@schema-weaver/pg-connector 0.0.0-stage → 2.0.1

package/dist/cjs/execution/statement-classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statement-classifier.js","sourceRoot":"","sources":["../../../src/execution/statement-classifier.ts"],"names":[],"mappings":";;;AA8JA,8CAMC;AASD,gDAYC;AAuBD,4DAMC;AAmZD,8DA6BC;AAtoBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,6CAiBsB;AA6kBb,8FAxlBP,0BAAa,OAwlBO;AAAE,0GAvlBtB,sCAAyB,OAulBsB;AACxC,wFA/kBP,oBAAO,OA+kBO;AA5kBhB,yDAAsD;AAmBtD;;;;;;GAMG;AACU,QAAA,sBAAsB,GAA+B,IAAI,GAAG,CAAgB;IACvF,cAAc;IACd,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,kBAAkB;CACnB,CAAC,CAAC;AAeH,wEAAwE;AACxE,MAAM,mBAAmB,GAA2B,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAEpF,MAAa,4BAA6B,SAAQ,KAAK;IAGnC;IAFlB,YACE,OAAe,EACC,IAAyC;QAEzD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAqC;QAGzD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AARD,oEAQC;AAED,SAAS,IAAI,CACX,IAAqC,EACrC,IAAY,EACZ,aAAsB,EACtB,IAAY,EACZ,QAA0C,EAAE,EAC5C,UAAkC,mBAAmB;IAErD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,aAAa;QACb,IAAI;QACJ,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE,IAAI;QACd,eAAe,EAAE,EAAE;QACnB,gBAAgB,EAAE,OAAO,CAAC,OAAO;QACjC,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC;QAChD,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAwC;IACjE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,UAA2B,EAAE;IAE7B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,qBAAQ,EAAC,GAAG,CAAC,CAAC;IAChC,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,KAAgB,EAChB,UAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iCAAoB,EAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GACX,KAAK,CAAC,MAAM,KAAK,CAAC;QAChB,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB;YACnC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC;YACvC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,4BAA4B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,KAAwB;IAClD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mCAAgB,EAAC,IAAI,CAAC,CAAC;QACpD,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,KAAgB;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iCAAoB,EAAC,IAAI,CAAC,CAAC,CAAC;IAClE,OAAO,4BAA4B,CACjC,KAAK,EACL,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,KAAgB,EAChB,OAA+B;IAE/B,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;IAEpC,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;YACxC,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC,aAAa,CAAC;SACjC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,wEAAwE;QACxE,kCAAkC;QAClC,IAAI,KAAK,GAA4B,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1E,eAAe,EAAE,cAAc;YAC/B,eAAe,EAAE,CAAC,qBAAqB,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,UAAU,GAAa,CAAC,qBAAqB,CAAC,CAAC;QACrD,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;gBACpC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,UAAU,GAAG,IAAI,CAAC;YAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,KAAK,GAAG,GAAG,CAAC;QAC7D,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,uEAAuE;YACvE,0DAA0D;YAC1D,OAAO;gBACL,GAAG,KAAK;gBACR,eAAe,EAAE,cAAc;gBAC/B,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,MAAM,cAAc,GAAG,CAAC,oBAAoB;gBAC/D,eAAe,EAAE,UAAU;aAC5B,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,oEAAoE;QACpE,OAAO;YACL,GAAG,KAAK;YACR,eAAe,EAAE,cAAc;YAC/B,IAAI,EAAE,GAAG,cAAc,aAAa;YACpC,eAAe,EAAE,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAkC;IAClD,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,MAAM;YACT,OAAO,CAAC,CAAC;QACX,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC;QACX,KAAK,OAAO;YACV,OAAO,CAAC,CAAC;QACX,KAAK,KAAK;YACR,OAAO,CAAC,CAAC;QACX;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAAa,EACb,OAA+B;IAE/B,MAAM,QAAQ,GAAG,IAAA,yBAAY,EAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAA,qBAAQ,EAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAExC,2EAA2E;IAC3E,IAAI,uBAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,IAAI,QAAQ,KAAK,YAAY;YAAE,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpE,yEAAyE;QACzE,kCAAkC;QAClC,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,OAAO,GAAG,IAAA,qCAAwB,EAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAa,EAAE,OAAO,CAAC,CAAC;QACjF,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,GAAG,KAAK;gBACR,IAAI,EAAE,mBAAmB,KAAK,CAAC,IAAI,EAAE;gBACrC,eAAe,EAAE;oBACf,GAAG,KAAK,CAAC,eAAe;oBACxB,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,kBAAkB,CAAC;wBACpD,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAE,CAAC,kBAAkB,CAAqB,CAAC;iBAC/C;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,WAAW,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,IAAI,wBAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,wCAAwC;IACxC,IAAI,6BAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAC5D,eAAe,EAAE,CAAC,kBAAkB,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,uEAAuE;QACvE,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;gBAChD,eAAe,EAAE,CAAC,kBAAkB,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,0EAA0E;IAC1E,IAAI,sBAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CACT,KAAK,EACL,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAC7B,CAAC,IAAA,mCAAsB,EAAC,QAAQ,EAAE,IAAI,CAAC,EACvC,IAAI,EACJ,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,0BAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3E,OAAO,IAAI,CACT,SAAS,EACT,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAC7B,CAAC,IAAA,mCAAsB,EAAC,QAAQ,EAAE,IAAI,CAAC,EACvC,IAAI,EACJ,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,OAAO,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5C,eAAe,EAAE,CAAC,kBAAkB,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAS;IACpC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC;IAC9E,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CAAC,IAAa,EAAE,OAA+B;IACpE,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,IAAA,gCAAmB,EAAC,IAAI,CAAC,CAAC;IAExC,IAAI,KAAK,CAAC,WAAW;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,WAAW;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,IAAA,iCAAoB,EAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAA,mCAAsB,EAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE1D,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE5E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/E,yEAAyE;QACzE,wEAAwE;QACxE,OAAO,IAAI,CACT,OAAO,EACP,IAAI,EACJ,IAAI,EACJ,QAAQ,EACR,EAAE,eAAe,EAAE,UAAU,EAAE,EAC/B,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CACxC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAS,EAAE,IAAY;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;QAC7B,MAAM;QACN,uBAAuB;QACvB,0BAA0B;QAC1B,uBAAuB;QACvB,+BAA+B;KAChC,CAAC,CAAC;IAEH,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;YAC1D,eAAe,EAAE,CAAC,kBAAkB,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,wBAAwB,CAAC,IAAS;IACzC,MAAM,IAAI,GAAU,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,OAAO,KAAK,uBAAuB,IAAI,OAAO,KAAK,+BAA+B,EAAE,CAAC;YACvF,IAAI,eAAe,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAS;IAChC,MAAM,QAAQ,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,IAAS;IAC7C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,OAAO,CAAC;QACjB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC;QAClB,KAAK,WAAW;YACd,OAAO,cAAc,CAAC;QACxB,KAAK,mBAAmB;YACtB,OAAO,iBAAiB,CAAC;QAC3B,KAAK,UAAU;YACb,OAAO,aAAa,CAAC;QACvB,KAAK,gBAAgB;YACnB,OAAO,OAAO,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,MAAM,CAAC;QAChB,KAAK,cAAc;YACjB,OAAO,UAAU,CAAC;QACpB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/D,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACzE,KAAK,iBAAiB;YACpB,OAAO,KAAK,CAAC;QACf,KAAK,kBAAkB;YACrB,OAAO,MAAM,CAAC;QAChB,KAAK,iBAAiB;YACpB,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACrD,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,MAAM,CAAC;QAChB,KAAK,YAAY;YACf,OAAO,QAAQ,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;QACnB,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd,KAAK,UAAU;YACb,OAAO,MAAM,CAAC;QAChB,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;QACnB,KAAK,UAAU;YACb,OAAO,MAAM,CAAC;QAChB,KAAK,iBAAiB;YACpB,OAAO,cAAc,CAAC;QACxB,KAAK,gBAAgB;YACnB,OAAO,aAAa,CAAC;QACvB,KAAK,eAAe;YAClB,OAAO,YAAY,CAAC;QACtB,KAAK,oBAAoB;YACvB,OAAO,2BAA2B,CAAC;QACrC,KAAK,mBAAmB;YACtB,OAAO,SAAS,CAAC;QACnB,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;GAGG;AACI,KAAK,UAAU,yBAAyB,CAC7C,GAAW,EACX,UAA2B,EAAE;IAE7B,IAAI,cAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,sCAAyB;YAAE,MAAM,GAAG,CAAC;QACxD,IAAI,GAAG,YAAY,0BAAa,EAAE,CAAC;YACjC,MAAM,IAAI,4BAA4B,CACpC,sCAAsC,GAAG,CAAC,OAAO,EAAE,EACnD,aAAa,CACd,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,4BAA4B,CAAC,gCAAgC,EAAE,aAAa,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,cAAc,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,4BAA4B,CACpC,yCAAyC,cAAc,CAAC,eAAe,IAAI;YACzE,6CAA6C,EAC/C,qBAAqB,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC"}

package/dist/cjs/execution/types.d.ts

@@ -0,0 +1,189 @@
+import type { AgentMessage, MigrationStatementStatus } from '../protocol/envelope';
+import type { PoolClient, QueryArrayConfig, QueryArrayResult, QueryConfig } from 'pg';
+import type { FunctionEffectRecord, SideEffectKind } from './function-effects';
+/**
+ * node-postgres selects the **simple** query protocol whenever `values` is
+ * falsy (`pg/lib/query.js` → `requiresPreparation`: `if (!this.values) return
+ * false`), and the simple protocol executes *every* semicolon-separated
+ * statement in one round trip. A payload without `params` therefore reached
+ * PostgreSQL as a multi-command string.
+ *
+ * `queryMode: 'extended'` forces Parse/Bind/Execute. PostgreSQL refuses to
+ * parse more than one command into a single prepared statement, so anything
+ * sent through {@link extendedQuery} reaches the engine as exactly one command
+ * regardless of what the classifier or the protocol validator admitted.
+ * `$1`-style parameters keep working because Bind still carries `values`.
+ *
+ * `queryMode` is not yet declared by `@types/pg`.
+ */
+export type ExtendedQueryConfig = QueryConfig & {
+    queryMode: 'extended';
+};
+export type ExtendedQueryArrayConfig = QueryArrayConfig & {
+    queryMode: 'extended';
+};
+/** Minimal result shape used by the internal session/hardening statements. */
+export interface SimpleResult {
+    rows: unknown[];
+    rowCount: number | null;
+    fields: Array<{
+        name: string;
+        dataTypeID: number;
+    }>;
+}
+/**
+ * Build a query config that is guaranteed to travel over the extended query
+ * protocol. `values` is always an array, so node-postgres never takes the
+ * falsy-`values` shortcut; an empty array means "no bind parameters".
+ */
+export declare function extendedQuery(text: string, values?: readonly unknown[]): ExtendedQueryConfig;
+/** {@link extendedQuery} for `rowMode: 'array'` results. */
+export declare function extendedArrayQuery(text: string, values?: readonly unknown[]): ExtendedQueryArrayConfig;
+/** Run a single statement over the extended protocol. */
+export declare function runExtended(client: PoolClient, text: string, values?: readonly unknown[]): Promise<SimpleResult>;
+/** Run a single statement over the extended protocol, rows as arrays. */
+export declare function runExtendedArray(client: PoolClient, text: string, values?: readonly unknown[]): Promise<QueryArrayResult<unknown[]>>;
+/** Result of classifying a SQL statement. */
+export interface StatementClassification {
+    /** High-level type. Derived from the PostgreSQL parse tree root node. */
+    type: 'read' | 'write' | 'ddl' | 'utility' | 'unknown';
+    /** Specific statement kind (SELECT, DROP TABLE, ALTER ROLE, …). */
+    kind: string;
+    /** Whether this statement can run inside a transaction block. */
+    transactional: boolean;
+    /** Detected statement name (uppercased). */
+    verb: string;
+    /**
+     * How many statements PostgreSQL's parser found in the input. Anything other
+     * than 1 must be rejected: the previous token classifier could not see a
+     * trailing `; DROP TABLE`, and node-postgres executes every statement when
+     * the simple query protocol is used.
