@vericto/sdk 0.0.0-stage → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/better-sqlite3.ts"],"names":["sqlToExecute","Vericto"],"mappings":";;;;;AAkBO,IAAM,OAAA,GAAU;AAgBhB,IAAM,kBAAN,MAAoD;AAAA;AAAA,EAEhD,GAAA;AAAA,EACA,OAAA;AAAA,EAET,WAAA,CAAY,IAAO,OAAA,EAAkB;AACnC,IAAA,IAAA,CAAK,GAAA,GAAM,EAAA;AACX,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA;AAAA,EAGA,MAAM,QAAQ,GAAA,EAAsC;AAClD,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,KAAK,OAAO,CAAA;AACrD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,mBAAmB,GAAA,EAAuE;AAC9F,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,KAAK,OAAO,CAAA;AACvD,IAAA,OAAO,EAAE,WAAW,IAAA,CAAK,GAAA,CAAI,QAAQA,8BAAA,CAAa,OAAO,CAAC,CAAA,EAAqB,OAAA,EAAQ;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAK,GAAA,EAA4B;AACrC,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,KAAK,OAAO,CAAA;AACrD,IAAA,IAAA,CAAK,GAAA,CAAI,KAAK,KAAK,CAAA;AACnB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,GAAA,EAAA,GAAgB,MAAA,EAA6D;AACrF,IAAA,OAAO,KAAK,MAAM,IAAA,CAAK,QAAQ,GAAG,CAAA,EAAG,OAAO,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,GAAA,EAAA,GAAgB,MAAA,EAA6D;AACrF,IAAA,OAAO,KAAK,MAAM,IAAA,CAAK,QAAQ,GAAG,CAAA,EAAG,OAAO,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,GAAA,EAAA,GAAgB,MAAA,EAA6D;AACrF,IAAA,OAAO,KAAK,MAAM,IAAA,CAAK,QAAQ,GAAG,CAAA,EAAG,OAAO,MAAM,CAAA;AAAA,EACpD;AACF;AAEA,SAAS,IAAA,CAAK,SAAA,EAAoB,MAAA,EAAgB,MAAA,EAA4B;AAC5E,EAAA,MAAM,EAAA,GAAM,UAAsC,MAAM,CAAA;AACxD,EAAA,IAAI,OAAO,OAAO,UAAA,EAAY,MAAM,IAAI,SAAA,CAAU,CAAA,uCAAA,EAA0C,MAAM,CAAA,EAAA,CAAI,CAAA;AACtG,EAAA,OAAQ,EAAA,CAAuC,KAAA,CAAM,SAAA,EAAW,MAAM,CAAA;AACxE;AAMA,eAAsB,aAAA,CACpB,EAAA,EACA,OAAA,GAAwB,EAAC,EACI;AAC7B,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,IAAIC,yBAAA,EAAQ;AAC/C,EAAA,MAAM,OAAA,CAAQ,eAAe,OAAO,CAAA;AACpC,EAAA,OAAO,IAAI,eAAA,CAAgB,EAAA,EAAI,OAAO,CAAA;AACxC","file":"better-sqlite3.cjs","sourcesContent":["/**\n * Vericto for `better-sqlite3`.\n *\n * better-sqlite3 is synchronous and Vericto is a network call, so the SQL-carrying\n * entry points become async: `await db.prepare(sql)` checks the SQL once and\n * resolves the real `Statement`, whose `run`/`all`/`get`/`iterate` then stay\n * synchronous (the SQL of a prepared statement cannot change). Prepare statements\n * before a `db.raw.transaction(...)` and use them inside it.\n *\n * SQLite has no server, so this wrapper is the enforcement point: SQL run through\n * `db.raw` or another connection to the same file is not checked. The Vericto server\n * evaluates the `sqlite` dialect (vericto-engine 4.1.0+); `guardDatabase` still asks\n * it (`GET /api/v1/meta/config`) and rejects with `VerictoUnsupportedDialectError`,\n * with no SQL run, against a server that does not list `sqlite`.\n */\nimport { Vericto } from './guard.js';\nimport { sqlToExecute, type Verdict } from './verdict.js';\n\nexport const DIALECT = 'sqlite';\n\n/** The part of a better-sqlite3 `Database` this wrapper uses. */\nexport interface SqliteDatabaseLike {\n prepare(source: string): unknown;\n exec(source: string): unknown;\n}\n\ntype StatementOf<D> = D extends { prepare(source: string): infer S } ? S : never;\ntype ResultOf<S, K extends string> = S extends Record<K, (...args: never[]) => infer R> ? R : unknown;\n\nexport interface GuardOptions {\n /** The guard to use. Default: `new Vericto()` from the `VERICTO_*` environment. */\n vericto?: Vericto;\n}\n\nexport class GuardedDatabase<D extends SqliteDatabaseLike> {\n /** The underlying database. SQL run through it directly is **not** checked. */\n readonly raw: D;\n readonly vericto: Vericto;\n\n constructor(db: D, vericto: Vericto) {\n this.raw = db;\n this.vericto = vericto;\n }\n\n /** Check `sql`, then `db.prepare()` the SQL to run (the masked rewrite, if any). */\n async prepare(sql: string): Promise<StatementOf<D>> {\n const final = await this.vericto.prepare(sql, DIALECT);\n return this.raw.prepare(final) as StatementOf<D>;\n }\n\n /** Like `prepare`, also resolving the verdict (decision, rule, event id). */\n async prepareWithVerdict(sql: string): Promise<{ statement: StatementOf<D>; verdict: Verdict }> {\n const verdict = await this.vericto.enforce(sql, DIALECT);\n return { statement: this.raw.prepare(sqlToExecute(verdict)) as StatementOf<D>, verdict };\n }\n\n /**\n * Check a script, then `db.exec()` it. The script is evaluated as one request (the\n * engine evaluates every statement in it); a block anywhere means nothing runs.\n */\n async exec(sql: string): Promise<this> {\n const final = await this.vericto.prepare(sql, DIALECT);\n this.raw.exec(final);\n return this;\n }\n\n /** `prepare(sql)` then `statement.run(...params)`. */\n async run(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'run'>> {\n return call(await this.prepare(sql), 'run', params) as ResultOf<StatementOf<D>, 'run'>;\n }\n\n /** `prepare(sql)` then `statement.all(...params)`. */\n async all(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'all'>> {\n return call(await this.prepare(sql), 'all', params) as ResultOf<StatementOf<D>, 'all'>;\n }\n\n /** `prepare(sql)` then `statement.get(...params)`. */\n async get(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'get'>> {\n return call(await this.prepare(sql), 'get', params) as ResultOf<StatementOf<D>, 'get'>;\n }\n}\n\nfunction call(statement: unknown, method: string, params: unknown[]): unknown {\n const fn = (statement as Record<string, unknown>)[method];\n if (typeof fn !== 'function') throw new TypeError(`vericto: the prepared statement has no ${method}()`);\n return (fn as (...args: unknown[]) => unknown).apply(statement, params);\n}\n\n/**\n * Guard a better-sqlite3 `Database`. Rejects with `VerictoUnsupportedDialectError`\n * when the server does not list the `sqlite` dialect.\n */\nexport async function guardDatabase<D extends SqliteDatabaseLike>(\n db: D,\n options: GuardOptions = {},\n): Promise<GuardedDatabase<D>> {\n const vericto = options.vericto ?? new Vericto();\n await vericto.requireDialect(DIALECT);\n return new GuardedDatabase(db, vericto);\n}\n"]}
@@ -0,0 +1,64 @@
1
+ import { Vericto, Verdict } from './index.cjs';
2
+
3
+ /**
4
+ * Vericto for `better-sqlite3`.
5
+ *
6
+ * better-sqlite3 is synchronous and Vericto is a network call, so the SQL-carrying
7
+ * entry points become async: `await db.prepare(sql)` checks the SQL once and
8
+ * resolves the real `Statement`, whose `run`/`all`/`get`/`iterate` then stay
9
+ * synchronous (the SQL of a prepared statement cannot change). Prepare statements
10
+ * before a `db.raw.transaction(...)` and use them inside it.
