@zincapp/znvault-cli 4.24.2 → 4.24.4

package/dist/commands/mysql/recovery-hpke.js

@@ -0,0 +1,311 @@
+/**
+ * Consumer-side HPKE for Dynamic Secrets Recovery Fence v1.
+ *
+ * The X25519 private key is a process-local CryptoKey. It is never serialized,
+ * written to disk, printed, placed in argv, or copied into the environment.
+ */
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { TextDecoder } from 'node:util';
+import { Chacha20Poly1305 } from '@hpke/chacha20poly1305';
+import { CipherSuite, HkdfSha256 } from '@hpke/core';
+import { DhkemX25519HkdfSha256 } from '@hpke/dhkem-x25519';
+const DELIVERY_FORMAT = 'hpke-v1';
+const SUITE_NAME = 'X25519-HKDF-SHA256-ChaCha20Poly1305';
+const INFO = 'znvault.dynsec.recovery-credential.hpke-v1';
+const AAD_SCHEMA = 'znvault.dynsec.recovery-credential-aad.v1';
+const CREDENTIAL_SCHEMA = 'znvault.dynsec.recovery-credential.v1';
+const SHA256 = /^sha256:[0-9a-f]{64}$/;
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
+const utf8 = new TextDecoder('utf-8', { fatal: true });
+function suite() {
+    return new CipherSuite({
+        kem: new DhkemX25519HkdfSha256(),
+        kdf: new HkdfSha256(),
+        aead: new Chacha20Poly1305(),
+    });
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (isRecord(value)) {
+        const result = {};
+        for (const key of Object.keys(value).sort())
+            result[key] = canonicalize(value[key]);
+        return result;
+    }
+    return value;
+}
+export function canonicalJsonBytes(value) {
+    return Buffer.from(JSON.stringify(canonicalize(value)), 'utf8');
+}
+function sha256KeyId(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function canonicalBase64Url(value, expectedBytes, maxBytes) {
+    if (typeof value !== 'string' || value.length === 0 || !BASE64URL.test(value)) {
+        throw new Error('Recovery HPKE response contains invalid base64url');
+    }
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.toString('base64url') !== value
+        || (expectedBytes !== undefined && decoded.length !== expectedBytes)
+        || (maxBytes !== undefined && decoded.length > maxBytes)) {
+        decoded.fill(0);
+        throw new Error('Recovery HPKE response contains non-canonical base64url');
+    }
+    return decoded;
+}
+function canonicalTimestamp(value) {
+    if (typeof value !== 'string')
+        throw new Error('Recovery HPKE response contains an invalid timestamp');
+    const date = new Date(value);
+    if (!Number.isFinite(date.getTime()) || date.toISOString() !== value) {
+        throw new Error('Recovery HPKE response contains a non-canonical timestamp');
+    }
+    return value;
+}
+function requireIdentifier(value) {
+    if (typeof value !== 'string' || !IDENTIFIER.test(value)) {
+        throw new Error('Recovery HPKE response contains an invalid identifier');
+    }
+    return value;
+}
+function requirePositiveInteger(value) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
+        throw new Error('Recovery HPKE response contains an invalid epoch or revision');
+    }
+    return value;
+}
+function requireDigest(value, prefixed) {
+    if (typeof value !== 'string' || !(prefixed ? SHA256 : SHA256_HEX).test(value)) {
+        throw new Error('Recovery HPKE response contains an invalid SHA-256 identity');
+    }
+    return value;
+}
+function requireOverlay(value) {
+    if (value !== 'NONE' && value !== 'MYSQL_SCHEMA_LOCK_TABLES') {
+        throw new Error('Recovery HPKE response contains an invalid privilege overlay');
+    }
+    return value;
+}
+function parseAad(raw) {
+    if (raw.length === 0 || raw.length > 16_384)
+        throw new Error('Recovery HPKE AAD is too large');
+    let candidate;
+    try {
+        candidate = JSON.parse(utf8.decode(raw));
+    }
+    catch {
+        throw new Error('Recovery HPKE AAD is not valid UTF-8 JSON');
+    }
+    const keys = [
+        'schema', 'version', 'deliveryFormat', 'suite', 'tenantId', 'roleId',
+        'fenceId', 'fenceEpoch', 'permitId', 'requestId', 'leaseId',
