@safegres/test 0.0.2 → 1.30.7

package/types.d.ts

@@ -0,0 +1,292 @@
+/**
+ * Report types for the safegres audit.
+ *
+ * Kept intentionally minimal and dependency-free so they can be imported
+ * by downstream packages (e.g. `@constructive-db/rls-audit-constructive`)
+ * without pulling in `pg` or `pgsql-parser`.
+ */
+export type Severity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+/**
+ * Which way a finding fails:
+ * - `fail-open`   — the untrusted side can read/write more than intended (a leak).
+ * - `fail-closed` — the operation is denied at runtime; an availability/hygiene
+ *                   concern, not an exposure. Excluded from the score by default.
+ * - `neutral`     — directionless (performance, meta).
+ */
+export type Direction = 'fail-open' | 'fail-closed' | 'neutral';
+/**
+ * Which axis a finding is scored on. `security` findings drive `report.score`;
+ * `perf` findings drive `report.perf.score`. The two are never mixed — a
+ * database can be an A+ on security and a D on index hygiene, and both
+ * numbers stay meaningful.
+ */
+export type Dimension = 'security' | 'perf';
+export declare const SEVERITY_ORDER: Record<Severity, number>;
+export interface Finding {
+    /** Finding code, e.g. `A1`, `P7`. Stable across versions. */
+    code: string;
+    severity: Severity;
+    /** High-level bucket — helps renderers group findings. */
+    category: 'flags' | 'coverage' | 'anti-pattern' | 'index' | 'sync' | 'match' | 'meta' | 'convention';
+    /** Leak vs deny vs directionless. Stamped from the rule registry. */
+    direction?: Direction;
+    /** Scoring axis. Stamped from the rule registry; defaults to `security`. */
+    dimension?: Dimension;
+    /**
+     * Whether the finding's table is on the resolved exposure surface — i.e.
+     * reachable on the *primary* plane. `undefined` when no exposure surface is
+     * known (everything is assumed reachable).
+     */
+    exposed?: boolean;
+    /**
+     * Every access plane the finding is reachable on, by name. A relation that
+     * is internal to the API can still be reachable by a role holding a direct
+     * connection, and this is where that shows up. Not part of a finding's
+     * identity: baselines and comparisons key on the finding, not on who can
+     * reach it.
+     */
+    planes?: string[];
+    /**
+     * The finding is acknowledged by config as intentional (e.g. an open read
+     * on a table declared in `public.read`) — reported, but excluded from the
+     * score.
+     */
+    acknowledged?: boolean;
+    /** Schema-qualified location, where applicable. */
+    schema?: string;
+    table?: string;
+    policy?: string;
+    role?: string;
+    privilege?: string;
+    /** Human-readable summary. */
+    message: string;
+    /** Optional remediation hint / pointer to docs. */
+    hint?: string;
+    /** Optional machine-readable extras (AST nodes, offending function name, …). */
+    context?: Record<string, unknown>;
+    /**
+     * Proof attached by `--explain`: the plan the database produced for the
+     * query shape this finding is a claim about.
+     */
+    evidence?: FindingEvidence;
+}
+/**
+ * Planner evidence for a finding. `refuted` means the planner disagreed with
+ * the catalog inference — the finding is reported but no longer scored.
+ */
+export interface FindingEvidence {
+    source: 'explain';
+    status: 'confirmed' | 'refuted' | 'inconclusive';
+    /** The probe query, with parameters left unbound. */
+    probe: string;
+    /** Plan node types, outermost first. */
+    plan: string;
+    /** Why an inconclusive probe was inconclusive. */
+    note?: string;
+}
+export interface Summary {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    info: number;
+}
+/**
+ * One graded access plane: a way into the database, with its own score.
+ *
+ * The primary plane is the declared API surface, and its score *is*
+ * `report.score` — secondary planes never move it. They answer the question
+ * the headline cannot: what does this database grade for somebody who does
+ * not come through the API?
+ */
+export interface PlaneReport {
+    name: string;
+    kind: 'api' | 'role' | 'schema';