11
+ *
12
+ * SQLite has no server, so this wrapper is the enforcement point: SQL run through
13
+ * `db.raw` or another connection to the same file is not checked. The Vericto server
14
+ * evaluates the `sqlite` dialect (vericto-engine 4.1.0+); `guardDatabase` still asks
15
+ * it (`GET /api/v1/meta/config`) and rejects with `VerictoUnsupportedDialectError`,
16
+ * with no SQL run, against a server that does not list `sqlite`.
17
+ */
18
+
19
+ declare const DIALECT = "sqlite";
20
+ /** The part of a better-sqlite3 `Database` this wrapper uses. */
21
+ interface SqliteDatabaseLike {
22
+ prepare(source: string): unknown;
23
+ exec(source: string): unknown;
24
+ }
25
+ type StatementOf<D> = D extends {
26
+ prepare(source: string): infer S;
27
+ } ? S : never;
28
+ type ResultOf<S, K extends string> = S extends Record<K, (...args: never[]) => infer R> ? R : unknown;
29
+ interface GuardOptions {
30
+ /** The guard to use. Default: `new Vericto()` from the `VERICTO_*` environment. */
31
+ vericto?: Vericto;
32
+ }
33
+ declare class GuardedDatabase<D extends SqliteDatabaseLike> {
34
+ /** The underlying database. SQL run through it directly is **not** checked. */
35
+ readonly raw: D;
36
+ readonly vericto: Vericto;
37
+ constructor(db: D, vericto: Vericto);
38
+ /** Check `sql`, then `db.prepare()` the SQL to run (the masked rewrite, if any). */
39
+ prepare(sql: string): Promise<StatementOf<D>>;
40
+ /** Like `prepare`, also resolving the verdict (decision, rule, event id). */
41
+ prepareWithVerdict(sql: string): Promise<{
42
+ statement: StatementOf<D>;
43
+ verdict: Verdict;
44
+ }>;
45
+ /**
46
+ * Check a script, then `db.exec()` it. The script is evaluated as one request (the
47
+ * engine evaluates every statement in it); a block anywhere means nothing runs.
48
+ */
49
+ exec(sql: string): Promise<this>;
50
+ /** `prepare(sql)` then `statement.run(...params)`. */
51
+ run(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'run'>>;
52
+ /** `prepare(sql)` then `statement.all(...params)`. */
53
+ all(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'all'>>;
54
+ /** `prepare(sql)` then `statement.get(...params)`. */
55
+ get(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'get'>>;
56
+ }
57
+ /**
58
+ * Guard a better-sqlite3 `Database`. Rejects with `VerictoUnsupportedDialectError`
59
+ * when the server does not list the `sqlite` dialect.
60
+ */
61
+ declare function guardDatabase<D extends SqliteDatabaseLike>(db: D, options?: GuardOptions): Promise<GuardedDatabase<D>>;
62
+
63
+ export { DIALECT, GuardedDatabase, guardDatabase };
64
+ export type { GuardOptions, SqliteDatabaseLike };
@@ -0,0 +1,64 @@
1
+ import { Vericto, Verdict } from './index.js';
2
+
3
+ /**
4
+ * Vericto for `better-sqlite3`.
5
+ *
6
+ * better-sqlite3 is synchronous and Vericto is a network call, so the SQL-carrying
7
+ * entry points become async: `await db.prepare(sql)` checks the SQL once and
8
+ * resolves the real `Statement`, whose `run`/`all`/`get`/`iterate` then stay
9
+ * synchronous (the SQL of a prepared statement cannot change). Prepare statements
10
+ * before a `db.raw.transaction(...)` and use them inside it.
11
+ *
12
+ * SQLite has no server, so this wrapper is the enforcement point: SQL run through
13
+ * `db.raw` or another connection to the same file is not checked. The Vericto server
14
+ * evaluates the `sqlite` dialect (vericto-engine 4.1.0+); `guardDatabase` still asks
15
+ * it (`GET /api/v1/meta/config`) and rejects with `VerictoUnsupportedDialectError`,
16
+ * with no SQL run, against a server that does not list `sqlite`.