+        'consumerApiKeyId', 'roleRevision', 'roleConfigSha256', 'grantPlanSha256',
+        'recipientKeyId', 'credentialExpiresAt', 'privilegeOverlay',
+    ];
+    if (!isRecord(candidate)
+        || !hasExactKeys(candidate, keys)
+        || candidate.schema !== AAD_SCHEMA
+        || candidate.version !== 1
+        || candidate.deliveryFormat !== DELIVERY_FORMAT
+        || candidate.suite !== SUITE_NAME) {
+        throw new Error('Recovery HPKE AAD has an invalid contract shape');
+    }
+    if (!canonicalJsonBytes(candidate).equals(raw)) {
+        throw new Error('Recovery HPKE AAD is not canonical JSON');
+    }
+    return {
+        schema: AAD_SCHEMA,
+        version: 1,
+        deliveryFormat: DELIVERY_FORMAT,
+        suite: SUITE_NAME,
+        tenantId: requireIdentifier(candidate.tenantId),
+        roleId: requireIdentifier(candidate.roleId),
+        fenceId: requireIdentifier(candidate.fenceId),
+        fenceEpoch: requirePositiveInteger(candidate.fenceEpoch),
+        permitId: requireIdentifier(candidate.permitId),
+        requestId: requireIdentifier(candidate.requestId),
+        leaseId: requireIdentifier(candidate.leaseId),
+        consumerApiKeyId: requireIdentifier(candidate.consumerApiKeyId),
+        roleRevision: requirePositiveInteger(candidate.roleRevision),
+        roleConfigSha256: requireDigest(candidate.roleConfigSha256, false),
+        grantPlanSha256: requireDigest(candidate.grantPlanSha256, false),
+        recipientKeyId: requireDigest(candidate.recipientKeyId, true),
+        credentialExpiresAt: canonicalTimestamp(candidate.credentialExpiresAt),
+        privilegeOverlay: requireOverlay(candidate.privilegeOverlay),
+    };
+}
+function assertEnvelope(value) {
+    const candidate = value;
+    if (!isRecord(candidate)
+        || !hasExactKeys(candidate, ['version', 'suite', 'enc', 'ciphertext', 'aadSha256'])
+        || candidate.version !== DELIVERY_FORMAT
+        || candidate.suite !== SUITE_NAME) {
+        throw new Error('Recovery HPKE envelope has an invalid contract shape');
+    }
+    requireDigest(candidate.aadSha256, true);
+}
+function assertBoundAad(aad, operation, recipient) {
+    const exactBindings = [
+        [aad.tenantId, operation.tenantId, 'tenant'],
+        [aad.roleId, operation.roleId, 'role'],
+        [aad.fenceId, operation.fenceId, 'fence'],
+        [aad.permitId, operation.permitId, 'permit'],
+        [aad.requestId, operation.requestId, 'request'],
+        [aad.leaseId, operation.leaseId, 'lease'],
+        [aad.roleConfigSha256, operation.roleConfigSha256, 'role digest'],
+        [aad.grantPlanSha256, operation.grantPlanSha256, 'grant-plan digest'],
+        [aad.recipientKeyId, recipient.recipientKeyId, 'recipient'],
+        [aad.credentialExpiresAt, operation.credentialExpiresAt, 'expiry'],
+        [aad.privilegeOverlay, operation.privilegeOverlay, 'privilege overlay'],
+        [aad.consumerApiKeyId, operation.consumerApiKeyId, 'consumer API key'],
+    ];
+    for (const [actual, expected, name] of exactBindings) {
+        if (actual !== expected)
+            throw new Error(`Recovery HPKE ${name} binding does not match the operation`);
+    }
+    if (aad.fenceEpoch !== operation.fenceEpoch || aad.roleRevision !== operation.roleRevision) {
+        throw new Error('Recovery HPKE epoch or role revision binding does not match the operation');
+    }
+}
+function safeOptionValue(value, field, maxLength) {
+    if (typeof value !== 'string'
+        || value.length === 0
+        || value.length > maxLength
+        || /[\0\r\n]/.test(value)) {
+        throw new Error(`Decrypted recovery credential has an invalid ${field}`);
+    }
+    return value;
+}
+function parseCredential(raw, expectedExpiresAt) {
+    let candidate;
+    try {
+        candidate = JSON.parse(utf8.decode(raw));
+    }
+    catch {
+        throw new Error('Decrypted recovery credential is not valid UTF-8 JSON');
+    }
+    const keys = ['schema', 'version', 'username', 'password', 'host', 'port', 'database', 'expiresAt'];