+     */
+    statement_count: number;
+    /** False when the input could not be parsed. Callers must fail closed. */
+    parse_ok: boolean;
+    /**
+     * Reasons a syntactically valid SELECT is nonetheless not a safe read:
+     * SELECT INTO creates a table, writable CTEs and FOR UPDATE mutate state,
+     * denylisted functions reach the filesystem, other servers, or session
+     * control, and any function reference the catalogue could not prove
+     * `IMMUTABLE` may do anything the calling role may do. Empty array means the
+     * statement is a provable read.
+     */
+    read_violations: string[];
+    /**
+     * Per-function catalogue verdicts for the statement.
+     *
+     * Optional in the type only, so that a hand-built classification (a test
+     * fixture, an older constructor in another package) still compiles. It is
+     * ALWAYS populated by the classifier, and the permission layer treats an
+     * absent array as UNKNOWN rather than as "no functions were referenced" —
+     * `isProvableRead()` refuses such a classification. Reading it as "empty,
+     * therefore safe" is precisely the bug this field exists to close.
+     */
+    function_effects?: FunctionEffectRecord[];
+    /**
+     * Side effects the statement's function references perform outside the
+     * transaction: notifications, advisory locks, sequence advances, XID
+     * allocation, session mutation, remote I/O.
+     *
+     * Optional for the same reason as {@link StatementClassification.function_effects}
+     * and treated the same way: absent means "not known", which is not safe.
+     */
+    side_effects?: SideEffectKind[];
+}
+/** Tracks one in-flight request. */
+export interface InFlightRequest {
+    request_id: string;
+    db_alias: string;
+    /** PG backend PID for this request. Used by canceller. */
+    pid: number;
+    /** When the request started (epoch ms). */
+    started_at: number;
+    /** The originating message, when the caller supplies it. */
+    message?: AgentMessage;
+    /** Abort controller for cancellation. */
+    abort: AbortController;
+    /** Whether this is a streaming request. */
+    is_streaming: boolean;
+}
+/** Result of a single migration statement execution. */
+export interface StatementResult {
+    index: number;
+    status: MigrationStatementStatus;
+    ms: number;
+    rows_affected: number;
+    error?: string;
+    pg_error_code?: string;
+}
+/** Snapshot of one table's schema. */
+export interface TableSnapshot {
+    schema: string;
+    name: string;
+    type: 'table' | 'view' | 'materialized_view';
+    columns: Array<{
+        name: string;
+        type: string;
+        nullable: boolean;
+        default: string | null;
+        is_primary_key: boolean;
+        is_unique: boolean;
+        is_foreign_key: boolean;
+        foreign_key?: {
+            references_schema: string;
+            references_table: string;
+            references_column: string;
+            on_delete: string | null;
+            on_update: string | null;
+        };
+    }>;
+    indexes: Array<{
+        name: string;
+        columns: string[];
+        is_unique: boolean;
+        is_primary: boolean;
+        definition: string;
+    }>;
+    constraints: Array<{
+        name: string;
+        type: 'CHECK' | 'FOREIGN KEY' | 'UNIQUE' | 'PRIMARY KEY' | 'EXCLUSION';
+        definition: string;
+    }>;
+    triggers: Array<{
+        name: string;
+        event: string;
+        timing: string;
+        function: string;
+    }>;
+    partition_info?: {
+        is_partitioned: boolean;
+        partition_key: string | null;
+        partitions: Array<{
+            name: string;
+            for_values: string;
+        }>;
+    };
+    owner: string;
+    comment: string | null;
+}
+/** Full schema snapshot of a database. */
+export interface SchemaSnapshot {
+    pg_version: string;
+    snapshot_at: number;
+    schemas: string[];
+    tables: TableSnapshot[];
+    extensions: Array<{
+        name: string;
+        version: string;
+        enabled: boolean;
+    }>;
+    size_bytes: number;
+}
+/** Pool manager events. */
+export interface PoolManagerEvents {
+    onPoolOpen?: (dbAlias: string) => void;
+    onPoolClose?: (dbAlias: string, reason: 'idle' | 'explicit' | 'error') => void;
+    onConnectionAcquired?: (dbAlias: string) => void;
+    onConnectionReleased?: (dbAlias: string) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/cjs/execution/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/execution/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAM/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG;IAAE,SAAS,EAAE,UAAU,CAAA;CAAE,CAAC;AAC1E,MAAM,MAAM,wBAAwB,GAAG,gBAAgB,GAAG;IAAE,SAAS,EAAE,UAAU,CAAA;CAAE,CAAC;AAEpF,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,mBAAmB,CAE5F;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,wBAAwB,CAE1B;AAED,yDAAyD;AACzD,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC,YAAY,CAAC,CAGvB;AAED,yEAAyE;AACzE,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,CAEtC;AAED,6CAA6C;AAC7C,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAC1C;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;CACjC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,eAAe,CAAC;IACvB,2CAA2C;IAC3C,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,wBAAwB,CAAC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,sCAAsC;AACtC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,mBAAmB,CAAC;IAC7C,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,cAAc,EAAE,OAAO,CAAC;QACxB,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE;YACZ,iBAAiB,EAAE,MAAM,CAAC;YAC1B,gBAAgB,EAAE,MAAM,CAAC;YACzB,iBAAiB,EAAE,MAAM,CAAC;YAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;SAC1B,CAAC;KACH,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,SAAS,EAAE,OAAO,CAAC;QACnB,UAAU,EAAE,OAAO,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,WAAW,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,QAAQ,GAAG,aAAa,GAAG,WAAW,CAAC;QACvE,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,cAAc,CAAC,EAAE;QACf,cAAc,EAAE,OAAO,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,UAAU,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACzD,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,KAAK,IAAI,CAAC;IAC/E,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClD"}

package/dist/cjs/execution/types.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extendedQuery = extendedQuery;
+exports.extendedArrayQuery = extendedArrayQuery;
+exports.runExtended = runExtended;
+exports.runExtendedArray = runExtendedArray;
+/**
+ * Build a query config that is guaranteed to travel over the extended query
+ * protocol. `values` is always an array, so node-postgres never takes the
+ * falsy-`values` shortcut; an empty array means "no bind parameters".
