@nifrajs/cli 3.3.0 → 4.0.0

package/dist/db-audit.js

@@ -0,0 +1,99 @@
+/**
+ * `.nifra/db-audit.jsonl`: one line per `nifra db` call - what ran, never what came back. Each entry
+ * carries the SQL (secrets redacted), its fingerprint, the row count, the duration and the refusal
+ * code. The file is owner-only, never followed through a symlink, and rotates at 1 MB to
+ * `db-audit.1.jsonl`, so it stays bounded.
+ */
+import { createHash } from "node:crypto";
+import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, writeSync, } from "node:fs";
+import { resolve } from "node:path";
+export const DB_AUDIT_FILE = ".nifra/db-audit.jsonl";
+export const DB_AUDIT_ROTATED_FILE = ".nifra/db-audit.1.jsonl";
+export const DB_AUDIT_MAX_BYTES = 1024 * 1024;
+/** A statement's shape: literals become `?`, whitespace collapses, case folds; hashed. */
+export function sqlFingerprint(sql) {
+    const shape = sql
+        .replace(/--[^\n]*/g, " ")
+        .replace(/\/\*[\s\S]*?\*\//g, " ")
+        .replace(/'(?:[^']|'')*'/g, "?")
+        .replace(/\b\d+(?:\.\d+)?\b/g, "?")
+        .replace(/\s+/g, " ")
+        .trim()
+        .toLowerCase();
+    return createHash("sha256").update(shape).digest("hex").slice(0, 16);
+}
+/** True when `path` exists and is a symlink: the audit never writes through one. */
+function isSymlink(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Append one entry. Returns false (and writes nothing) when `.nifra` or the log is a symlink or the
+ * write fails - an audit problem never fails the call it records.
+ */
+export function appendDbAudit(root, entry) {
+    const dir = resolve(root, ".nifra");
+    const file = resolve(root, DB_AUDIT_FILE);
+    try {
+        if (isSymlink(dir))
+            return false;
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (isSymlink(file))
+            return false;
+        const line = `${JSON.stringify(entry)}\n`;
+        if (existsSync(file) && lstatSync(file).size + Buffer.byteLength(line) > DB_AUDIT_MAX_BYTES) {
+            const rotated = resolve(root, DB_AUDIT_ROTATED_FILE);
+            if (isSymlink(rotated))
+                return false;
+            renameSync(file, rotated);
+        }
+        const fd = openSync(file, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+        try {
+            writeSync(fd, line);
+        }
+        finally {
+            closeSync(fd);
+        }
+        chmodSync(file, 0o600);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** True for a line `appendDbAudit` wrote (its required fields, at least). */
+export const isDbAuditEntry = (value) => typeof value === "object" &&
+    value !== null &&
+    "at" in value &&
+    typeof value.at === "string" &&
+    "tool" in value &&
+    typeof value.tool === "string" &&
+    "ok" in value &&
+    typeof value.ok === "boolean";
+/** The newest `limit` entries, oldest first, across the current and the rotated file. */
+export function readDbAudit(root, limit) {
+    const entries = [];
+    for (const name of [DB_AUDIT_ROTATED_FILE, DB_AUDIT_FILE]) {
+        const path = resolve(root, name);
+        if (!existsSync(path) || isSymlink(path))
+            continue;
+        for (const line of readFileSync(path, "utf8").split("\n")) {
+            if (line.trim() === "")
+                continue;
+            try {
+                const parsed = JSON.parse(line);
+                if (isDbAuditEntry(parsed))
+                    entries.push(parsed);
+            }
+            catch {
+                // A torn last line from a killed writer is skipped, not fatal.
