@rvoh/dream 2.32.0 → 2.33.0

package/dist/cjs/src/cli/index.js

@@ -508,10 +508,10 @@ ${INDENT}Examples: User, Place, Room/Bedroom, Settings/CommunicationPreferences`
      * (package.json scripts, CLI argv, scaffold templates) — never from
      * runtime request input or any other untrusted external source.
      *
-     * Argv-form is the safe choice for any caller that interpolates a
-     * config value, path, or credential: a database password containing
-     * `$` or backticks is passed literally to the child rather than
-     * interpreted by a shell.
+     * Argv-form passes config values and paths literally to the child,
+     * without interpreting shell metacharacters. Credentials belong in
+     * the child's environment, since argv is visible in process listings
+     * and in the refused-spawn error.
      *
      * ## Layered defense
      *

package/dist/cjs/src/db/helpers/syncDbTypesFiles.js

@@ -13,16 +13,14 @@ export default async function syncDbTypesFiles(connectionName) {
     const dbFilename = dbTypesFilenameForConnection(connectionName);
     const dbSyncFilePath = path.join(dreamPath('types'), dbFilename);
     const absoluteDbSyncPath = path.join(dreamApp.projectRoot, dbSyncFilePath);
+    const password = await driverClass.codegenPassword(dbConf.password);
     await CliFileWriter.cache(absoluteDbSyncPath);
     const lowLevelDbOpts = dreamApp.dbCredentialsFor(connectionName);
-    // Argv form (R-015): the connection URL embeds the DB password, and passwords
-    // may legitimately contain shell meta-characters (`$`, backticks, spaces, etc.).
-    // DreamCLI.spawn always uses shell:false, so each arg is passed literally to
-    // the child rather than parsed by a shell — credentials are preserved and any
-    // future mutable source can't open a command-injection surface.
-    const userinfo = `${dbConf.user}${dbConf.password ? `:${dbConf.password}` : ''}`;
+    // Pass the URL only in the child's environment. A URL in argv exposes the
+    // password in the process command line and DreamCLI's refused-spawn error.
+    const userinfo = `${encodeURIComponent(dbConf.user)}${password ? `:${encodeURIComponent(password)}` : ''}`;
     const url = `${driverClass.syncDialect}://${userinfo}@${dbConf.host}:${dbConf.port}/${dbConf.name}`;
-    const args = [`--dialect=${driverClass.syncDialect}`, `--url=${url}`];
+    const args = [`--dialect=${driverClass.syncDialect}`, '--url=env(DATABASE_URL)'];
     if (lowLevelDbOpts?.tableIncludePattern) {
         args.push(`--include-pattern=${lowLevelDbOpts.tableIncludePattern}`);
     }
@@ -32,6 +30,7 @@ export default async function syncDbTypesFiles(connectionName) {
     args.push(`--out-file=${absoluteDbSyncPath}`);
     await DreamCLI.spawn('kysely-codegen', {
         args,
+        env: { ...process.env, DATABASE_URL: url },
         onStdout: message => {
             DreamCLI.logger.logContinueProgress(colorize(`[db]`, { color: 'greenBright' }) + ' ' + message, {
                 logPrefixColor: 'greenBright',

package/dist/cjs/src/dream/QueryDriver/Base.js

@@ -626,6 +626,13 @@ export default class QueryDriverBase {
     static get syncDialect() {
         return 'postgres';
     }
+    /** @internal Resolve the credential used by the database type generator. */
+    static codegenPassword(password) {
+        if (typeof password === 'function') {
+            throw new Error('This database adapter does not support a password provider for type generation');
+        }
+        return Promise.resolve(password);
+    }
     /**
      * Returns the sql that would be executed by this Query
      *