+    /** The headline plane. Exactly one plane is primary. */
+    primary: boolean;
+    /** Adapter name, `config`, or `none`. */
+    source: string;
+    schemas: string[];
+    roles?: string[];
+    /** Relations the plane reaches (the density denominator). */
+    exposedTables: number;
+    /**
+     * Relations in the plane's schemas its API cannot address, and which are
+     * therefore excluded from `exposedTables`.
+     */
+    unaddressableTables?: number;
+    /** Role planes: the most direct way the reach arrives. */
+    reachedVia?: 'grant' | 'PUBLIC' | 'inheritance';
+    /** Security score for this plane, same model as the headline. */
+    score: import('./score/score').Score;
+    /** Severity counts for the findings reachable on this plane. */
+    summary: Summary;
+    /** Present when the plane was reported but deliberately not graded. */
+    skipped?: string;
+}
+/** The resolved exposure surface an audit was scored against. */
+export interface ExposureReport {
+    /** True when a surface was configured or auto-resolved. */
+    known: boolean;
+    /** Where the surface came from: an adapter name, `config`, or `none`. */
+    source: string;
+    /** Name of the primary plane. */
+    plane?: string;
+    /** Schemas reachable from the exposed APIs. Empty when unknown. */
+    schemas: string[];
+    /** API-edge roles, when the resolver can discover them. */
+    roles?: string[];
+    /**
+     * The subset of `roles` an unauthenticated caller arrives as — the answer to
+     * "what can someone with no credentials reach?". Omitted when none resolve.
+     */
+    anonRoles?: string[];
+    /** Tables on the exposed surface (the score denominator). */
+    exposedTables: number;
+    /** All tables the audit introspected. */
+    totalTables: number;
+    /**
+     * Relations in the exposed schemas the generated API cannot address, and
+     * which are therefore excluded from `exposedTables`. Present only when an
+     * adapter could prove it; listed rather than counted, because a subtraction
+     * from the score denominator should be readable.
+     */
+    unaddressable?: import('./exposure/reach').UnreachableRelation[];
+}
+/**
+ * The optional performance dimension (`--perf`): index-hygiene and
+ * policy-cost findings, scored on their own 0-100 axis against the same
+ * exposure surface.
+ */
+export interface PerfReport {
+    /** Perf-dimension findings (also present in `report.findings`). */
+    findings: Finding[];
+    summary: Summary;
+    /** Perf score — computed only over perf-dimension findings. */
+    score: import('./score/score').Score;
+    /**
+     * Diff against a committed perf baseline (`--perf-baseline`): which findings
+     * are new debt, which were fixed, which are accepted.
+     */
+    diff?: import('./perf/baseline').PerfDiff;
+    /** Runtime-statistics provenance, present when the audit ran with `--stats`. */
+    stats?: PerfStatsReport;
+    /**
+     * Access-path classification: how many foreign keys X1 was not applied to,
+     * because nothing reads them. Reported so a suppression this broad is never
+     * silent.
+     */
+    paths?: PerfPathsReport;
+    /** Planner-proof summary, present when the audit ran with `--explain`. */
+    explain?: import('./perf/explain').ExplainReport;
+}
+/**
+ * What the access-path signals found, and what X1 did about it. Reported so
+ * the evidence is visible even when — as by default — it changes nothing.
+ */
+export interface PerfPathsReport {
+    /** Foreign keys examined. */
+    total: number;
+    /** Keys with a `read` signal: an RLS policy or a view names the column. */
+    read: number;
+    /** Keys whose only signals are shape: they look like provisioning pointers. */
+    writeOnceShaped: number;
+    /** Tables carrying enough write-once pointers to look like config records. */
+    tables: number;
+    /** What X1 did with the write-once-shaped keys. */
+    onWriteOncePointer: 'report' | 'demote' | 'suppress';
+    /**
+     * Keys whose reverse relation an API behavior declares absent. Reported
+     * only: one missing path is not proof that nothing traverses the key.
+     */
+    declaredHidden?: number;