+    if (!isRecord(candidate)
+        || !hasExactKeys(candidate, keys)
+        || candidate.schema !== CREDENTIAL_SCHEMA
+        || candidate.version !== 1
+        || !canonicalJsonBytes(candidate).equals(raw)
+        || !Number.isSafeInteger(candidate.port)
+        || candidate.port < 1
+        || candidate.port > 65_535) {
+        throw new Error('Decrypted recovery credential has an invalid contract shape');
+    }
+    const expiresAt = canonicalTimestamp(candidate.expiresAt);
+    if (expiresAt !== expectedExpiresAt) {
+        throw new Error('Decrypted recovery credential expiry does not match authenticated metadata');
+    }
+    return {
+        schema: CREDENTIAL_SCHEMA,
+        version: 1,
+        username: safeOptionValue(candidate.username, 'username', 255),
+        password: safeOptionValue(candidate.password, 'password', 4_096),
+        host: safeOptionValue(candidate.host, 'host', 255),
+        port: candidate.port,
+        database: safeOptionValue(candidate.database, 'database', 255),
+        expiresAt,
+    };
+}
+export async function generateEphemeralRecoveryRecipient() {
+    const hpke = suite();
+    // The packages expose the KEM methods at runtime, while their nested type is
+    // intentionally abstract. Narrow the two methods this consumer needs.
+    const kem = hpke.kem;
+    const keyPair = await kem.generateKeyPair();
+    const rawPublicKey = Buffer.from(await kem.serializePublicKey(keyPair.publicKey));
+    try {
+        if (rawPublicKey.length !== 32 || rawPublicKey.every(byte => byte === 0)) {
+            throw new Error('Failed to generate a valid ephemeral X25519 recipient');
+        }
+        return Object.freeze({
+            recipientPublicKey: rawPublicKey.toString('base64url'),
+            recipientKeyId: sha256KeyId(rawPublicKey),
+            privateKey: keyPair.privateKey,
+        });
+    }
+    finally {
+        rawPublicKey.fill(0);
+    }
+}
+export async function openRecoveryCredential(input) {
+    const { delivery, operation, recipient } = input;
+    const wireDelivery = delivery;
+    if (!isRecord(wireDelivery)
+        || wireDelivery.deliveryFormat !== DELIVERY_FORMAT
+        || wireDelivery.permitId !== operation.permitId
+        || wireDelivery.requestId !== operation.requestId
+        || (wireDelivery.state !== 'CONSUMED' && wireDelivery.state !== 'DELIVERED')) {
+        throw new Error('Recovery credential delivery does not match the requested operation');
+    }
+    assertEnvelope(delivery.envelope);
+    const aad = canonicalBase64Url(delivery.aad, undefined, 16_384);
+    const enc = canonicalBase64Url(delivery.envelope.enc, 32);
+    const ciphertext = canonicalBase64Url(delivery.envelope.ciphertext, undefined, 16_384);
+    let plaintext;
+    try {
+        if (ciphertext.length <= 16)
+            throw new Error('Recovery HPKE ciphertext is too short');
+        const expectedAadDigest = Buffer.from(delivery.envelope.aadSha256.slice('sha256:'.length), 'hex');
+        const actualAadDigest = createHash('sha256').update(aad).digest();
+        try {
+            if (!timingSafeEqual(expectedAadDigest, actualAadDigest)) {
+                throw new Error('Recovery HPKE envelope does not authenticate the supplied AAD');
+            }
+        }
+        finally {
+            expectedAadDigest.fill(0);
+            actualAadDigest.fill(0);
+        }
+        const providedEnvelopeSha256 = requireDigest(delivery.envelopeSha256, true);
+        const expectedEnvelopeDigest = Buffer.from(providedEnvelopeSha256.slice('sha256:'.length), 'hex');
+        const actualEnvelopeDigest = createHash('sha256')
+            .update(canonicalJsonBytes(delivery.envelope))
+            .digest();
+        try {
+            if (!timingSafeEqual(expectedEnvelopeDigest, actualEnvelopeDigest)) {
+                throw new Error('Recovery HPKE envelope digest does not match the persisted envelope');
+            }
+        }
+        finally {
+            expectedEnvelopeDigest.fill(0);