package/dist/cjs/src/dream/QueryDriver/Kysely.js

@@ -71,6 +71,7 @@ import softDeleteDream from '../internal/softDeleteDream.js';
 import sqlResultToDreamInstance from '../internal/sqlResultToDreamInstance.js';
 import Query from '../Query.js';
 import QueryDriverBase from './Base.js';
+import { PasswordProviderPoolClient } from './helpers/pg/loadPgClient.js';
 import checkForNeedToBeRunMigrations from './helpers/kysely/checkForNeedToBeRunMigrations.js';
 import foreignKeyTypeFromPrimaryKey from './helpers/kysely/foreignKeyTypeFromPrimaryKey.js';
 import runMigration from './helpers/kysely/runMigration.js';
@@ -103,7 +104,10 @@ export default class KyselyQueryDriver extends QueryDriverBase {
                 // Spread pg passthrough first; Dream's resolved fields follow and
                 // always win (per-connection database name, TLS directive).
                 ...(connectionConf.pg ?? {}),
+                Client: typeof connectionConf.password === 'function' ? PasswordProviderPoolClient : undefined,
                 user: connectionConf.user || '',
+                // pg accepts a callback here and resolves it for each new client when
+                // the server requests password authentication.
                 password: connectionConf.password || '',
                 database: DreamApp.getOrFail().dbName(connectionName, dbConnectionType),
                 host: connectionConf.host || 'localhost',
@@ -227,6 +231,9 @@ export default class KyselyQueryDriver extends QueryDriverBase {
     static get syncDialect() {
         return 'postgres';
     }
+    static async codegenPassword(password) {
+        return typeof password === 'function' ? await password() : password;
+    }
     /**
      * @internal
      *

package/dist/cjs/src/dream/QueryDriver/Postgres.js

@@ -332,7 +332,13 @@ export default class PostgresQueryDriver extends KyselyQueryDriver {
             keepAlive: true,
             keepAliveInitialDelayMillis: LOCK_CONNECTION_KEEPALIVE_INITIAL_DELAY_MS,
         });
-        await client.connect();
+        try {
+            await client.connect();
+        }
+        catch (err) {
+            await client.end().catch(() => undefined);
+            throw err;
+        }
         return {
             async tryAcquire(namespace, index) {
                 const result = await client.query('SELECT pg_try_advisory_lock($1::int4, $2::int4) AS locked', [

package/dist/cjs/src/dream/QueryDriver/helpers/pg/loadPgClient.js

@@ -8,6 +8,28 @@
 // @ts-ignore
 import pg from 'pg';
 import DreamApp from '../../../../dream-app/index.js';
+export class PasswordProviderPoolClient extends pg.Client {
+    connect(callback) {
+        if (callback) {
+            super.connect(err => {
+                if (err)
+                    this.destroyConnectionStream();
+                callback(err);
+            });
+        }
+        else {
+            return super.connect().catch(err => {
+                this.destroyConnectionStream();
+                throw err;
+            });
+        }
+    }
+    destroyConnectionStream() {
+        // pg reports a rejected password provider without closing its socket.
+        ;
+        this.connection?.stream.destroy();
+    }
+}
 export default async function loadPgClient({ connectionName, useSystemDb, }) {
     const dreamconf = DreamApp.getOrFail();
     const creds = dreamconf.dbCredentialsFor(connectionName)?.primary;
@@ -20,6 +42,12 @@ export default async function loadPgClient({ connectionName, useSystemDb, }) {
         user: creds.user,
         password: creds.password,
     });
-    await client.connect();
+    try {
+        await client.connect();
+    }
+    catch (err) {
+        await client.end().catch(() => undefined);
+        throw err;
+    }
     return client;
 }

package/dist/esm/src/cli/index.js

@@ -508,10 +508,10 @@ ${INDENT}Examples: User, Place, Room/Bedroom, Settings/CommunicationPreferences`
      * (package.json scripts, CLI argv, scaffold templates) — never from
      * runtime request input or any other untrusted external source.
      *
-     * Argv-form is the safe choice for any caller that interpolates a
-     * config value, path, or credential: a database password containing
-     * `$` or backticks is passed literally to the child rather than
-     * interpreted by a shell.
+     * Argv-form passes config values and paths literally to the child,
+     * without interpreting shell metacharacters. Credentials belong in
+     * the child's environment, since argv is visible in process listings
+     * and in the refused-spawn error.
      *
      * ## Layered defense
      *