+ */
+function extendedQuery(text, values) {
+    return { text, queryMode: 'extended', values: values ? [...values] : [] };
+}
+/** {@link extendedQuery} for `rowMode: 'array'` results. */
+function extendedArrayQuery(text, values) {
+    return { text, queryMode: 'extended', rowMode: 'array', values: values ? [...values] : [] };
+}
+/** Run a single statement over the extended protocol. */
+async function runExtended(client, text, values) {
+    const res = await client.query(extendedQuery(text, values));
+    return res;
+}
+/** Run a single statement over the extended protocol, rows as arrays. */
+async function runExtendedArray(client, text, values) {
+    return (await client.query(extendedArrayQuery(text, values)));
+}
+//# sourceMappingURL=types.js.map

package/dist/cjs/execution/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/execution/types.ts"],"names":[],"mappings":";;AAsCA,sCAEC;AAGD,gDAKC;AAGD,kCAOC;AAGD,4CAMC;AAlCD;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAY,EAAE,MAA2B;IACrE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,4DAA4D;AAC5D,SAAgB,kBAAkB,CAChC,IAAY,EACZ,MAA2B;IAE3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC9F,CAAC;AAED,yDAAyD;AAClD,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,IAAY,EACZ,MAA2B;IAE3B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO,GAA8B,CAAC;AACxC,CAAC;AAED,yEAAyE;AAClE,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,IAAY,EACZ,MAA2B;IAE3B,OAAO,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAgC,CAAC;AAC/F,CAAC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,34 @@
+export declare const VERSION = "2.0.0";
+export * from './config/machine-config';
+export * from './config/db-config';
+export * from './config/paths';
+export * from './config/token';
+export * from './config/schema';
+export { PROTOCOL_VERSION, DEFAULTS, LIMITS } from './protocol/constants';
+export { AgentMessage, Role, MessageType, EventKind, MigrationStatementStatus, createMessage, } from './protocol/envelope';
+export * from './protocol/messages';
+export { ErrorCode, ErrorMetadata, ERROR_CATALOG, getErrorMetadata, isFatalError, isRetryableError, makeError, } from './protocol/errors';
+export { serialize, deserialize, serializeToBytes, deserializeFromBytes, ProtocolError, } from './protocol/serialize';
+export { validateEnvelope, validatePayload, validateMessage, } from './protocol/validate';
+export { WakeChannel, WakeChannelOptions } from './channels/wake-channel';
+export { DataChannel, DataChannelOptions } from './channels/data-channel';
+export { AgentSession, AgentSessionOptions } from './channels/agent-session';
+export { Backoff, sleep, withJitter } from './channels/reconnect';
+export { WakeChannelState, DataChannelState, DataChannelCloseReason, WakeEvent, AgentSessionState, MessageHandler, StateChangeHandler, } from './channels/types';
+export { PoolManager, PoolError } from './execution/pool';
+export { QueryRunner, QueryTooLargeError, QueryCancelledError, QueryRunContext } from './execution/query-runner';
+export { MigrationRunner, MigrationInProgressError, MigrationContext } from './execution/migration-runner';
+export { Canceller } from './execution/canceller';
+export { Introspector } from './execution/introspection';
+export { Dispatcher, DispatcherOptions } from './execution/dispatcher';
+export { classifyStatement } from './execution/statement-classifier';
+export { detectNonTransactional } from './execution/non-tx-detector';
+export * from './execution/types';
+export { PermissionChecker, PermissionCheckerOptions } from './permissions/checker';
+export { AutoUpgradeChecker, AutoUpgradeOptions } from './permissions/auto-upgrade';
+export { ManualApprovalHandler, ManualApprovalOptions } from './permissions/manual-approval';
+export { PlanRegistry, RegisteredPlan, PlanRegistryOptions } from './permissions/plan-registry';
+export { ROLE_CAPABILITIES, RoleCapability, hasCapability, capabilityForClassification, capabilityForMessageType, } from './permissions/role-policy';
+export { ActionRequest, PermissionDecision, AutoUpgradeResult, ManualApprovalResult, } from './permissions/types';
+export * from './audit';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EACL,YAAY,EACZ,IAAI,EACJ,WAAW,EACX,SAAS,EACT,wBAAwB,EACxB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,OAAO,EACL,SAAS,EACT,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,SAAS,GACV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AACjH,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3G,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EACL,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAChD,2BAA2B,EAAE,wBAAwB,GACtD,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,GAC3E,MAAM,qBAAqB,CAAC;AAG7B,cAAc,SAAS,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,98 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.capabilityForMessageType = exports.capabilityForClassification = exports.hasCapability = exports.ROLE_CAPABILITIES = exports.PlanRegistry = exports.ManualApprovalHandler = exports.AutoUpgradeChecker = exports.PermissionChecker = exports.detectNonTransactional = exports.classifyStatement = exports.Dispatcher = exports.Introspector = exports.Canceller = exports.MigrationInProgressError = exports.MigrationRunner = exports.QueryCancelledError = exports.QueryTooLargeError = exports.QueryRunner = exports.PoolError = exports.PoolManager = exports.withJitter = exports.sleep = exports.Backoff = exports.AgentSession = exports.DataChannel = exports.WakeChannel = exports.validateMessage = exports.validatePayload = exports.validateEnvelope = exports.ProtocolError = exports.deserializeFromBytes = exports.serializeToBytes = exports.deserialize = exports.serialize = exports.makeError = exports.isRetryableError = exports.isFatalError = exports.getErrorMetadata = exports.ERROR_CATALOG = exports.createMessage = exports.LIMITS = exports.DEFAULTS = exports.PROTOCOL_VERSION = exports.VERSION = void 0;
+exports.VERSION = '2.0.0';
+// Config (from Part 2)
+__exportStar(require("./config/machine-config"), exports);
+__exportStar(require("./config/db-config"), exports);
+__exportStar(require("./config/paths"), exports);
+__exportStar(require("./config/token"), exports);
+__exportStar(require("./config/schema"), exports);
+// Protocol (new in Part 3)
+var constants_1 = require("./protocol/constants");
+Object.defineProperty(exports, "PROTOCOL_VERSION", { enumerable: true, get: function () { return constants_1.PROTOCOL_VERSION; } });
+Object.defineProperty(exports, "DEFAULTS", { enumerable: true, get: function () { return constants_1.DEFAULTS; } });
+Object.defineProperty(exports, "LIMITS", { enumerable: true, get: function () { return constants_1.LIMITS; } });
+var envelope_1 = require("./protocol/envelope");
+Object.defineProperty(exports, "createMessage", { enumerable: true, get: function () { return envelope_1.createMessage; } });
+__exportStar(require("./protocol/messages"), exports);
+var errors_1 = require("./protocol/errors");
+Object.defineProperty(exports, "ERROR_CATALOG", { enumerable: true, get: function () { return errors_1.ERROR_CATALOG; } });
+Object.defineProperty(exports, "getErrorMetadata", { enumerable: true, get: function () { return errors_1.getErrorMetadata; } });
+Object.defineProperty(exports, "isFatalError", { enumerable: true, get: function () { return errors_1.isFatalError; } });
+Object.defineProperty(exports, "isRetryableError", { enumerable: true, get: function () { return errors_1.isRetryableError; } });
+Object.defineProperty(exports, "makeError", { enumerable: true, get: function () { return errors_1.makeError; } });
+var serialize_1 = require("./protocol/serialize");
+Object.defineProperty(exports, "serialize", { enumerable: true, get: function () { return serialize_1.serialize; } });
+Object.defineProperty(exports, "deserialize", { enumerable: true, get: function () { return serialize_1.deserialize; } });
+Object.defineProperty(exports, "serializeToBytes", { enumerable: true, get: function () { return serialize_1.serializeToBytes; } });
+Object.defineProperty(exports, "deserializeFromBytes", { enumerable: true, get: function () { return serialize_1.deserializeFromBytes; } });
+Object.defineProperty(exports, "ProtocolError", { enumerable: true, get: function () { return serialize_1.ProtocolError; } });
+var validate_1 = require("./protocol/validate");
+Object.defineProperty(exports, "validateEnvelope", { enumerable: true, get: function () { return validate_1.validateEnvelope; } });
+Object.defineProperty(exports, "validatePayload", { enumerable: true, get: function () { return validate_1.validatePayload; } });
+Object.defineProperty(exports, "validateMessage", { enumerable: true, get: function () { return validate_1.validateMessage; } });
+// Channels (new in Part 4)
+var wake_channel_1 = require("./channels/wake-channel");
+Object.defineProperty(exports, "WakeChannel", { enumerable: true, get: function () { return wake_channel_1.WakeChannel; } });
+var data_channel_1 = require("./channels/data-channel");
+Object.defineProperty(exports, "DataChannel", { enumerable: true, get: function () { return data_channel_1.DataChannel; } });
+var agent_session_1 = require("./channels/agent-session");
+Object.defineProperty(exports, "AgentSession", { enumerable: true, get: function () { return agent_session_1.AgentSession; } });
+var reconnect_1 = require("./channels/reconnect");
+Object.defineProperty(exports, "Backoff", { enumerable: true, get: function () { return reconnect_1.Backoff; } });
+Object.defineProperty(exports, "sleep", { enumerable: true, get: function () { return reconnect_1.sleep; } });
+Object.defineProperty(exports, "withJitter", { enumerable: true, get: function () { return reconnect_1.withJitter; } });
+// Execution (new in Part 5)
+var pool_1 = require("./execution/pool");
+Object.defineProperty(exports, "PoolManager", { enumerable: true, get: function () { return pool_1.PoolManager; } });
+Object.defineProperty(exports, "PoolError", { enumerable: true, get: function () { return pool_1.PoolError; } });
+var query_runner_1 = require("./execution/query-runner");
+Object.defineProperty(exports, "QueryRunner", { enumerable: true, get: function () { return query_runner_1.QueryRunner; } });