+            actualEnvelopeDigest.fill(0);
+        }
+        const parsedAad = parseAad(aad);
+        assertBoundAad(parsedAad, operation, recipient);
+        let opened;
+        try {
+            opened = await suite().open({
+                recipientKey: recipient.privateKey,
+                enc,
+                info: Buffer.from(INFO, 'utf8'),
+            }, ciphertext, aad);
+        }
+        catch {
+            throw new Error('Recovery HPKE credential authentication failed');
+        }
+        plaintext = Buffer.from(opened);
+        return parseCredential(plaintext, parsedAad.credentialExpiresAt);
+    }
+    finally {
+        aad.fill(0);
+        enc.fill(0);
+        ciphertext.fill(0);
+        plaintext?.fill(0);
+    }
+}
+//# sourceMappingURL=recovery-hpke.js.map

package/dist/commands/mysql/recovery-hpke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-hpke.js","sourceRoot":"","sources":["../../../src/commands/mysql/recovery-hpke.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,UAAU,EAAE,eAAe,EAAC,MAAM,aAAa,CAAC;AACxD,OAAO,EAAC,WAAW,EAAC,MAAM,WAAW,CAAC;AACtC,OAAO,EAAC,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAC,WAAW,EAAE,UAAU,EAAC,MAAM,YAAY,CAAC;AACnD,OAAO,EAAC,qBAAqB,EAAC,MAAM,oBAAoB,CAAC;AAQzD,MAAM,eAAe,GAAG,SAAkB,CAAC;AAC3C,MAAM,UAAU,GAAG,qCAA8C,CAAC;AAClE,MAAM,IAAI,GAAG,4CAA4C,CAAC;AAC1D,MAAM,UAAU,GAAG,2CAA2C,CAAC;AAC/D,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAClE,MAAM,MAAM,GAAG,uBAAuB,CAAC;AACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,UAAU,GAAG,qCAAqC,CAAC;AACzD,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAC,KAAK,EAAE,IAAI,EAAC,CAAC,CAAC;AAkDrD,SAAS,KAAK;IACZ,OAAO,IAAI,WAAW,CAAC;QACrB,GAAG,EAAE,IAAI,qBAAqB,EAAE;QAChC,GAAG,EAAE,IAAI,UAAU,EAAE;QACrB,IAAI,EAAE,IAAI,gBAAgB,EAAE;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,QAA2B;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB;IACpC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,aAAsB,EAAE,QAAiB;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IACE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;WACpC,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC;WACjE,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,EACxD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,QAAiB;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,0BAA0B,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/F,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAY,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ;QACpE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS;QAC3D,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,iBAAiB;QACzE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB;KACnD,CAAC;IACX,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;WACjB,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;WAC9B,SAAS,CAAC,MAAM,KAAK,UAAU;WAC/B,SAAS,CAAC,OAAO,KAAK,CAAC;WACvB,SAAS,CAAC,cAAc,KAAK,eAAe;WAC5C,SAAS,CAAC,KAAK,KAAK,UAAU,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,eAAe;QAC/B,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC/C,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC;QAC3C,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7C,UAAU,EAAE,sBAAsB,CAAC,SAAS,CAAC,UAAU,CAAC;QACxD,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC;QAC/C,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC;QACjD,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,iBAAiB,CAAC,SAAS,CAAC,gBAAgB,CAAC;QAC/D,YAAY,EAAE,sBAAsB,CAAC,SAAS,CAAC,YAAY,CAAC;QAC5D,gBAAgB,EAAE,aAAa,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC;QAClE,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC;QAChE,cAAc,EAAE,aAAa,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC;QAC7D,mBAAmB,EAAE,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,CAAC;QACtE,gBAAgB,EAAE,cAAc,CAAC,SAAS,CAAC,gBAAgB,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAA2B;IACjD,MAAM,SAAS,GAAY,KAAK,CAAC;IACjC,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;WACjB,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