+}
+/** Where the `S*` findings' numbers came from, and how much to trust them. */
+export interface PerfStatsReport {
+    source: 'live';
+    /** Tables whose cumulative statistics were read. */
+    tables: number;
+    /** When the counters were last reset — the window the numbers describe. */
+    statsReset: string | null;
+    /** Whether `S*` findings counted toward the perf score. */
+    scored: boolean;
+    /** Non-fatal gaps, e.g. `pg_stat_statements` not installed. */
+    notes?: string[];
+}
+/**
+ * The per-role exposure report: the direct answer to "what can role X
+ * access?", computed over effective grants (direct, TO PUBLIC, inherited)
+ * for the configured untrusted roles. Present whenever such roles are
+ * configured (e.g. L5/R1 options), independent of any findings.
+ */
+export interface RoleAccessReport {
+    roles: import('./checks/lattice').RoleAccessEntry[];
+}
+export interface Report {
+    version: string;
+    generatedAt: string;
+    /**
+     * What ruler this score was measured with: a fingerprint of the resolved
+     * configuration, and whether the run refused local config entirely. Two
+     * reports are comparable when their fingerprints match.
+     */
+    provenance?: import('./config/fingerprint').Provenance;
+    summary: Summary;
+    findings: Finding[];
+    /** Config-driven audit score (weighted deductions, 0-100 + grade). */
+    score?: import('./score/score').Score;
+    /** Performance dimension, present when the audit ran with `perf` enabled. */
+    perf?: PerfReport;
+    /** The exposure surface the score was computed against. */
+    exposure?: ExposureReport;
+    /**
+     * Every graded access plane, primary first. `planes[0].score` is
+     * `report.score`; the rest are advisory unless `failOn.planes` opts them
+     * into gating.
+     */
+    planes?: PlaneReport[];
+    /**
+     * Named scores over slices of the same findings (`scorecards` config), the
+     * reserved `default` and `raw` cards first. Different teams gate on
+     * different questions; this is where each one's answer lives, computed
+     * from the one set of findings so they can never disagree about the facts.
+     */
+    scorecards?: import('./score/scorecards').ScorecardReport[];
+    /** Effective per-role access, for the configured untrusted roles. */
+    roleAccess?: RoleAccessReport;
+    /**
+     * L21's `granted − reachable` result: per role, the EXECUTE grants that are
+     * revocable, the ones retained (each with the reachability path that proves
+     * it load-bearing), and the ones suppressed because the closure could not be
+     * fully read. The retained-and-suppressed lists are the point of the rule —
+     * they are what a human reviews before dropping anything.
+     */
+    revocableGrants?: import('./checks/revocable-grants').RevocableGrantsReport;
+    /**
+     * Unscored call-graph audit (`--call-graph`): trust boundaries reachable
+     * from the exposed entry points, for human review.
+     */
+    callGraph?: import('./callgraph/graph').CallGraphReport;
+    /**
+     * Diff against a committed call-graph baseline (`--baseline`): trust
+     * boundaries added since the snapshot (require sign-off) and boundaries
+     * that were resolved.
+     */
+    callGraphDiff?: import('./callgraph/baseline').CallGraphDiff;
+    /**
+     * Movement against a previous run (`--compare`): score deltas, severity
+     * deltas and the rules that changed. A report describes a database; this is
+     * the only part that describes a change to one.
+     */
+    comparison?: import('./report/compare').ReportComparison;
+    /**
+     * Why there is no `comparison` (`--compare-skipped`): a baseline was looked
+     * for and none qualified. Silence would read as "nothing moved", which is
+     * how a delta nobody could see went wrong unnoticed; the absolute score and
+     * the perf ratchet still gate the run, and this line says so.
+     */
+    comparisonSkipped?: string;
+}
+export declare function newSummary(): Summary;
+export declare function summarize(findings: Finding[]): Summary;
+export declare function meetsThreshold(sev: Severity, threshold: Severity): boolean;