+Object.defineProperty(exports, "QueryTooLargeError", { enumerable: true, get: function () { return query_runner_1.QueryTooLargeError; } });
+Object.defineProperty(exports, "QueryCancelledError", { enumerable: true, get: function () { return query_runner_1.QueryCancelledError; } });
+var migration_runner_1 = require("./execution/migration-runner");
+Object.defineProperty(exports, "MigrationRunner", { enumerable: true, get: function () { return migration_runner_1.MigrationRunner; } });
+Object.defineProperty(exports, "MigrationInProgressError", { enumerable: true, get: function () { return migration_runner_1.MigrationInProgressError; } });
+var canceller_1 = require("./execution/canceller");
+Object.defineProperty(exports, "Canceller", { enumerable: true, get: function () { return canceller_1.Canceller; } });
+var introspection_1 = require("./execution/introspection");
+Object.defineProperty(exports, "Introspector", { enumerable: true, get: function () { return introspection_1.Introspector; } });
+var dispatcher_1 = require("./execution/dispatcher");
+Object.defineProperty(exports, "Dispatcher", { enumerable: true, get: function () { return dispatcher_1.Dispatcher; } });
+var statement_classifier_1 = require("./execution/statement-classifier");
+Object.defineProperty(exports, "classifyStatement", { enumerable: true, get: function () { return statement_classifier_1.classifyStatement; } });
+var non_tx_detector_1 = require("./execution/non-tx-detector");
+Object.defineProperty(exports, "detectNonTransactional", { enumerable: true, get: function () { return non_tx_detector_1.detectNonTransactional; } });
+__exportStar(require("./execution/types"), exports);
+// Permissions (new in Part 6)
+var checker_1 = require("./permissions/checker");
+Object.defineProperty(exports, "PermissionChecker", { enumerable: true, get: function () { return checker_1.PermissionChecker; } });
+var auto_upgrade_1 = require("./permissions/auto-upgrade");
+Object.defineProperty(exports, "AutoUpgradeChecker", { enumerable: true, get: function () { return auto_upgrade_1.AutoUpgradeChecker; } });
+var manual_approval_1 = require("./permissions/manual-approval");
+Object.defineProperty(exports, "ManualApprovalHandler", { enumerable: true, get: function () { return manual_approval_1.ManualApprovalHandler; } });
+var plan_registry_1 = require("./permissions/plan-registry");
+Object.defineProperty(exports, "PlanRegistry", { enumerable: true, get: function () { return plan_registry_1.PlanRegistry; } });
+var role_policy_1 = require("./permissions/role-policy");
+Object.defineProperty(exports, "ROLE_CAPABILITIES", { enumerable: true, get: function () { return role_policy_1.ROLE_CAPABILITIES; } });
+Object.defineProperty(exports, "hasCapability", { enumerable: true, get: function () { return role_policy_1.hasCapability; } });
+Object.defineProperty(exports, "capabilityForClassification", { enumerable: true, get: function () { return role_policy_1.capabilityForClassification; } });
+Object.defineProperty(exports, "capabilityForMessageType", { enumerable: true, get: function () { return role_policy_1.capabilityForMessageType; } });
+// Audit (Part 7)
+__exportStar(require("./audit"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAa,QAAA,OAAO,GAAG,OAAO,CAAC;AAE/B,uBAAuB;AACvB,0DAAwC;AACxC,qDAAmC;AACnC,iDAA+B;AAC/B,iDAA+B;AAC/B,kDAAgC;AAEhC,2BAA2B;AAC3B,kDAA0E;AAAjE,6GAAA,gBAAgB,OAAA;AAAE,qGAAA,QAAQ,OAAA;AAAE,mGAAA,MAAM,OAAA;AAC3C,gDAO6B;AAD3B,yGAAA,aAAa,OAAA;AAEf,sDAAoC;AACpC,4CAQ2B;AALzB,uGAAA,aAAa,OAAA;AACb,0GAAA,gBAAgB,OAAA;AAChB,sGAAA,YAAY,OAAA;AACZ,0GAAA,gBAAgB,OAAA;AAChB,mGAAA,SAAS,OAAA;AAEX,kDAM8B;AAL5B,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,0GAAA,aAAa,OAAA;AAEf,gDAI6B;AAH3B,4GAAA,gBAAgB,OAAA;AAChB,2GAAA,eAAe,OAAA;AACf,2GAAA,eAAe,OAAA;AAGjB,2BAA2B;AAC3B,wDAA0E;AAAjE,2GAAA,WAAW,OAAA;AACpB,wDAA0E;AAAjE,2GAAA,WAAW,OAAA;AACpB,0DAA6E;AAApE,6GAAA,YAAY,OAAA;AACrB,kDAAkE;AAAzD,oGAAA,OAAO,OAAA;AAAE,kGAAA,KAAK,OAAA;AAAE,uGAAA,UAAU,OAAA;AAWnC,4BAA4B;AAC5B,yCAA0D;AAAjD,mGAAA,WAAW,OAAA;AAAE,iGAAA,SAAS,OAAA;AAC/B,yDAAiH;AAAxG,2GAAA,WAAW,OAAA;AAAE,kHAAA,kBAAkB,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAC7D,iEAA2G;AAAlG,mHAAA,eAAe,OAAA;AAAE,4HAAA,wBAAwB,OAAA;AAClD,mDAAkD;AAAzC,sGAAA,SAAS,OAAA;AAClB,2DAAyD;AAAhD,6GAAA,YAAY,OAAA;AACrB,qDAAuE;AAA9D,wGAAA,UAAU,OAAA;AACnB,yEAAqE;AAA5D,yHAAA,iBAAiB,OAAA;AAC1B,+DAAqE;AAA5D,yHAAA,sBAAsB,OAAA;AAC/B,oDAAkC;AAElC,8BAA8B;AAC9B,iDAAoF;AAA3E,4GAAA,iBAAiB,OAAA;AAC1B,2DAAoF;AAA3E,kHAAA,kBAAkB,OAAA;AAC3B,iEAA6F;AAApF,wHAAA,qBAAqB,OAAA;AAC9B,6DAAgG;AAAvF,6GAAA,YAAY,OAAA;AACrB,yDAGmC;AAFjC,gHAAA,iBAAiB,OAAA;AAAkB,4GAAA,aAAa,OAAA;AAChD,0HAAA,2BAA2B,OAAA;AAAE,uHAAA,wBAAwB,OAAA;AAMvD,iBAAiB;AACjB,0CAAwB"}

package/dist/cjs/permissions/auto-upgrade.d.ts

@@ -0,0 +1,40 @@
+import { ActionRequest, AutoUpgradeResult } from './types';
+import { PlanRegistry } from './plan-registry';
+export interface AutoUpgradeOptions {
+    planRegistry: PlanRegistry;
+}
+export declare class AutoUpgradeChecker {
+    private readonly opts;
+    constructor(opts: AutoUpgradeOptions);
+    /**
+     * Check whether auto-upgrade should be granted.