;WAChF,SAAS,CAAC,OAAO,KAAK,eAAe;WACrC,SAAS,CAAC,KAAK,KAAK,UAAU,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CACrB,GAAoB,EACpB,SAAwB,EACxB,SAAqC;IAErC,MAAM,aAAa,GAAG;QACpB,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5C,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;QACtC,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;QACzC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC5C,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;QAC/C,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;QACzC,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACjE,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC;QACrE,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC;QAC3D,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE,QAAQ,CAAC;QAClE,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;QACvE,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;KAC9D,CAAC;IACX,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,aAAa,EAAE,CAAC;QACrD,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,uCAAuC,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa,EAAE,SAAiB;IACvE,IACE,OAAO,KAAK,KAAK,QAAQ;WACtB,KAAK,CAAC,MAAM,KAAK,CAAC;WAClB,KAAK,CAAC,MAAM,GAAG,SAAS;WACxB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,iBAAyB;IAC7D,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAY,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;IAC7G,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;WACjB,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;WAC9B,SAAS,CAAC,MAAM,KAAK,iBAAiB;WACtC,SAAS,CAAC,OAAO,KAAK,CAAC;WACvB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;WAC1C,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC;WACpC,SAAS,CAAC,IAAe,GAAG,CAAC;WAC7B,SAAS,CAAC,IAAe,GAAG,MAAM,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC;QAC9D,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC;QAChE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC;QAClD,IAAI,EAAE,SAAS,CAAC,IAAc;QAC9B,QAAQ,EAAE,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC;QAC9D,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC;IACtD,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;IACrB,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAA6B,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,eAAe,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,IAAI,YAAY,CAAC,MAAM,KAAK,EAAE,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,cAAc,EAAE,WAAW,CAAC,YAAY,CAAC;YACzC,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAI5C;IACC,MAAM,EAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAC,GAAG,KAAK,CAAC;IAC/C,MAAM,YAAY,GAAY,QAAQ,CAAC;IACvC,IACE,CAAC,QAAQ,CAAC,YAAY,CAAC;WACpB,YAAY,CAAC,cAAc,KAAK,eAAe;WAC/C,YAAY,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ;WAC5C,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;WAC9C,CAAC,YAAY,CAAC,KAAK,KAAK,UAAU,IAAI,YAAY,CAAC,KAAK,KAAK,WAAW,CAAC,EAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAElC,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvF,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACtF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAClG,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,sBAAsB,GAAG,aAAa,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAClG,MAAM,oBAAoB,GAAG,UAAU,CAAC,QAAQ,CAAC;aAC9C,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;aAC7C,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/B,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChC,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,IAAI,CACzB;gBACE,YAAY,EAAE,SAAS,CAAC,UAAU;gBAClC,GAAG;gBACH,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;aAChC,EACD,UAAU,EACV,GAAG,CACJ,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/commands/mysql/run.d.ts

@@ -9,18 +9,16 @@
  */
 export declare function assertMysqlOnPath(): string;
 /**
- * Reject any passthrough token that is (or starts with `=`-form of) a forbidden
- * connection/credential/defaults override flag.
+ * Accept only the fixed allowlist of argument-free presentation flags.