+            }
+        }
+    }
+    return entries.slice(-limit);
+}
+//# sourceMappingURL=db-audit.js.map

package/dist/db-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-audit.js","sourceRoot":"","sources":["../src/db-audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGnC,MAAM,CAAC,MAAM,aAAa,GAAG,uBAAuB,CAAA;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAA;AAC9D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAA;AAkB7C,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG;SACd,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;SACzB,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACjC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;SAClC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,WAAW,EAAE,CAAA;IAChB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACtE,CAAC;AAED,oFAAoF;AACpF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAmB;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAChC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAChD,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACjC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAA;QACzC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,kBAAkB,EAAE,CAAC;YAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;YACpD,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;YACpC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC3B,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CACjB,IAAI,EACJ,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,UAAU,EAClF,KAAK,CACN,CAAA;QACD,IAAI,CAAC;YACH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACrB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAA;QACf,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAyB,EAAE,CACtE,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,IAAI,IAAI,KAAK;IACb,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;IAC5B,MAAM,IAAI,KAAK;IACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;IAC9B,IAAI,IAAI,KAAK;IACb,OAAO,KAAK,CAAC,EAAE,KAAK,SAAS,CAAA;AAE/B,yFAAyF;AACzF,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,OAAO,GAAmB,EAAE,CAAA;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,qBAAqB,EAAE,aAAa,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC;YAAE,SAAQ;QAClD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAQ;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACxC,IAAI,cAAc,CAAC,MAAM,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAClD,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC"}

package/dist/db-child.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The `nifra db` subprocess. The parent (`db-tool.ts`) spawns a fresh one per call: it applies the
+ * project's `.env` files, imports `nifra.config.ts`, reports the declared deadline, opens the database,
+ * runs one operation, prints the answer and exits. The parent kills it at the deadline, so the deadline
+ * bounds the work and not only the response.
+ *
+ * Protocol: one JSON request on stdin; answers on stdout as lines prefixed with the request's token,
+ * so anything the config prints cannot be read as an answer.
+ */
+import { type DbPlan, type DbRedaction, type DbRefusal, type DbRows, type DbSchemaReport } from "@nifrajs/mcp-db/engine";
+import { type PostgresRoleSql } from "@nifrajs/mcp-db/postgres";
+import { type DevDatabase } from "./db-config.js";
+/** The one operation a subprocess runs. */
+export interface DbChildRequest {
+    readonly op: "schema" | "query" | "explain" | "role";
+    readonly sql?: string | undefined;
+    readonly table?: string | undefined;
+    readonly analyze?: boolean | undefined;
+}
+/** What an operation produced, before the parent adds timing and the untrusted-data note. */
+export type DbChildAnswer = {
+    readonly ok: true;
+    readonly engine: DevDatabase["kind"];
+    readonly database: string;
+    readonly durationMs: number;
+    readonly schema?: DbSchemaReport;
+    readonly rows?: DbRows;
+    readonly plan?: DbPlan;
+    readonly role?: Omit<PostgresRoleSql, "serverVersionNum"> | {
+        readonly statements: [];
+    };
+} | {
+    readonly ok: false;
+    readonly engine?: DevDatabase["kind"] | undefined;
+    readonly database?: string | undefined;
+    readonly durationMs: number;
+    readonly refusal: DbRefusal;
+};
+/** The lines a subprocess writes, after its token. */
+export type DbChildMessage = {
+    readonly type: "ready";
+    readonly timeoutMs: number;
+} | {
+    readonly type: "answer";
+    readonly answer: DbChildAnswer;
+};
+/**
+ * The masked columns a query may not read (the credential-name classifier, plus `redactColumns`,
+ * minus `revealColumns`) and the dev feed's text redactor for every string value.
+ */
+export declare function dbRedaction(root: string, db: DevDatabase, env?: Readonly<Record<string, string | undefined>>): DbRedaction;
+/** Run one operation against a loaded declaration. Every refusal message is redacted too. */
+export declare function runDbOperation(root: string, request: DbChildRequest, db: DevDatabase): Promise<DbChildAnswer>;
+/** Validate the parent's request (it crosses a process boundary). */
+export declare function parseDbChildRequest(text: string): (DbChildRequest & {
+    readonly token: string;
+}) | undefined;
+/**
+ * Serve one request: read it from `input`, load the declaration, report the deadline, run the
+ * operation and write the answer through `write`, each line prefixed with the request's token.