+     *
+     * Only meaningful when permission_level === 'auto_upgrade'.
+     *
+     * Auto-upgrade is granted only when ALL of the following hold:
+     *   - the effective permission level really is `auto_upgrade`; this checker
+     *     grants nothing at `read_only`, `manual` or `full`, so a caller that
+     *     reaches it on the wrong path is refused rather than trusted
+     *   - the message really is a `migration_run`
+     *   - the role holds `migration_run`
+     *   - a plan id is present and is registered, unexpired, and its statements
+     *     hash matches the statements being submitted
+     *   - the plan's registering principal is bound to this execution: the runner
+     *     is the registrant, or holds a strictly more privileged role, and the
+     *     permission level at execution is at least as permissive as the level the
+     *     plan was registered under
+     *   - every statement parses, is exactly one statement, and is not a read
+     *   - the plan is consumed, so it cannot be replayed
+     *
+     * The last four conditions are decided by ONE synchronous call into the
+     * registry (`consume()`), not by a validate-then-authorise-then-delete
+     * sequence: `consume()` removes the plan in the same tick it grants it, so
+     * no interleaving of two `migration_run` frames can ever be granted twice.
+     *
+     * Without the provenance rules the registry is a self-attesting allow-list:
+     * the same untrusted principal registers the plan and runs it, so a statement
+     * hash match proves nothing at all.
+     */
+    check(req: ActionRequest, statements?: string[]): Promise<AutoUpgradeResult>;
+}
+//# sourceMappingURL=auto-upgrade.d.ts.map

package/dist/cjs/permissions/auto-upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-upgrade.d.ts","sourceRoot":"","sources":["../../../src/permissions/auto-upgrade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAsB,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,YAAY,EAA2B,MAAM,iBAAiB,CAAC;AAKxE,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;gBAE9B,IAAI,EAAE,kBAAkB;IAIpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAoHnF"}

package/dist/cjs/permissions/auto-upgrade.js

@@ -0,0 +1,168 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AutoUpgradeChecker = void 0;
+const role_policy_1 = require("./role-policy");
+const statement_classifier_1 = require("../execution/statement-classifier");
+const sql_parser_1 = require("../execution/sql-parser");
+class AutoUpgradeChecker {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /**
+     * Check whether auto-upgrade should be granted.
+     *
+     * Only meaningful when permission_level === 'auto_upgrade'.
+     *
+     * Auto-upgrade is granted only when ALL of the following hold:
+     *   - the effective permission level really is `auto_upgrade`; this checker
+     *     grants nothing at `read_only`, `manual` or `full`, so a caller that
+     *     reaches it on the wrong path is refused rather than trusted
+     *   - the message really is a `migration_run`
+     *   - the role holds `migration_run`
+     *   - a plan id is present and is registered, unexpired, and its statements
+     *     hash matches the statements being submitted
+     *   - the plan's registering principal is bound to this execution: the runner
+     *     is the registrant, or holds a strictly more privileged role, and the
+     *     permission level at execution is at least as permissive as the level the
+     *     plan was registered under
+     *   - every statement parses, is exactly one statement, and is not a read
+     *   - the plan is consumed, so it cannot be replayed
+     *
+     * The last four conditions are decided by ONE synchronous call into the
+     * registry (`consume()`), not by a validate-then-authorise-then-delete
+     * sequence: `consume()` removes the plan in the same tick it grants it, so
+     * no interleaving of two `migration_run` frames can ever be granted twice.
+     *
+     * Without the provenance rules the registry is a self-attesting allow-list:
+     * the same untrusted principal registers the plan and runs it, so a statement
+     * hash match proves nothing at all.
+     */
+    async check(req, statements) {
+        // Rule 0: this checker exists to satisfy `auto_upgrade` and nothing else.
+        // `PermissionChecker` only calls it at that level, so any other level means
+        // a caller reached the upgrade path directly; refuse rather than upgrade.
+        if (req.permission_level !== 'auto_upgrade') {
+            return {
+                granted: false,
+                reason: `Auto-upgrade is only available at permission level 'auto_upgrade', got ${req.permission_level}`,
+            };
+        }
+        // Rule 1: must be a migration_run message
+        if (req.message_type !== 'migration_run') {
+            return {
+                granted: false,
+                reason: `Auto-upgrade only available for migration_run, got ${req.message_type}`,
+            };
+        }
+        // Rule 2: role must allow migration_run
+        if (!(0, role_policy_1.hasCapability)(req.role, 'migration_run')) {
+            return {
+                granted: false,
+                reason: `Role ${req.role} cannot run migrations`,
+            };
+        }
+        // Rule 3: plan_id must be present
+        if (!req.plan_id) {
+            return { granted: false, reason: 'No plan_id provided for migration_run' };
+        }
+        // Rule 4: statements must be present
+        if (!statements || statements.length === 0) {
+            return { granted: false, reason: 'No statements provided for validation' };
+        }
+        // Rule 5: every statement must parse AND be exactly one statement
+        const classifications = [];
+        for (let i = 0; i < statements.length; i++) {
+            let c;
+            try {
+                c = await (0, statement_classifier_1.classifyStatement)(statements[i]);
+            }
+            catch (err) {
+                // Fail closed: an unparseable statement or an unavailable parser is a
+                // refusal, never a guess.