17
+ */
18
+
19
+ declare const DIALECT = "sqlite";
20
+ /** The part of a better-sqlite3 `Database` this wrapper uses. */
21
+ interface SqliteDatabaseLike {
22
+ prepare(source: string): unknown;
23
+ exec(source: string): unknown;
24
+ }
25
+ type StatementOf<D> = D extends {
26
+ prepare(source: string): infer S;
27
+ } ? S : never;
28
+ type ResultOf<S, K extends string> = S extends Record<K, (...args: never[]) => infer R> ? R : unknown;
29
+ interface GuardOptions {
30
+ /** The guard to use. Default: `new Vericto()` from the `VERICTO_*` environment. */
31
+ vericto?: Vericto;
32
+ }
33
+ declare class GuardedDatabase<D extends SqliteDatabaseLike> {
34
+ /** The underlying database. SQL run through it directly is **not** checked. */
35
+ readonly raw: D;
36
+ readonly vericto: Vericto;
37
+ constructor(db: D, vericto: Vericto);
38
+ /** Check `sql`, then `db.prepare()` the SQL to run (the masked rewrite, if any). */
39
+ prepare(sql: string): Promise<StatementOf<D>>;
40
+ /** Like `prepare`, also resolving the verdict (decision, rule, event id). */
41
+ prepareWithVerdict(sql: string): Promise<{
42
+ statement: StatementOf<D>;
43
+ verdict: Verdict;
44
+ }>;
45
+ /**
46
+ * Check a script, then `db.exec()` it. The script is evaluated as one request (the
47
+ * engine evaluates every statement in it); a block anywhere means nothing runs.
48
+ */
49
+ exec(sql: string): Promise<this>;
50
+ /** `prepare(sql)` then `statement.run(...params)`. */
51
+ run(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'run'>>;
52
+ /** `prepare(sql)` then `statement.all(...params)`. */
53
+ all(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'all'>>;
54
+ /** `prepare(sql)` then `statement.get(...params)`. */
55
+ get(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'get'>>;
56
+ }
57
+ /**
58
+ * Guard a better-sqlite3 `Database`. Rejects with `VerictoUnsupportedDialectError`
59
+ * when the server does not list the `sqlite` dialect.
60
+ */
61
+ declare function guardDatabase<D extends SqliteDatabaseLike>(db: D, options?: GuardOptions): Promise<GuardedDatabase<D>>;
62
+
63
+ export { DIALECT, GuardedDatabase, guardDatabase };
64
+ export type { GuardOptions, SqliteDatabaseLike };
@@ -0,0 +1,58 @@
1
+ import { sqlToExecute, Vericto } from './chunk-I4I35HUY.js';
2
+
3
+ // src/better-sqlite3.ts
4
+ var DIALECT = "sqlite";
5
+ var GuardedDatabase = class {
6
+ /** The underlying database. SQL run through it directly is **not** checked. */
7
+ raw;
8
+ vericto;
9
+ constructor(db, vericto) {
10
+ this.raw = db;
11
+ this.vericto = vericto;
12
+ }
13
+ /** Check `sql`, then `db.prepare()` the SQL to run (the masked rewrite, if any). */
14
+ async prepare(sql) {
15
+ const final = await this.vericto.prepare(sql, DIALECT);
16
+ return this.raw.prepare(final);
17
+ }
18
+ /** Like `prepare`, also resolving the verdict (decision, rule, event id). */
19
+ async prepareWithVerdict(sql) {
20
+ const verdict = await this.vericto.enforce(sql, DIALECT);
21
+ return { statement: this.raw.prepare(sqlToExecute(verdict)), verdict };
22
+ }
23
+ /**
24
+ * Check a script, then `db.exec()` it. The script is evaluated as one request (the
25
+ * engine evaluates every statement in it); a block anywhere means nothing runs.