package/dist/esm/src/db/helpers/syncDbTypesFiles.js

@@ -13,16 +13,14 @@ export default async function syncDbTypesFiles(connectionName) {
     const dbFilename = dbTypesFilenameForConnection(connectionName);
     const dbSyncFilePath = path.join(dreamPath('types'), dbFilename);
     const absoluteDbSyncPath = path.join(dreamApp.projectRoot, dbSyncFilePath);
+    const password = await driverClass.codegenPassword(dbConf.password);
     await CliFileWriter.cache(absoluteDbSyncPath);
     const lowLevelDbOpts = dreamApp.dbCredentialsFor(connectionName);
-    // Argv form (R-015): the connection URL embeds the DB password, and passwords
-    // may legitimately contain shell meta-characters (`$`, backticks, spaces, etc.).
-    // DreamCLI.spawn always uses shell:false, so each arg is passed literally to
-    // the child rather than parsed by a shell — credentials are preserved and any
-    // future mutable source can't open a command-injection surface.
-    const userinfo = `${dbConf.user}${dbConf.password ? `:${dbConf.password}` : ''}`;
+    // Pass the URL only in the child's environment. A URL in argv exposes the
+    // password in the process command line and DreamCLI's refused-spawn error.
+    const userinfo = `${encodeURIComponent(dbConf.user)}${password ? `:${encodeURIComponent(password)}` : ''}`;
     const url = `${driverClass.syncDialect}://${userinfo}@${dbConf.host}:${dbConf.port}/${dbConf.name}`;
-    const args = [`--dialect=${driverClass.syncDialect}`, `--url=${url}`];
+    const args = [`--dialect=${driverClass.syncDialect}`, '--url=env(DATABASE_URL)'];
     if (lowLevelDbOpts?.tableIncludePattern) {
         args.push(`--include-pattern=${lowLevelDbOpts.tableIncludePattern}`);
     }
@@ -32,6 +30,7 @@ export default async function syncDbTypesFiles(connectionName) {
     args.push(`--out-file=${absoluteDbSyncPath}`);
     await DreamCLI.spawn('kysely-codegen', {
         args,
+        env: { ...process.env, DATABASE_URL: url },
         onStdout: message => {
             DreamCLI.logger.logContinueProgress(colorize(`[db]`, { color: 'greenBright' }) + ' ' + message, {
                 logPrefixColor: 'greenBright',

package/dist/esm/src/dream/QueryDriver/Base.js

@@ -626,6 +626,13 @@ export default class QueryDriverBase {
     static get syncDialect() {
         return 'postgres';
     }
+    /** @internal Resolve the credential used by the database type generator. */
+    static codegenPassword(password) {
+        if (typeof password === 'function') {
+            throw new Error('This database adapter does not support a password provider for type generation');
+        }
+        return Promise.resolve(password);
+    }
     /**
      * Returns the sql that would be executed by this Query
      *

package/dist/esm/src/dream/QueryDriver/Kysely.js

@@ -71,6 +71,7 @@ import softDeleteDream from '../internal/softDeleteDream.js';
 import sqlResultToDreamInstance from '../internal/sqlResultToDreamInstance.js';
 import Query from '../Query.js';
 import QueryDriverBase from './Base.js';
+import { PasswordProviderPoolClient } from './helpers/pg/loadPgClient.js';
 import checkForNeedToBeRunMigrations from './helpers/kysely/checkForNeedToBeRunMigrations.js';
 import foreignKeyTypeFromPrimaryKey from './helpers/kysely/foreignKeyTypeFromPrimaryKey.js';
 import runMigration from './helpers/kysely/runMigration.js';
@@ -103,7 +104,10 @@ export default class KyselyQueryDriver extends QueryDriverBase {
                 // Spread pg passthrough first; Dream's resolved fields follow and
                 // always win (per-connection database name, TLS directive).
                 ...(connectionConf.pg ?? {}),
+                Client: typeof connectionConf.password === 'function' ? PasswordProviderPoolClient : undefined,
                 user: connectionConf.user || '',
+                // pg accepts a callback here and resolves it for each new client when
+                // the server requests password authentication.
                 password: connectionConf.password || '',
                 database: DreamApp.getOrFail().dbName(connectionName, dbConnectionType),
                 host: connectionConf.host || 'localhost',
@@ -227,6 +231,9 @@ export default class KyselyQueryDriver extends QueryDriverBase {
     static get syncDialect() {
         return 'postgres';
     }
+    static async codegenPassword(password) {
+        return typeof password === 'function' ? await password() : password;
+    }
     /**
      * @internal
      *