+ * Forbidden-option recognition below exists for actionable diagnostics; the
+ * final generic rejection is the security boundary for unknown future flags.
  *
  * Recognised forms for a forbidden flag `--host`:
  *   - exact:   `--host`        (its value is the next token)
  *   - inline:  `--host=value`
  *   - short:   `-h`            (value is next token)  / `-P`, `-p`
  *
- * Tokens that merely START with a forbidden name but are a different flag
- * (e.g. `--hostgroup`, `--port-something`) are NOT rejected.
- *
- * @throws Error naming the offending flag and citing F2, on the first match.
+ * @throws Error naming the first non-allowlisted token.
  */
 export declare function assertPassthroughAllowed(passthrough: readonly string[]): void;
 /**
@@ -30,15 +28,47 @@ export declare function assertPassthroughAllowed(passthrough: readonly string[])
  */
 export interface BuildMysqlInvocationOpts {
     /**
-     * Value for `--defaults-extra-file`. This is the `/dev/fd/<fd>` path returned
+     * Value for `--defaults-file`. This is the `/dev/fd/<fd>` path returned
      * by createMyCnf (B2) — mysql re-opens the inherited fd through it.
      */
     fdPath: string;
     /** Optional default schema to select (positional arg — spec F8). */
     database?: string;
-    /** Extra arguments appended verbatim to the mysql argv. */
+    /** Allowlisted, argument-free mysql presentation flags. */
     passthrough?: string[];
+    /**
+     * Capability discovered from the selected client. Oracle MySQL needs
+     * --no-login-paths; MariaDB has no login-path feature and rejects the flag.
+     */
+    supportsNoLoginPaths?: boolean;
+    /** Force non-interactive client-command isolation for piped SQL. */
+    binaryMode?: boolean;
 }
+/**
+ * Validate the optional positional schema before it reaches mysql argv.
+ *
+ * MySQL identifiers can be broader when quoted inside SQL, but the CLI schema
+ * selector is deliberately a conservative ASCII contract. This prevents a
+ * value beginning with `-` from being interpreted as a client option and keeps
+ * control characters or shell-like path material out of process arguments.
+ */
+export declare function assertSafeMysqlDatabase(database: string | undefined): void;
+export interface MysqlClientCapabilities {
+    binary: string;
+    family: 'mysql' | 'mariadb';
+    supportsNoLoginPaths: boolean;
+    supportsBinaryMode: boolean;
+}
+export declare function assertMysqlExecCapabilities(capabilities: MysqlClientCapabilities): void;
+/**
+ * Probe option-file isolation before a lease/permit is consumed.
+ *
+ * Oracle MySQL clients expose --no-login-paths and require it to exclude
+ * .mylogin.cnf. MariaDB clients do not implement login paths and reject that
+ * flag, so their exclusive --defaults-file is sufficient. Unknown clients
+ * without the Oracle flag fail closed.
+ */
+export declare function inspectMysqlClient(binary?: string): MysqlClientCapabilities;
 /**
  * Build the mysql argv and child environment.
  *
@@ -47,14 +77,17 @@ export interface BuildMysqlInvocationOpts {
  * without spawning real mysql.
  *
  * Security invariants:
- *   - `--defaults-extra-file=<fdPath>` is args[0].
+ *   - `--defaults-file=<fdPath>` is args[0]. Oracle MySQL then receives
+ *     `--no-login-paths`; MariaDB omits the unsupported flag after probing.
+ *   - Exec invocations force `--binary-mode` before the positional schema.
  *   - No --user / -u / --password / -p / MYSQL_PWD in args or env.
  *   - No --host / --port / -h / -P flags (connection coords from cnf).
- *   - Forbidden override flags in `passthrough` are rejected (spec F2).
+ *   - Only fixed, argument-free passthrough flags are accepted (spec F2).
+ *   - The child environment is a non-secret allowlist; Vault credentials and
+ *     ambient MySQL selectors are never inherited.
  *   - MYSQL_HISTFILE=/dev/null overrides any pre-existing value.