+ * Returns false (writing nothing) for a malformed request.
+ */
+export declare function serveDbChild(root: string, input: ReadableStream<Uint8Array>, write: (line: string) => Promise<void>): Promise<boolean>;
+//# sourceMappingURL=db-child.d.ts.map

package/dist/db-child.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-child.d.ts","sourceRoot":"","sources":["../src/db-child.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,cAAc,EAQpB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAGL,KAAK,eAAe,EAKrB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,gBAAgB,CAAA;AAGlE,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CACvC;AAED,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG;QAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAA;KAAE,CAAA;CACxF,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAC5B,CAAA;AAEL,sDAAsD;AACtD,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,CAAA;AAI/D;;;GAGG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,WAAW,EACf,GAAG,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GAC9D,WAAW,CASb;AAwFD,6FAA6F;AAC7F,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,cAAc,EACvB,EAAE,EAAE,WAAW,GACd,OAAO,CAAC,aAAa,CAAC,CAoBxB;AAID,qEAAqE;AACrE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GACX,CAAC,cAAc,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAoB3D;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EACjC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACrC,OAAO,CAAC,OAAO,CAAC,CAyBlB"}

package/dist/db-child.js

@@ -0,0 +1,213 @@
+/**
+ * The `nifra db` subprocess. The parent (`db-tool.ts`) spawns a fresh one per call: it applies the
+ * project's `.env` files, imports `nifra.config.ts`, reports the declared deadline, opens the database,
+ * runs one operation, prints the answer and exits. The parent kills it at the deadline, so the deadline
+ * bounds the work and not only the response.
+ *
+ * Protocol: one JSON request on stdin; answers on stdout as lines prefixed with the request's token,
+ * so anything the config prints cannot be read as an answer.
+ */
+import { dbRefusal, explainSqlite, isDbRefusal, openReadOnlySqlite, querySqlite, readSqliteSchema, resolveSqliteFile, } from "@nifrajs/mcp-db/engine";
+import { connectPostgres, explainPostgres, parsePostgresUrl, postgresRoleSql, queryPostgres, readPostgresSchema, } from "@nifrajs/mcp-db/postgres";
+import { createDevFeed } from "@nifrajs/web/dev-feed";
+import { isSensitiveFieldName } from "@nifrajs/web/zones";
+import { loadDevDatabase } from "./db-config.js";
+import { CHILD_INPUT_MAX_BYTES, readBoundedStream } from "./mcp-io.js";
+const lower = (name) => name.toLowerCase();
+/**
+ * The masked columns a query may not read (the credential-name classifier, plus `redactColumns`,
+ * minus `revealColumns`) and the dev feed's text redactor for every string value.
+ */
+export function dbRedaction(root, db, env = process.env) {
+    const redact = new Set(db.redactColumns.map(lower));
+    const reveal = new Set(db.revealColumns.map(lower));
+    const feed = createDevFeed({ root, persist: false, env });
+    return {
+        column: (name) => !reveal.has(lower(name)) && (isSensitiveFieldName(name) || redact.has(lower(name))),
+        text: (value) => feed.redact(value),
+    };
+}
+const QUERY_OFF = () => dbRefusal("NIFRA_DB_QUERY_OFF", "devDatabase.query is false: only the schema tool is on");
+async function runSqlite(root, request, db, redaction) {
+    if (request.op === "role") {
+        return { ok: true, engine: "sqlite", database: db.file, role: { statements: [] } };
+    }
+    if (request.op !== "schema" && !db.query)
+        return QUERY_OFF();
+    const file = resolveSqliteFile(root, db.file, db.allowFiles);
+    if (isDbRefusal(file))
+        return file;
+    let handle;
+    try {
+        handle = await openReadOnlySqlite(file);
+    }
+    catch (error) {
+        return dbRefusal("NIFRA_DB_DRIVER", `could not open ${db.file}: ${String(error)}`);
+    }
+    try {
+        const base = { ok: true, engine: "sqlite", database: db.file };
+        if (request.op === "schema") {
+            const schema = readSqliteSchema(handle, {
+                exclude: db.exclude,
+                redaction,
+                table: request.table,
+            });