package/types.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * Report types for the safegres audit.
+ *
+ * Kept intentionally minimal and dependency-free so they can be imported
+ * by downstream packages (e.g. `@constructive-db/rls-audit-constructive`)
+ * without pulling in `pg` or `pgsql-parser`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEVERITY_ORDER = void 0;
+exports.newSummary = newSummary;
+exports.summarize = summarize;
+exports.meetsThreshold = meetsThreshold;
+exports.SEVERITY_ORDER = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+    info: 0
+};
+function newSummary() {
+    return { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+}
+function summarize(findings) {
+    const s = newSummary();
+    for (const f of findings)
+        s[f.severity] += 1;
+    return s;
+}
+function meetsThreshold(sev, threshold) {
+    return exports.SEVERITY_ORDER[sev] >= exports.SEVERITY_ORDER[threshold];
+}

package/version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The analyzer version stamped into every report and into the SARIF tool
+ * record. Read from package.json the same way the CLI reads it, rather than
+ * held in a generated constant: a constant only stays true if a sync step runs
+ * on the same commit lerna bumps the manifest, and it drifted (1.16.1 against a
+ * 1.18.0 manifest) precisely because it doesn't.
+ */
+export declare const version: string;

package/version.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.version = void 0;
+const utils_1 = require("@inquirerer/utils");
+/**
+ * The analyzer version stamped into every report and into the SARIF tool
+ * record. Read from package.json the same way the CLI reads it, rather than
+ * held in a generated constant: a constant only stays true if a sync step runs
+ * on the same commit lerna bumps the manifest, and it drifted (1.16.1 against a
+ * 1.18.0 manifest) precisely because it doesn't.
+ */
+exports.version = (0, utils_1.getPackageVersion)(__dirname);

package/LICENSE

@@ -1,23 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2025 Dan Lynch <pyramation@gmail.com>
-Copyright (c) 2025 Hyperweb <developers@hyperweb.io>
-Copyright (c) 2020-present, Interweb, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/admin.d.ts

@@ -1,26 +0,0 @@
-import { PgTestConnectionOptions } from '@launchql/types';
-import { PgConfig } from 'pg-env';
-import { SeedAdapter } from './seed/types';
-export declare class DbAdmin {
-    private config;
-    private verbose;
-    private roleConfig?;
-    constructor(config: PgConfig, verbose?: boolean, roleConfig?: PgTestConnectionOptions);
-    private getEnv;
-    private run;
-    private safeDropDb;
-    drop(dbName?: string): void;
-    dropTemplate(dbName: string): void;
-    create(dbName?: string): void;
-    createFromTemplate(template: string, dbName?: string): void;
-    installExtensions(extensions: string[] | string, dbName?: string): void;
-    connectionString(dbName?: string): string;
-    createTemplateFromBase(base: string, template: string): void;
-    cleanupTemplate(template: string): void;
-    grantRole(role: string, user: string, dbName?: string): Promise<void>;
-    grantConnect(role: string, dbName?: string): Promise<void>;
-    createUserRole(user: string, password: string, dbName: string): Promise<void>;
-    loadSql(file: string, dbName: string): void;
-    streamSql(sql: string, dbName: string): Promise<void>;
-    createSeededTemplate(templateName: string, adapter: SeedAdapter): Promise<void>;
-}