package/dist/esm/src/dream/QueryDriver/Postgres.js

@@ -332,7 +332,13 @@ export default class PostgresQueryDriver extends KyselyQueryDriver {
             keepAlive: true,
             keepAliveInitialDelayMillis: LOCK_CONNECTION_KEEPALIVE_INITIAL_DELAY_MS,
         });
-        await client.connect();
+        try {
+            await client.connect();
+        }
+        catch (err) {
+            await client.end().catch(() => undefined);
+            throw err;
+        }
         return {
             async tryAcquire(namespace, index) {
                 const result = await client.query('SELECT pg_try_advisory_lock($1::int4, $2::int4) AS locked', [

package/dist/esm/src/dream/QueryDriver/helpers/pg/loadPgClient.js

@@ -8,6 +8,28 @@
 // @ts-ignore
 import pg from 'pg';
 import DreamApp from '../../../../dream-app/index.js';
+export class PasswordProviderPoolClient extends pg.Client {
+    connect(callback) {
+        if (callback) {
+            super.connect(err => {
+                if (err)
+                    this.destroyConnectionStream();
+                callback(err);
+            });
+        }
+        else {
+            return super.connect().catch(err => {
+                this.destroyConnectionStream();
+                throw err;
+            });
+        }
+    }
+    destroyConnectionStream() {
+        // pg reports a rejected password provider without closing its socket.
+        ;
+        this.connection?.stream.destroy();
+    }
+}
 export default async function loadPgClient({ connectionName, useSystemDb, }) {
     const dreamconf = DreamApp.getOrFail();
     const creds = dreamconf.dbCredentialsFor(connectionName)?.primary;
@@ -20,6 +42,12 @@ export default async function loadPgClient({ connectionName, useSystemDb, }) {
         user: creds.user,
         password: creds.password,
     });
-    await client.connect();
+    try {
+        await client.connect();
+    }
+    catch (err) {
+        await client.end().catch(() => undefined);
+        throw err;
+    }
     return client;
 }

package/dist/types/src/cli/index.d.ts

@@ -8,8 +8,9 @@ export type SpawnOptions = Omit<NodeSpawnOptions, 'shell'> & {
      * Argv elements passed to the child as separate arguments. Defaults to `[]`.
      * Each entry is passed literally — shell meta-characters (`$`, backticks,
      * `&&`, spaces, etc.) inside any element are not interpreted by a shell.
-     * This is the right shape for any caller that interpolates a path or
-     * credential.
+     * This is the right shape for paths and other non-secret values. Pass
+     * credentials through the child's environment so they do not appear in
+     * the process command line or a refused-spawn error.
      */
     args?: string[];
 };
@@ -103,10 +104,10 @@ export default class DreamCLI {
      * (package.json scripts, CLI argv, scaffold templates) — never from
      * runtime request input or any other untrusted external source.
      *
-     * Argv-form is the safe choice for any caller that interpolates a
-     * config value, path, or credential: a database password containing
-     * `$` or backticks is passed literally to the child rather than
-     * interpreted by a shell.
+     * Argv-form passes config values and paths literally to the child,
+     * without interpreting shell metacharacters. Credentials belong in
+     * the child's environment, since argv is visible in process listings
+     * and in the refused-spawn error.
      *
      * ## Layered defense
      *

package/dist/types/src/dream/QueryDriver/Base.d.ts

@@ -1,4 +1,5 @@
 import { CompiledQuery, DeleteQueryBuilder, SelectQueryBuilder, UpdateQueryBuilder } from 'kysely';
+import type { DreamDbConfig } from '../../dream-app/index.js';
 import Dream from '../../Dream.js';
 import { SchemaBuilderAssociationData, SchemaBuilderColumnData } from '../../helpers/cli/ASTBuilder.js';
 import { AssociationStatement } from '../../types/associations/shared.js';
@@ -480,6 +481,8 @@ export default class QueryDriverBase<DreamInstance extends Dream> {
      */
     static destroyDream(dream: Dream, txn: DreamTransaction<Dream>, reallyDestroy: boolean): Promise<number>;
     static get syncDialect(): string;
+    /** @internal Resolve the credential used by the database type generator. */
+    static codegenPassword(password: DreamDbConfig['password']): Promise<string>;
     /**
      * Returns the sql that would be executed by this Query
      *