+            return isDbRefusal(schema) ? schema : { ...base, schema };
+        }
+        if (request.op === "explain") {
+            const plan = explainSqlite(handle, request.sql ?? "", db);
+            return isDbRefusal(plan) ? plan : { ...base, plan };
+        }
+        const rows = querySqlite(handle, request.sql ?? "", { ...db, redaction });
+        return isDbRefusal(rows) ? rows : { ...base, rows };
+    }
+    finally {
+        handle.close();
+    }
+}
+async function runPostgres(request, db, redaction) {
+    if ((request.op === "query" || request.op === "explain") && !db.query)
+        return QUERY_OFF();
+    const target = parsePostgresUrl(db.url);
+    if (isDbRefusal(target))
+        return target;
+    const database = `${target.host ?? target.socket}:${target.port}/${target.database}`;
+    const client = connectPostgres(target, db);
+    if (isDbRefusal(client))
+        return client;
+    const base = { ok: true, engine: "postgres", database };
+    try {
+        if (request.op === "schema") {
+            const schema = await readPostgresSchema(client, {
+                ...db,
+                redaction,
+                table: request.table,
+            });
+            return isDbRefusal(schema) ? schema : { ...base, schema };
+        }
+        if (request.op === "role") {
+            const role = await postgresRoleSql(client, db);
+            if (isDbRefusal(role))
+                return role;
+            return {
+                ...base,
+                role: { role: role.role, database: role.database, statements: role.statements },
+            };
+        }
+        if (request.op === "explain") {
+            const plan = await explainPostgres(client, request.sql ?? "", {
+                ...db,
+                redaction,
+                analyze: request.analyze === true,
+            });
+            return isDbRefusal(plan) ? plan : { ...base, plan };
+        }
+        const rows = await queryPostgres(client, request.sql ?? "", { ...db, redaction });
+        return isDbRefusal(rows) ? rows : { ...base, rows };
+    }
+    finally {
+        await client.close({ timeout: 0 }).catch(() => { });
+    }
+}
+/** Run one operation against a loaded declaration. Every refusal message is redacted too. */
+export async function runDbOperation(root, request, db) {
+    const started = performance.now();
+    const redaction = dbRedaction(root, db);
+    let outcome;
+    try {
+        outcome =
+            db.kind === "sqlite"
+                ? await runSqlite(root, request, db, redaction)
+                : await runPostgres(request, db, redaction);
+    }
+    catch (error) {
+        outcome = dbRefusal("NIFRA_DB_DRIVER", error instanceof Error ? error.message : String(error));
+    }
+    const durationMs = Math.round(performance.now() - started);
+    if (!isDbRefusal(outcome))
+        return { ...outcome, durationMs };
+    return {
+        ok: false,
+        engine: db.kind,
+        durationMs,
+        refusal: { ...outcome, message: redaction.text?.(outcome.message) ?? outcome.message },
+    };
+}
+const OPS = ["schema", "query", "explain", "role"];
+/** Validate the parent's request (it crosses a process boundary). */
+export function parseDbChildRequest(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof value !== "object" || value === null)
+        return undefined;
+    const field = (key) => Reflect.get(value, key);
+    const token = field("token");
+    const op = OPS.find((name) => name === field("op"));
+    const sql = field("sql");
+    const table = field("table");
+    const analyze = field("analyze");
+    if (typeof token !== "string" || !/^[0-9a-f-]{16,64}$/.test(token))
+        return undefined;
+    if (op === undefined)
+        return undefined;
+    if (sql !== undefined && typeof sql !== "string")
+        return undefined;
+    if (table !== undefined && typeof table !== "string")
+        return undefined;
+    if (analyze !== undefined && typeof analyze !== "boolean")
+        return undefined;
+    return { token, op, sql, table, analyze };
+}
+/**
+ * Serve one request: read it from `input`, load the declaration, report the deadline, run the
+ * operation and write the answer through `write`, each line prefixed with the request's token.