package/admin.js

@@ -1,182 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbAdmin = void 0;
-const logger_1 = require("@launchql/logger");
-const child_process_1 = require("child_process");
-const fs_1 = require("fs");
-const pg_env_1 = require("pg-env");
-const roles_1 = require("./roles");
-const stream_1 = require("./stream");
-const log = new logger_1.Logger('db-admin');
-class DbAdmin {
-    config;
-    verbose;
-    roleConfig;
-    constructor(config, verbose = false, roleConfig) {
-        this.config = config;
-        this.verbose = verbose;
-        this.roleConfig = roleConfig;
-        this.config = (0, pg_env_1.getPgEnvOptions)(config);
-    }
-    getEnv() {
-        return {
-            PGHOST: this.config.host,
-            PGPORT: String(this.config.port),
-            PGUSER: this.config.user,
-            PGPASSWORD: this.config.password
-        };
-    }
-    run(command) {
-        try {
-            (0, child_process_1.execSync)(command, {
-                stdio: this.verbose ? 'inherit' : 'pipe',
-                env: {
-                    ...process.env,
-                    ...this.getEnv()
-                }
-            });
-            if (this.verbose)
-                log.success(`Executed: ${command}`);
-        }
-        catch (err) {
-            log.error(`Command failed: ${command}`);
-            if (this.verbose)
-                log.error(err.message);
-            throw err;
-        }
-    }
-    safeDropDb(name) {
-        try {
-            this.run(`dropdb "${name}"`);
-        }
-        catch (err) {
-            if (!err.message.includes('does not exist')) {
-                log.warn(`Could not drop database ${name}: ${err.message}`);
-            }
-        }
-    }
-    drop(dbName) {
-        this.safeDropDb(dbName ?? this.config.database);
-    }
-    dropTemplate(dbName) {
-        this.run(`psql -c "UPDATE pg_database SET datistemplate='false' WHERE datname='${dbName}';"`);
-        this.drop(dbName);
-    }
-    create(dbName) {
-        const db = dbName ?? this.config.database;
-        this.run(`createdb -U ${this.config.user} -h ${this.config.host} -p ${this.config.port} "${db}"`);
-    }
-    createFromTemplate(template, dbName) {
-        const db = dbName ?? this.config.database;
-        this.run(`createdb -U ${this.config.user} -h ${this.config.host} -p ${this.config.port} -e "${db}" -T "${template}"`);
-    }
-    installExtensions(extensions, dbName) {
-        const db = dbName ?? this.config.database;
-        const extList = typeof extensions === 'string' ? extensions.split(',') : extensions;
-        for (const extension of extList) {
-            this.run(`psql --dbname "${db}" -c 'CREATE EXTENSION IF NOT EXISTS "${extension}" CASCADE;'`);
-        }
-    }
-    connectionString(dbName) {
-        const { user, password, host, port } = this.config;
-        const db = dbName ?? this.config.database;
-        return `postgres://${user}:${password}@${host}:${port}/${db}`;
-    }
-    createTemplateFromBase(base, template) {
-        this.run(`createdb -T "${base}" "${template}"`);
-        this.run(`psql -c "UPDATE pg_database SET datistemplate = true WHERE datname = '${template}';"`);
-    }
-    cleanupTemplate(template) {
-        try {
-            this.run(`psql -c "UPDATE pg_database SET datistemplate = false WHERE datname = '${template}'"`);
-        }
-        catch {
-            log.warn(`Skipping failed UPDATE of datistemplate for ${template}`);
-        }
-        this.safeDropDb(template);
-    }
-    async grantRole(role, user, dbName) {
-        const db = dbName ?? this.config.database;
-        const sql = `GRANT ${role} TO ${user};`;
-        await this.streamSql(sql, db);
-    }
-    async grantConnect(role, dbName) {
-        const db = dbName ?? this.config.database;
-        const sql = `GRANT CONNECT ON DATABASE "${db}" TO ${role};`;
-        await this.streamSql(sql, db);
-    }
-    // TODO: make adminRole a configurable option
-    // ONLY granting admin role for testing purposes, normally the db connection for apps won't have admin role
-    // DO NOT USE THIS FOR PRODUCTION
-    async createUserRole(user, password, dbName) {
-        const anonRole = (0, roles_1.getRoleName)('anonymous', this.roleConfig);
-        const authRole = (0, roles_1.getRoleName)('authenticated', this.roleConfig);
-        const adminRole = (0, roles_1.getRoleName)('administrator', this.roleConfig);
-        const sql = `
-      DO $$
-      BEGIN
-        -- Create role if it doesn't exist
-        IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${user}') THEN
-          CREATE ROLE ${user} LOGIN PASSWORD '${password}';
-        END IF;
-        
-        -- Grant anonymous role if not already granted
-        IF NOT EXISTS (
-          SELECT 1 FROM pg_auth_members am 
-          JOIN pg_roles r1 ON am.roleid = r1.oid 
-          JOIN pg_roles r2 ON am.member = r2.oid 
-          WHERE r1.rolname = '${anonRole}' AND r2.rolname = '${user}'
-        ) THEN
-          GRANT ${anonRole} TO ${user};
-        END IF;
-        
-        -- Grant authenticated role if not already granted
-        IF NOT EXISTS (
-          SELECT 1 FROM pg_auth_members am 
-          JOIN pg_roles r1 ON am.roleid = r1.oid 
-          JOIN pg_roles r2 ON am.member = r2.oid 
-          WHERE r1.rolname = '${authRole}' AND r2.rolname = '${user}'
-        ) THEN
-          GRANT ${authRole} TO ${user};
-        END IF;
-        
-        -- Grant administrator role if not already granted
-        IF NOT EXISTS (
-          SELECT 1 FROM pg_auth_members am 
-          JOIN pg_roles r1 ON am.roleid = r1.oid 
-          JOIN pg_roles r2 ON am.member = r2.oid 
-          WHERE r1.rolname = '${adminRole}' AND r2.rolname = '${user}'
-        ) THEN
-          GRANT ${adminRole} TO ${user};
-        END IF;
-      END $$;
-    `.trim();
-        await this.streamSql(sql, dbName);
-    }
-    loadSql(file, dbName) {
-        if (!(0, fs_1.existsSync)(file)) {
-            throw new Error(`Missing SQL file: ${file}`);
-        }
-        this.run(`psql -f ${file} ${dbName}`);
-    }
-    async streamSql(sql, dbName) {
-        await (0, stream_1.streamSql)({
-            ...this.config,
-            database: dbName
-        }, sql);
-    }
-    async createSeededTemplate(templateName, adapter) {
-        const seedDb = this.config.database;
-        this.create(seedDb);
-        await adapter.seed({
-            admin: this,
-            config: this.config,
-            pg: null, // placeholder for PgTestClient
-            connect: null // placeholder for connection factory
-        });
-        this.cleanupTemplate(templateName);
-        this.createTemplateFromBase(seedDb, templateName);
-        this.drop(seedDb);
-    }
-}
-exports.DbAdmin = DbAdmin;