+                const detail = err instanceof sql_parser_1.SqlParseError || err instanceof sql_parser_1.SqlParserUnavailableError
+                    ? err.message
+                    : String(err);
+                return {
+                    granted: false,
+                    reason: `Statement ${i + 1} could not be verified: ${detail}`,
+                };
+            }
+            if (c.statement_count !== 1) {
+                return {
+                    granted: false,
+                    reason: `Statement ${i + 1} contains ${c.statement_count} statements; each plan entry must be exactly one statement`,
+                };
+            }
+            if (c.type === 'read') {
+                return {
+                    granted: false,
+                    reason: `Migration plan contains a read-only statement: ${c.verb}. Auto-upgrade not granted for reads.`,
+                };
+            }
+            if (c.type === 'unknown') {
+                return {
+                    granted: false,
+                    reason: `Migration plan contains an unclassifiable statement: ${c.verb}`,
+                };
+            }
+            if (c.read_violations.includes('executable_block')) {
+                return {
+                    granted: false,
+                    reason: `Migration plan statement ${i + 1} (${c.verb} ${c.kind}) can execute arbitrary code and is never auto-approved`,
+                };
+            }
+            classifications.push(c);
+        }
+        // Rule 6 + 7: the plan must be registered, unexpired, bound to exactly
+        // these statements, and authorise THIS principal — and it is destroyed in
+        // the same synchronous step, so a second frame that arrives while the
+        // statements above were being parsed finds a tombstone and is refused.
+        // The runner is bound to the RESOLVED database, not to what the frame claimed.
+        // A plan registered against production must not be executable by a frame that
+        // says `dev` while resolving to production, and `assertPlanScope` is
+        // fail-closed, so a caller with no resolved identity at all is refused here
+        // and again in `dispatcher`'s pre-flight `assertExecutionScope`.
+        const consumption = this.opts.planRegistry.consume(req.plan_id, statements, {
+            user_id: req.user.id,
+            role: req.role,
+            permission_level: req.permission_level,
+            scope: resolvedScopeOf(req),
+        });
+        if (!consumption.ok) {
+            const provenanceRefusals = [
+                'runner_not_privileged',
+                'principal_not_attested',
+                'registered_at_more_permissive_level',
+            ];
+            return {
+                granted: false,
+                reason: provenanceRefusals.includes(consumption.code)
+                    ? `Plan provenance rejected: ${consumption.reason}`
+                    : `Plan validation failed: ${consumption.reason}`,
+            };
+        }
+        return {
+            granted: true,
+            reason: `Auto-upgrade granted for migration plan ${req.plan_id} (${classifications.length} statement(s) verified)`,
+        };
+    }
+}
+exports.AutoUpgradeChecker = AutoUpgradeChecker;
+/**
+ * The database this request is actually about.
+ *
+ * Prefers the resolved identity the dispatcher looked up over the pair the frame
+ * asserted. Both halves are required: a scope missing either one is `undefined`,
+ * which `PlanRegistry.assertPlanScope` refuses rather than treats as a wildcard.
+ */
+function resolvedScopeOf(req) {
+    const project = req.resolved_project ?? req.project;
+    const dbAlias = req.resolved_db_alias ?? req.db_alias;
+    if (typeof project !== 'string' || project.length === 0)
+        return undefined;
+    if (typeof dbAlias !== 'string' || dbAlias.length === 0)
+        return undefined;
+    return { project, db_alias: dbAlias };
+}
+//# sourceMappingURL=auto-upgrade.js.map

package/dist/cjs/permissions/auto-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-upgrade.js","sourceRoot":"","sources":["../../../src/permissions/auto-upgrade.ts"],"names":[],"mappings":";;;AAEA,+CAA8C;AAC9C,4EAAsE;AACtE,wDAAmF;AAMnF,MAAa,kBAAkB;IACZ,IAAI,CAAqB;IAE1C,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,KAAK,CAAC,GAAkB,EAAE,UAAqB;QACnD,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,GAAG,CAAC,gBAAgB,KAAK,cAAc,EAAE,CAAC;YAC5C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,0EAA0E,GAAG,CAAC,gBAAgB,EAAE;aACzG,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,IAAI,GAAG,CAAC,YAAY,KAAK,eAAe,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,sDAAsD,GAAG,CAAC,YAAY,EAAE;aACjF,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,IAAA,2BAAa,EAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YAC9C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,QAAQ,GAAG,CAAC,IAAI,wBAAwB;aACjD,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QAC7E,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QAC7E,CAAC;QAED,kEAAkE;QAClE,MAAM,eAAe,GAAG,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC;YACN,IAAI,CAAC;gBACH,CAAC,GAAG,MAAM,IAAA,wCAAiB,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,sEAAsE;gBACtE,0BAA0B;gBAC1B,MAAM,MAAM,GACV,GAAG,YAAY,0BAAa,IAAI,GAAG,YAAY,sCAAyB;oBACtE,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,2BAA2B,MAAM,EAAE;iBAC9D,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,eAAe,4DAA4D;iBACrH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kDAAkD,CAAC,CAAC,IAAI,uCAAuC;iBACxG,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,wDAAwD,CAAC,CAAC,IAAI,EAAE;iBACzE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACnD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,yDAAyD;iBACxH,CAAC;YACJ,CAAC;YACD,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,+EAA+E;QAC/E,8EAA8E;QAC9E,qEAAqE;QACrE,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE;YAC1E,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,kBAAkB,GAAyB;gBAC/C,uBAAuB;gBACvB,wBAAwB;gBACxB,qCAAqC;aACtC,CAAC;YACF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC;oBACnD,CAAC,CAAC,6BAA6B,WAAW,CAAC,MAAM,EAAE;oBACnD,CAAC,CAAC,2BAA2B,WAAW,CAAC,MAAM,EAAE;aACpD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,2CAA2C,GAAG,CAAC,OAAO,KAAK,eAAe,CAAC,MAAM,yBAAyB;SACnH,CAAC;IACJ,CAAC;CACF;AAxJD,gDAwJC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAkB;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,OAAO,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,IAAI,GAAG,CAAC,QAAQ,CAAC;IACtD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC"}