+ * Returns false (writing nothing) for a malformed request.
+ */
+export async function serveDbChild(root, input, write) {
+    const text = await readBoundedStream(input, CHILD_INPUT_MAX_BYTES);
+    const request = text.truncated ? undefined : parseDbChildRequest(text.text);
+    if (request === undefined)
+        return false;
+    const send = (message) => write(`${request.token} ${JSON.stringify(message)}\n`);
+    const started = performance.now();
+    let answer;
+    try {
+        const db = await loadDevDatabase(root);
+        if (isDbRefusal(db)) {
+            answer = { ok: false, durationMs: Math.round(performance.now() - started), refusal: db };
+        }
+        else {
+            await send({ type: "ready", timeoutMs: db.timeoutMs });
+            answer = await runDbOperation(root, request, db);
+        }
+    }
+    catch (error) {
+        answer = {
+            ok: false,
+            durationMs: Math.round(performance.now() - started),
+            refusal: dbRefusal("NIFRA_DB_DRIVER", error instanceof Error ? error.message : String(error)),
+        };
+    }
+    await send({ type: "answer", answer });
+    return true;
+}
+if (import.meta.main) {
+    // Bound before the config loads, so nothing it patches can reach the protocol channel.
+    const stdout = process.stdout.write.bind(process.stdout);
+    const toStderr = (...args) => {
+        process.stderr.write(`${args.map((arg) => String(arg)).join(" ")}\n`);
+    };
+    console.log = toStderr;
+    console.info = toStderr;
+    console.debug = toStderr;
+    const served = await serveDbChild(process.argv[2] ?? process.cwd(), Bun.stdin.stream(), (line) => new Promise((done) => stdout(line, () => done())));
+    if (!served)
+        process.stderr.write("nifra db: invalid request\n");
+    process.exit(served ? 0 : 2);
+}
+//# sourceMappingURL=db-child.js.map

package/dist/db-child.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-child.js","sourceRoot":"","sources":["../src/db-child.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAML,SAAS,EACT,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,eAAe,EACf,eAAe,EAEf,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,kBAAkB,GACnB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAoB,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAClE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAmCtE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;AAE1D;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,IAAY,EACZ,EAAe,EACf,MAAoD,OAAO,CAAC,GAAG;IAE/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IACzD,OAAO;QACL,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KACpC,CAAA;AACH,CAAC;AAED,MAAM,SAAS,GAAG,GAAc,EAAE,CAChC,SAAS,CAAC,oBAAoB,EAAE,wDAAwD,CAAC,CAAA;AAE3F,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,OAAuB,EACvB,EAA4C,EAC5C,SAAsB;IAEtB,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAA;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,KAAK;QAAE,OAAO,SAAS,EAAE,CAAA;IAC5D,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,CAAA;IAC5D,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,MAAsD,CAAA;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,QAAiB,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;QAChF,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE;gBACtC,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,SAAS;gBACT,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAA;YACF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAA;QAC3D,CAAC;QACD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;YACzD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QACzE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAuB,EACvB,EAA8C,EAC9C,SAAsB;IAEtB,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK;QAAE,OAAO,SAAS,EAAE,CAAA;IACzF,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACtC,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAA;IACpF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC1C,IAAI,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IACtC,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,UAAmB,EAAE,QAAQ,EAAE,CAAA;IACzE,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE;gBAC9C,GAAG,EAAE;gBACL,SAAS;gBACT,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAA;YACF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAA;QAC3D,CAAC;QACD,IAAI,OAAO,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC9C,IAAI,WAAW,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAA;YAClC,OAAO;gBACL,GAAG,IAAI;gBACP,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;aAChF,CAAA;QACH,CAAC;QACD,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE;gBAC5D,GAAG,EAAE;gBACL,SAAS;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;aAClC,CAAC,CAAA;YACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QACjF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACpD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAY,EACZ,OAAuB,EACvB,EAAe;IAEf,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACvC,IAAI,OAA6E,CAAA;IACjF,IAAI,CAAC;QACH,OAAO;YACL,EAAE,CAAC,IAAI,KAAK,QAAQ;gBAClB,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC;gBAC/C,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