  *
- * @throws If `passthrough` contains a forbidden connection/credential/defaults
- *         override flag (see assertPassthroughAllowed).
+ * @throws If `passthrough` contains a token outside the fixed safe allowlist.
  */
 export declare function buildMysqlInvocation(opts: BuildMysqlInvocationOpts): {
     args: string[];
@@ -68,7 +101,7 @@ type StdioEntry = 'pipe' | 'inherit' | 'ignore' | number;
 /**
  * Build the `stdio` array for spawning mysql so that the cnf fd is inherited by
  * the child at the SAME numeric index `fd`. This is what makes
- * `--defaults-extra-file=/dev/fd/<fd>` resolve correctly in the child: the
+ * `--defaults-file=/dev/fd/<fd>` resolve correctly in the child: the
  * child must have an fd open at exactly `fd`.
  *
  * Layout:
@@ -96,7 +129,7 @@ export declare function buildChildStdio(fd: number, stdin0: 'pipe' | 'inherit'):
 export interface RunMysqlOpts {
     /**
      * The `/dev/fd/<fd>` path returned by createMyCnf — passed to mysql as
-     * --defaults-extra-file. This module never re-opens it; mysql reads the
+     * --defaults-file. This module never re-opens it; mysql reads the
      * inherited fd through it.
      */
     fdPath: string;
@@ -120,6 +153,12 @@ export interface RunMysqlOpts {
      * Precedence: files → sql → parent stdin (spec F-input).
      */
     sql?: string;
+    /**
+     * (exec mode) Exact already-validated bytes to feed as stdin. Recovery
+     * permits use this so the file is validated before the one-shot consume and
+     * cannot change between validation and mysql execution.
+     */
+    input?: Buffer;
     /** Extra arguments appended verbatim to the mysql argv. */
     passthrough?: string[];
 }
@@ -128,16 +167,17 @@ export interface RunMysqlOpts {
  *
  * - Resolves with the child's numeric exit code (caller/CI relies on non-zero).
  * - The cnf fd (`opts.fd`) is inherited by the child at the SAME number so
- *   `--defaults-extra-file=/dev/fd/<fd>` resolves in the child (spec F1). The
+ *   `--defaults-file=/dev/fd/<fd>` resolves in the child (spec F1). The
  *   directory entry was already unlinked in createMyCnf — there is NOTHING to
  *   unlink here, and NO post-spawn unlink race.
  * - 'connect' mode: stdin/stdout/stderr are inherited (interactive terminal);
  *   the cnf fd is additionally inherited at index `fd`.
  * - 'exec' mode: stdin (index 0) is wired as:
- *     1. files (concatenated, in order) → stdin pipe
- *     2. sql (string) → stdin pipe
- *     3. parent stdin (if not a TTY) → piped through (inherit)
- *     4. parent stdin is a TTY and neither files nor sql provided → Error
+ *     1. input (exact Buffer) → stdin pipe
+ *     2. files (concatenated, in order) → stdin pipe
+ *     3. sql (string) → stdin pipe
+ *     4. parent stdin (if not a TTY) → piped through (inherit)
+ *     5. parent stdin is a TTY and no source was provided → Error
  *   stdout/stderr are inherited; the cnf fd is inherited at index `fd`.
  *
  * The parent's own copy of `opts.fd` is intentionally NOT closed here — the

package/dist/commands/mysql/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/run.ts"],"names":[],"mappings":"AAwCA;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAsB1C;AAoCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAa7E;AAMD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACpE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,CA+BA;AAMD;;;GAGG;AACH,KAAK,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,EAAE,CAoBpF;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAuElE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/run.ts"],"names":[],"mappings":"AAmDA;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAsB1C;AA4PD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAgD7E;AAMD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oEAAoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAQ1E;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,uBAAuB,GACpC,IAAI,CAMN;AAiCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,SAAsB,GAAG,uBAAuB,CAiCxF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACpE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,CAuCA;AAMD;;;GAGG;AACH,KAAK,UAAU,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,EAAE,CAoBpF;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CA8FlE"}