26
+ */
27
+ async exec(sql) {
28
+ const final = await this.vericto.prepare(sql, DIALECT);
29
+ this.raw.exec(final);
30
+ return this;
31
+ }
32
+ /** `prepare(sql)` then `statement.run(...params)`. */
33
+ async run(sql, ...params) {
34
+ return call(await this.prepare(sql), "run", params);
35
+ }
36
+ /** `prepare(sql)` then `statement.all(...params)`. */
37
+ async all(sql, ...params) {
38
+ return call(await this.prepare(sql), "all", params);
39
+ }
40
+ /** `prepare(sql)` then `statement.get(...params)`. */
41
+ async get(sql, ...params) {
42
+ return call(await this.prepare(sql), "get", params);
43
+ }
44
+ };
45
+ function call(statement, method, params) {
46
+ const fn = statement[method];
47
+ if (typeof fn !== "function") throw new TypeError(`vericto: the prepared statement has no ${method}()`);
48
+ return fn.apply(statement, params);
49
+ }
50
+ async function guardDatabase(db, options = {}) {
51
+ const vericto = options.vericto ?? new Vericto();
52
+ await vericto.requireDialect(DIALECT);
53
+ return new GuardedDatabase(db, vericto);
54
+ }
55
+
56
+ export { DIALECT, GuardedDatabase, guardDatabase };
57
+ //# sourceMappingURL=better-sqlite3.js.map
58
+ //# sourceMappingURL=better-sqlite3.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/better-sqlite3.ts"],"names":[],"mappings":";;;AAkBO,IAAM,OAAA,GAAU;AAgBhB,IAAM,kBAAN,MAAoD;AAAA;AAAA,EAEhD,GAAA;AAAA,EACA,OAAA;AAAA,EAET,WAAA,CAAY,IAAO,OAAA,EAAkB;AACnC,IAAA,IAAA,CAAK,GAAA,GAAM,EAAA;AACX,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA;AAAA,EAGA,MAAM,QAAQ,GAAA,EAAsC;AAClD,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,KAAK,OAAO,CAAA;AACrD,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,KAAK,CAAA;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,mBAAmB,GAAA,EAAuE;AAC9F,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,KAAK,OAAO,CAAA;AACvD,IAAA,OAAO,EAAE,WAAW,IAAA,CAAK,GAAA,CAAI,QAAQ,YAAA,CAAa,OAAO,CAAC,CAAA,EAAqB,OAAA,EAAQ;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAK,GAAA,EAA4B;AACrC,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,KAAK,OAAO,CAAA;AACrD,IAAA,IAAA,CAAK,GAAA,CAAI,KAAK,KAAK,CAAA;AACnB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,GAAA,EAAA,GAAgB,MAAA,EAA6D;AACrF,IAAA,OAAO,KAAK,MAAM,IAAA,CAAK,QAAQ,GAAG,CAAA,EAAG,OAAO,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,GAAA,EAAA,GAAgB,MAAA,EAA6D;AACrF,IAAA,OAAO,KAAK,MAAM,IAAA,CAAK,QAAQ,GAAG,CAAA,EAAG,OAAO,MAAM,CAAA;AAAA,EACpD;AAAA;AAAA,EAGA,MAAM,GAAA,CAAI,GAAA,EAAA,GAAgB,MAAA,EAA6D;AACrF,IAAA,OAAO,KAAK,MAAM,IAAA,CAAK,QAAQ,GAAG,CAAA,EAAG,OAAO,MAAM,CAAA;AAAA,EACpD;AACF;AAEA,SAAS,IAAA,CAAK,SAAA,EAAoB,MAAA,EAAgB,MAAA,EAA4B;AAC5E,EAAA,MAAM,EAAA,GAAM,UAAsC,MAAM,CAAA;AACxD,EAAA,IAAI,OAAO,OAAO,UAAA,EAAY,MAAM,IAAI,SAAA,CAAU,CAAA,uCAAA,EAA0C,MAAM,CAAA,EAAA,CAAI,CAAA;AACtG,EAAA,OAAQ,EAAA,CAAuC,KAAA,CAAM,SAAA,EAAW,MAAM,CAAA;AACxE;AAMA,eAAsB,aAAA,CACpB,EAAA,EACA,OAAA,GAAwB,EAAC,EACI;AAC7B,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,IAAI,OAAA,EAAQ;AAC/C,EAAA,MAAM,OAAA,CAAQ,eAAe,OAAO,CAAA;AACpC,EAAA,OAAO,IAAI,eAAA,CAAgB,EAAA,EAAI,OAAO,CAAA;AACxC","file":"better-sqlite3.js","sourcesContent":["/**\n * Vericto for `better-sqlite3`.\n *\n * better-sqlite3 is synchronous and Vericto is a network call, so the SQL-carrying\n * entry points become async: `await db.prepare(sql)` checks the SQL once and\n * resolves the real `Statement`, whose `run`/`all`/`get`/`iterate` then stay\n * synchronous (the SQL of a prepared statement cannot change). Prepare statements\n * before a `db.raw.transaction(...)` and use them inside it.