package/connect.d.ts

@@ -1,19 +0,0 @@
-import { PgTestConnectionOptions } from '@launchql/types';
-import { PgConfig } from 'pg-env';
-import { DbAdmin } from './admin';
-import { PgTestConnector } from './manager';
-import { SeedAdapter } from './seed/types';
-import { PgTestClient } from './test-client';
-export declare const getPgRootAdmin: (connOpts?: PgTestConnectionOptions) => DbAdmin;
-export interface GetConnectionOpts {
-    pg?: Partial<PgConfig>;
-    db?: Partial<PgTestConnectionOptions>;
-}
-export interface GetConnectionResult {
-    pg: PgTestClient;
-    db: PgTestClient;
-    admin: DbAdmin;
-    teardown: () => Promise<void>;
-    manager: PgTestConnector;
-}
-export declare const getConnections: (cn?: GetConnectionOpts, seedAdapters?: SeedAdapter[]) => Promise<GetConnectionResult>;

package/connect.js

@@ -1,83 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getConnections = exports.getPgRootAdmin = void 0;
-const env_1 = require("@launchql/env");
-const crypto_1 = require("crypto");
-const pg_cache_1 = require("pg-cache");
-const pg_env_1 = require("pg-env");
-const admin_1 = require("./admin");
-const manager_1 = require("./manager");
-const roles_1 = require("./roles");
-const seed_1 = require("./seed");
-let manager;
-const getPgRootAdmin = (connOpts = {}) => {
-    const opts = (0, pg_env_1.getPgEnvOptions)({
-        database: connOpts.rootDb
-    });
-    const admin = new admin_1.DbAdmin(opts, false, connOpts);
-    return admin;
-};
-exports.getPgRootAdmin = getPgRootAdmin;
-const getConnOopts = (cn = {}) => {
-    const connect = (0, env_1.getConnEnvOptions)(cn.db);
-    const config = (0, pg_env_1.getPgEnvOptions)({
-        database: `${connect.prefix}${(0, crypto_1.randomUUID)()}`,
-        ...cn.pg
-    });
-    return {
-        pg: config,
-        db: connect
-    };
-};
-const getConnections = async (cn = {}, seedAdapters = [seed_1.seed.launchql()]) => {
-    cn = getConnOopts(cn);
-    const config = cn.pg;
-    const connOpts = cn.db;
-    const root = (0, exports.getPgRootAdmin)(connOpts);
-    await root.createUserRole(connOpts.connection.user, connOpts.connection.password, connOpts.rootDb);
-    const admin = new admin_1.DbAdmin(config, false, connOpts);
-    if (process.env.TEST_DB) {
-        config.database = process.env.TEST_DB;
-    }
-    else if (connOpts.template) {
-        admin.createFromTemplate(connOpts.template, config.database);
-    }
-    else {
-        admin.create(config.database);
-        admin.installExtensions(connOpts.extensions);
-    }
-    await admin.grantConnect(connOpts.connection.user, config.database);
-    manager = manager_1.PgTestConnector.getInstance();
-    const pg = manager.getClient(config);
-    const teardown = async () => {
-        manager.beginTeardown();
-        await (0, pg_cache_1.teardownPgPools)();
-        await manager.closeAll();
-    };
-    if (seedAdapters.length) {
-        try {
-            await seed_1.seed.compose(seedAdapters).seed({
-                connect: connOpts,
-                admin,
-                config: config,
-                pg: manager.getClient(config)
-            });
-        }
-        catch (error) {
-            await teardown();
-            throw error;
-        }
-    }
-    const dbConfig = {
-        ...config,
-        user: connOpts.connection.user,
-        password: connOpts.connection.password
-    };
-    const db = manager.getClient(dbConfig, {
-        auth: connOpts.auth,
-        roles: connOpts.roles
-    });
-    db.setContext({ role: (0, roles_1.getDefaultRole)(connOpts) });
-    return { pg, db, teardown, manager, admin };
-};
-exports.getConnections = getConnections;