package/dist/types/src/dream/QueryDriver/Kysely.d.ts

@@ -44,6 +44,7 @@ export default class KyselyQueryDriver<DreamInstance extends Dream> extends Quer
         schemaOnly?: boolean;
     }): Promise<void>;
     static get syncDialect(): string;
+    static codegenPassword(password: DreamDbConfig['password']): Promise<string>;
     /**
      * @internal
      *

package/dist/types/src/dream/QueryDriver/helpers/pg/loadPgClient.d.ts

@@ -1,4 +1,9 @@
 import pg from 'pg';
+export declare class PasswordProviderPoolClient extends pg.Client {
+    connect(): Promise<void>;
+    connect(callback: (err: Error) => void): void;
+    private destroyConnectionStream;
+}
 export default function loadPgClient({ connectionName, useSystemDb, }: {
     connectionName: string;
     useSystemDb?: boolean;

package/dist/types/src/dream-app/index.d.ts

@@ -288,7 +288,17 @@ export interface DreamDbCredentialOptions {
 type UnicodeNormalizationForm = 'NFC' | 'NFD' | 'none';
 export interface DreamDbConfig {
     user: string;
-    password: string;
+    /**
+     * A fixed password, or a provider for Dream's built-in PostgreSQL driver.
+     * PostgreSQL calls the provider when the server requests password
+     * authentication for a new physical connection. The provider may return a
+     * string or a promise of one. Each such connection gets a fresh result;
+     * existing pooled connections keep their credential. A rejected provider
+     * fails that connection attempt and reaches its caller; Dream does not cache
+     * credentials or retry. Custom query drivers receive the configured value
+     * and must handle or reject a provider themselves.
+     */
+    password: string | (() => string | Promise<string>);
     host: string;
     name: string;
     port: number;

package/docs/assets/hierarchy.js

@@ -1 +1 @@
-window.hierarchyData = "eJyVk0FPwyAUx7/LO+McuLCVo1tMjHFqYvSw7MDaN0tGYQE60yz77gZ3wTktO0HJ+/P7Aa97cNYGD2JB+YgRSumSgMO1xjIoazyIPVBK42BkgyDgpUXXzZzaobuVHoHARpkKBGUTAq3TIKDU0nv019VqcFI9qEOjgRwrQEDw1VWMXx0XCJS10pVDA2LBimJ5IMCKIqE/dB51l+zaw/9Vf4kBvWGTqBDHxOHZ+vDh0OdbnEn0eEQqH/KEOq2x3Eyt8cFJZcKbslrGJ/oPjc5Z5wd/RXMc2Ch1sLptzNMO3Vrbzxzyj0AOb8QS3kwGeW9K22xlUCuN7yrUcW0lPd4p1FWGQu8eF3UEH3ISL4VQzimhfPzdo/HjRPu12+Lx9HH2qHwjQ1ln+p4P51zfOP1Z5jbMW60vaZXTSB/zcPgCAPBvFw=="
+window.hierarchyData = "eJyVk8FOAjEQht9lzgUpCwvboxATY0RNjB4Ih7I7uA3dlnS6mA3h3U3lsiK65dR2Mv/8X6fTAzhrPYFY8nQ8YZzzFQOHG425V9YQiANwzsNiZIUg4KVG18yd2qO7lYTAYKtMAYIPpwxqp0FAriUR0k2x7p9l90tfaWCnDBDgqegFee8UYJCXShcODYhlMhitjgySwajl/tAQ6qZVtcP/V/41BDxJpgEhrC2GZ0v+wyHFU1xQdHAE13TY7vusxHw7s4a8k8r4N2W1DE/0nzU6Zx31/5LGMCRZm8HqujJPe3QbbT9jnH8IYvzGk5bfXHp5b3Jb7aRXa43vypchtpaEdwp1EYHQWeOqiUiHnIWmMJ5OUsbT7HtGw+EM+7XZ4en2YfeoqJI+LyN5L4tj2pe1P8vC+kWt9TWjci7p8jwevwDboG8X"