,SAAS,CAAC,iBAAiB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAA;IAC1D,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAA;IAC5D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,EAAE,CAAC,IAAI;QACf,UAAU;QACV,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE;KACvF,CAAA;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAU,CAAA;AAE3D,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CACjC,IAAY;IAEZ,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,KAAK,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACpF,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAClE,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACtE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,KAAiC,EACjC,KAAsC;IAEtC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAA;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACvC,MAAM,IAAI,GAAG,CAAC,OAAuB,EAAiB,EAAE,CACtD,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IACjC,IAAI,MAAqB,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;QAC1F,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAA;YACtD,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG;YACP,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACnD,OAAO,EAAE,SAAS,CAAC,iBAAiB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC9F,CAAA;IACH,CAAC;IACD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IACtC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,uFAAuF;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAe,EAAQ,EAAE;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACvE,CAAC,CAAA;IACD,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAA;IACtB,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAA;IACvB,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAA;IACxB,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAChC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAClB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAC5D,CAAA;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9B,CAAC"}

package/dist/db-config.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The `devDatabase` declaration in `nifra.config.ts`: the one database `nifra db` / `nifra_db_*` may
+ * read. Declared explicitly or not at all - `DATABASE_URL` is never read on its own, because it often
+ * points at production.
+ *
+ *   export const devDatabase = { kind: "sqlite", file: "./data/app.db" }
+ *   export const devDatabase = {
+ *     kind: "postgres",
+ *     url: process.env.NIFRA_DEV_DATABASE_URL,
+ *     exclude: ["audit_log"],
+ *   }
+ *
+ * The config is imported only inside the query subprocess (`db-child.ts`), after `.env` files load.
+ */
+import { type DbRefusal } from "@nifrajs/mcp-db/engine";
+/** Fields both engines share, with their defaults applied. */
+export interface DevDatabaseCommon {
+    /** Tables a query may not read (`name`, or `schema.name` on Postgres). */
+    readonly exclude: readonly string[];
+    readonly maxRows: number;
+    readonly maxResultBytes: number;
+    readonly timeoutMs: number;
+    /** Columns a query may not read, on top of the credential-name classifier. */
+    readonly redactColumns: readonly string[];
+    /** Columns the classifier names that a query may read anyway. */
+    readonly revealColumns: readonly string[];
+    /** `nifra db query` is on for a declared database unless this is false. */
+    readonly query: boolean;
+}
+export interface DevSqliteDatabase extends DevDatabaseCommon {
+    readonly kind: "sqlite";
+    /** Relative to the project root; its real path must stay inside the root. */
+    readonly file: string;
+    /** Paths outside the root that `file` may resolve to. */
+    readonly allowFiles: readonly string[];
+}
+export interface DevPostgresDatabase extends DevDatabaseCommon {
+    readonly kind: "postgres";
+    readonly url: string;
+    /** Remote hosts the URL may name; loopback, `*.localhost` and unix sockets need no entry. */
+    readonly allowHosts: readonly string[];
+    /** Extensions or untrusted languages the role may use without the query being refused. */
+    readonly allowExtensions: readonly string[];
+    /** Schemas a query may read (default `["public"]`). */
+    readonly schemas: readonly string[];
+}
+export type DevDatabase = DevSqliteDatabase | DevPostgresDatabase;
+/** The `.env` files the subprocess applies, lowest precedence first; the process env wins over all. */
+export declare const DEV_DATABASE_ENV_FILES: readonly [".env", ".env.development", ".env.local", ".env.development.local"];
+/** Validate a `devDatabase` export and apply defaults. Unknown fields are refused, never ignored. */
+export declare function parseDevDatabase(value: unknown): DevDatabase | DbRefusal;
+/** The project's `.env` files as one record, for redacting with the values the subprocess sees. */
+export declare function readProjectEnv(root: string): Promise<Record<string, string>>;
+/**
+ * Apply the project's `.env` files (never overriding the process environment), then import
+ * `nifra.config.ts` and validate its `devDatabase` export. Runs in the query subprocess only: the
+ * config is code, and importing it in a long-lived process would pin its modules.
