                await client.end();
+            }
+            catch {
+                // best effort
+            }
+        }
+    },
+};
+//# sourceMappingURL=pg.js.map

package/dist/uat/probes/sql/pg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg.js","sourceRoot":"","sources":["../../../../src/uat/probes/sql/pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAO5C,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AA8BvC,IAAI,UAA2C,CAAC;AAEhD,KAAK,UAAU,MAAM;IACnB,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM;QACvB,kBAAkB,CAAC,IAAc,CAClC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAoB,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAwB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;QAC5E,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,IAAI,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAc;IACjC,IAAI,EAAE,UAAU;IAChB,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG;QACzB,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,+CAA+C,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,UAAgC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,MAAM,GAQR;YACF,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,iBAAiB,EAAE,MAAM;SAC1B,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACrD,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACvD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,mEAAmE;YACnE,8DAA8D;YAC9D,MAAM,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAClD,IAAI,MAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;YACH,CAAC;YACD,GAAG,CAAC,KAAK,CACP,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAC1E,mBAAmB,CACpB,CAAC;YACF,MAAM,GAAG,GAAmB;gBAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC/C,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;YACF,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/uat/probes/sql/sqlite.d.ts

@@ -0,0 +1,9 @@
+/**
+ * sqlite driver — lazy-loads `better-sqlite3`.
+ *
+ * v1 sqlite is the only fully-functional driver. Operator runs
+ * `harness setup:uat-sql` to install better-sqlite3; smoke skips
+ * gracefully if the package is missing.
+ */
+import type { SqlDriver } from "./types.js";
+export declare const sqliteDriver: SqlDriver;