\n *\n * SQLite has no server, so this wrapper is the enforcement point: SQL run through\n * `db.raw` or another connection to the same file is not checked. The Vericto server\n * evaluates the `sqlite` dialect (vericto-engine 4.1.0+); `guardDatabase` still asks\n * it (`GET /api/v1/meta/config`) and rejects with `VerictoUnsupportedDialectError`,\n * with no SQL run, against a server that does not list `sqlite`.\n */\nimport { Vericto } from './guard.js';\nimport { sqlToExecute, type Verdict } from './verdict.js';\n\nexport const DIALECT = 'sqlite';\n\n/** The part of a better-sqlite3 `Database` this wrapper uses. */\nexport interface SqliteDatabaseLike {\n prepare(source: string): unknown;\n exec(source: string): unknown;\n}\n\ntype StatementOf<D> = D extends { prepare(source: string): infer S } ? S : never;\ntype ResultOf<S, K extends string> = S extends Record<K, (...args: never[]) => infer R> ? R : unknown;\n\nexport interface GuardOptions {\n /** The guard to use. Default: `new Vericto()` from the `VERICTO_*` environment. */\n vericto?: Vericto;\n}\n\nexport class GuardedDatabase<D extends SqliteDatabaseLike> {\n /** The underlying database. SQL run through it directly is **not** checked. */\n readonly raw: D;\n readonly vericto: Vericto;\n\n constructor(db: D, vericto: Vericto) {\n this.raw = db;\n this.vericto = vericto;\n }\n\n /** Check `sql`, then `db.prepare()` the SQL to run (the masked rewrite, if any). */\n async prepare(sql: string): Promise<StatementOf<D>> {\n const final = await this.vericto.prepare(sql, DIALECT);\n return this.raw.prepare(final) as StatementOf<D>;\n }\n\n /** Like `prepare`, also resolving the verdict (decision, rule, event id). */\n async prepareWithVerdict(sql: string): Promise<{ statement: StatementOf<D>; verdict: Verdict }> {\n const verdict = await this.vericto.enforce(sql, DIALECT);\n return { statement: this.raw.prepare(sqlToExecute(verdict)) as StatementOf<D>, verdict };\n }\n\n /**\n * Check a script, then `db.exec()` it. The script is evaluated as one request (the\n * engine evaluates every statement in it); a block anywhere means nothing runs.\n */\n async exec(sql: string): Promise<this> {\n const final = await this.vericto.prepare(sql, DIALECT);\n this.raw.exec(final);\n return this;\n }\n\n /** `prepare(sql)` then `statement.run(...params)`. */\n async run(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'run'>> {\n return call(await this.prepare(sql), 'run', params) as ResultOf<StatementOf<D>, 'run'>;\n }\n\n /** `prepare(sql)` then `statement.all(...params)`. */\n async all(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'all'>> {\n return call(await this.prepare(sql), 'all', params) as ResultOf<StatementOf<D>, 'all'>;\n }\n\n /** `prepare(sql)` then `statement.get(...params)`. */\n async get(sql: string, ...params: unknown[]): Promise<ResultOf<StatementOf<D>, 'get'>> {\n return call(await this.prepare(sql), 'get', params) as ResultOf<StatementOf<D>, 'get'>;\n }\n}\n\nfunction call(statement: unknown, method: string, params: unknown[]): unknown {\n const fn = (statement as Record<string, unknown>)[method];\n if (typeof fn !== 'function') throw new TypeError(`vericto: the prepared statement has no ${method}()`);\n return (fn as (...args: unknown[]) => unknown).apply(statement, params);\n}\n\n/**\n * Guard a better-sqlite3 `Database`. Rejects with `VerictoUnsupportedDialectError`\n * when the server does not list the `sqlite` dialect.\n */\nexport async function guardDatabase<D extends SqliteDatabaseLike>(\n db: D,\n options: GuardOptions = {},\n): Promise<GuardedDatabase<D>> {\n const vericto = options.vericto ?? new Vericto();\n await vericto.requireDialect(DIALECT);\n return new GuardedDatabase(db, vericto);\n}\n"]}