+ */
+export declare function loadDevDatabase(root: string): Promise<DevDatabase | DbRefusal>;
+//# sourceMappingURL=db-config.d.ts.map

package/dist/db-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-config.d.ts","sourceRoot":"","sources":["../src/db-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,KAAK,SAAS,EAAa,MAAM,wBAAwB,CAAA;AAIlE,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,iEAAiE;IACjE,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG,mBAAmB,CAAA;AAqBjE,uGAAuG;AACvG,eAAO,MAAM,sBAAsB,+EAKzB,CAAA;AAwCV,qGAAqG;AACrG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CA0DxE;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQlF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAwBpF"}

package/dist/db-config.js

@@ -0,0 +1,176 @@
+/**
+ * The `devDatabase` declaration in `nifra.config.ts`: the one database `nifra db` / `nifra_db_*` may
+ * read. Declared explicitly or not at all - `DATABASE_URL` is never read on its own, because it often
+ * points at production.
+ *
+ *   export const devDatabase = { kind: "sqlite", file: "./data/app.db" }
+ *   export const devDatabase = {
+ *     kind: "postgres",
+ *     url: process.env.NIFRA_DEV_DATABASE_URL,
+ *     exclude: ["audit_log"],
+ *   }
+ *
+ * The config is imported only inside the query subprocess (`db-child.ts`), after `.env` files load.
+ */
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { dbRefusal } from "@nifrajs/mcp-db/engine";
+import { CONFIG_FILE } from "./app-files.js";
+import { applyEnvFiles, parseEnvFile } from "./env-file.js";
+const COMMON_FIELDS = [
+    "kind",
+    "exclude",
+    "maxRows",
+    "maxResultBytes",
+    "timeoutMs",
+    "redactColumns",
+    "revealColumns",
+    "query",
+];
+const SQLITE_FIELDS = new Set([...COMMON_FIELDS, "file", "allowFiles"]);
+const POSTGRES_FIELDS = new Set([
+    ...COMMON_FIELDS,
+    "url",
+    "allowHosts",
+    "allowExtensions",
+    "schemas",
+]);
+/** The `.env` files the subprocess applies, lowest precedence first; the process env wins over all. */
+export const DEV_DATABASE_ENV_FILES = [
+    ".env",
+    ".env.development",
+    ".env.local",
+    ".env.development.local",
+];
+class InvalidDeclaration extends Error {
+}
+function invalid(message) {
+    throw new InvalidDeclaration(message);
+}
+function strings(fields, field) {
+    const value = fields(field);
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        invalid(`devDatabase.${field} must be an array of non-empty strings`);
+    const out = [];
+    for (const item of value) {
+        if (typeof item !== "string" || item === "") {
+            invalid(`devDatabase.${field} must be an array of non-empty strings`);
+        }
+        out.push(item);
+    }
+    return out;
+}
+function integer(fields, field, fallback, min, max) {
+    const value = fields(field);
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min || value > max) {
+        invalid(`devDatabase.${field} must be an integer from ${min} to ${max}`);
+    }
+    return value;
+}
+/** Validate a `devDatabase` export and apply defaults. Unknown fields are refused, never ignored. */
+export function parseDevDatabase(value) {
+    try {
+        if (typeof value !== "object" || value === null || Array.isArray(value)) {
+            invalid('devDatabase must be an object such as { kind: "sqlite", file: "./data/app.db" }');
+        }
+        const fields = (field) => Reflect.get(value, field);
+        const declared = fields("kind");
+        const kind = declared === "sqlite" || declared === "postgres"
+            ? declared
+            : invalid('devDatabase.kind must be "sqlite" or "postgres"');
+        const known = kind === "sqlite" ? SQLITE_FIELDS : POSTGRES_FIELDS;
+        for (const field of Object.keys(value)) {
+            if (!known.has(field))
+                invalid(`devDatabase has no field ${JSON.stringify(field)} for kind ${kind}`);
+        }
+        const query = fields("query");
+        if (query !== undefined && typeof query !== "boolean") {
+            invalid("devDatabase.query must be a boolean");
+        }
+        const common = {
+            exclude: strings(fields, "exclude"),
+            maxRows: integer(fields, "maxRows", 100, 1, 10_000),
+            // The answer crosses the subprocess pipe as one line, bounded at 1 MiB with its envelope.
+            maxResultBytes: integer(fields, "maxResultBytes", 100 * 1024, 1024, 512 * 1024),
+            timeoutMs: integer(fields, "timeoutMs", 5_000, 100, 120_000),
+            redactColumns: strings(fields, "redactColumns"),
+            revealColumns: strings(fields, "revealColumns"),
+            query: query !== false,
+        };
+        if (kind === "sqlite") {
+            const file = fields("file");
+            if (typeof file !== "string" || file === "" || file.startsWith(":memory:")) {
+                invalid("devDatabase.file must be the path of a SQLite database file");
+            }
+            return { ...common, kind, file, allowFiles: strings(fields, "allowFiles") };
+        }
+        const url = fields("url");
+        if (url === undefined) {
+            invalid(`devDatabase.url is undefined: the environment variable it reads is not set (nifra applies ${DEV_DATABASE_ENV_FILES.join(", ")} first)`);
+        }
+        if (typeof url !== "string" || url === "") {
+            invalid("devDatabase.url must be a postgres:// URL");
+        }
+        return {
+            ...common,
+            kind,
+            url,
+            allowHosts: strings(fields, "allowHosts"),
+            allowExtensions: strings(fields, "allowExtensions"),
+            schemas: fields("schemas") === undefined ? ["public"] : strings(fields, "schemas"),
+        };
+    }
+    catch (error) {
+        if (error instanceof InvalidDeclaration)
+            return dbRefusal("NIFRA_DB_CONFIG", error.message);
+        throw error;
+    }
+}
+/** The project's `.env` files as one record, for redacting with the values the subprocess sees. */
+export async function readProjectEnv(root) {
+    const merged = {};
+    for (const file of DEV_DATABASE_ENV_FILES) {
+        const path = resolve(root, file);
+        if (!existsSync(path))
+            continue;
+        Object.assign(merged, parseEnvFile(await Bun.file(path).text()));
+    }
+    return merged;
+}
+/**
+ * Apply the project's `.env` files (never overriding the process environment), then import
+ * `nifra.config.ts` and validate its `devDatabase` export. Runs in the query subprocess only: the
+ * config is code, and importing it in a long-lived process would pin its modules.
+ */
+export async function loadDevDatabase(root) {
+    await applyEnvFiles(root, DEV_DATABASE_ENV_FILES.filter((file) => existsSync(resolve(root, file))));
+    const configPath = resolve(root, CONFIG_FILE);
+    if (!existsSync(configPath)) {
+        return dbRefusal("NIFRA_DB_NOT_DECLARED", `${root} has no ${CONFIG_FILE} declaring devDatabase`);
+    }
+    let config;
+    try {
+        config = await import(__rewriteRelativeImportExtension(configPath));
+    }
+    catch (error) {
+        return dbRefusal("NIFRA_DB_CONFIG", `${CONFIG_FILE} failed to load: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const declared = typeof config === "object" && config !== null ? Reflect.get(config, "devDatabase") : undefined;
+    if (declared === undefined) {
+        return dbRefusal("NIFRA_DB_NOT_DECLARED", `${CONFIG_FILE} does not export devDatabase`);
+    }
+    return parseDevDatabase(declared);
+}
+//# sourceMappingURL=db-config.js.map