admindb 2.2.1 → 2.3.1

package/dist/app.js

@@ -68,27 +68,35 @@ function addErrorHandlers(app, logger) {
 }
 function createSingleDbApp(options) {
     const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
-    const rawTarget = options.connection || options.dbPath || '';
+    const envTarget = process.env.ADMINDB_CONNECTION ||
+        process.env.DATABASE_URL ||
+        process.env.POSTGRES_URL ||
+        process.env.PG_CONNECTION ||
+        '';
+    const rawTarget = options.connection || options.dbPath || ((0, common_1.isPostgresConnectionString)(envTarget) ? envTarget : '');
     const isPg = Boolean(options.pgOptions) ||
         (0, common_1.isPostgresConnectionString)(rawTarget) ||
         options.db?.dialect === 'postgres';
     const readonly = options.readonly !== undefined
         ? Boolean(options.readonly)
-        : (isServerless && !isPg);
+        : (isServerless ? !isPg : false);
     const basePath = (options.basePath ?? '').replace(/\/+$/, '');
     const logger = options.logger ?? (0, logger_1.createLogger)(options.logLevel ?? 'info', 'admindb');
     let db;
     if (options.db) {
         db = options.db;
+        if (options.readonly !== undefined && db.isReadOnly !== Boolean(options.readonly)) {
+            try {
+                Object.defineProperty(db, 'isReadOnly', { value: Boolean(options.readonly), configurable: true });
+            }
+            catch { }
+        }
+    }
+    else if (isPg) {
+        db = new postgres_1.PostgresDatabase(options.pgOptions || rawTarget, logger, { readonly });
     }
     else {
-        if (isPg) {
-            const conn = options.pgOptions || rawTarget;
-            db = new postgres_1.PostgresDatabase(conn, logger, { readonly });
-        }
-        else {
-            db = new database_1.SqliteDatabase(options.dbPath ?? 'admindb.db', logger, { readonly });
-        }
+        db = new database_1.SqliteDatabase(options.dbPath ?? 'admindb.db', logger, { readonly });
     }
     const databasesUrl = options.databasesUrl;
     const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
@@ -138,8 +146,9 @@ function createSingleDbApp(options) {
 }
 function createManagerApp(options) {
     const isServerless = options.serverless !== undefined ? options.serverless : (0, serverless_1.isServerlessEnvironment)();
-    const readonly = isServerless || Boolean(options.readonly);
+    const explicitReadonly = options.readonly !== undefined ? Boolean(options.readonly) : undefined;
     const manager = options.manager;
+    const globalReadonly = explicitReadonly ?? manager.isReadOnly;
     const basePath = (options.basePath ?? '').replace(/\/+$/, '');
     const logger = options.logger ?? (0, logger_1.createLogger)(options.logLevel ?? 'info', 'admindb');
     const authConfig = (0, auth_1.resolveAuthConfig)(options.auth);
@@ -160,7 +169,7 @@ function createManagerApp(options) {
             res.locals.dbId = null;
             res.locals.databasesUrl = null;
             res.locals.databasesMode = true;
-            res.locals.readonly = readonly;
+            res.locals.readonly = globalReadonly;
             res.locals.serverless = isServerless;
             res.locals.version = APP_VERSION;
             res.locals.authEnabled = authConfig.enabled;
@@ -181,7 +190,7 @@ function createManagerApp(options) {
         manager,
         logger,
         basePath,
-        readonly,
+        readonly: globalReadonly,
         allowBrowse: isServerless ? false : options.allowBrowse,
         browseRoot: options.browseRoot,
         invalidate: (id) => subApps.delete(id),
@@ -201,22 +210,22 @@ function createManagerApp(options) {
         const rawRo = req.query.readonly;
         if (rawRo !== undefined) {
             const explicitRo = rawRo === '1' || rawRo === 'true';
-            if (!readonly || explicitRo) {
+            if (!globalReadonly || explicitRo) {
                 manager.setReadonly(dbId, explicitRo);
                 subApps.delete(dbId);
             }
         }
         let sub = subApps.get(dbId);
         if (!sub) {
-            const subBase = `${basePath ? basePath : ''}/${encodeURIComponent(dbId)}`;
-            const effectiveRo = readonly || manager.isDbReadOnly(dbId);
+            const subBase = `${basePath || ''}/${encodeURIComponent(dbId)}`;
+            const effectiveRo = globalReadonly ? true : manager.isDbReadOnly(dbId);
             sub = createSingleDbApp({
                 db: manager.open(dbId, effectiveRo),
                 basePath: subBase,
                 logger,
                 logLevel: options.logLevel,
                 dbId,
-                databasesUrl: `${basePath ? basePath : ''}/`,
+                databasesUrl: `${basePath || ''}/`,
                 readonly: effectiveRo,
                 serverless: isServerless,
                 auth: authConfig,

package/dist/auth/config.d.ts

@@ -1 +1 @@
-import{type AuthConfig,type ResolvedAuthConfig} from './types';export declare function resetPersistentSecretCache():void;export declare function getOrCreatePersistentSecret(env?:NodeJS.ProcessEnv):string;export declare function resolveAuthConfig(optionsAuth?:boolean|AuthConfig,env?:NodeJS.ProcessEnv):ResolvedAuthConfig;
+import{type AuthConfig,type ResolvedAuthConfig} from './types';export declare const resetPersistentSecretCache:()=>void;export declare function getOrCreatePersistentSecret(env?:NodeJS.ProcessEnv):string;export declare function resolveAuthConfig(optionsAuth?:boolean|AuthConfig,env?:NodeJS.ProcessEnv):ResolvedAuthConfig;

package/dist/auth/config.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetPersistentSecretCache = resetPersistentSecretCache;
+exports.resetPersistentSecretCache = void 0;
 exports.getOrCreatePersistentSecret = getOrCreatePersistentSecret;
 exports.resolveAuthConfig = resolveAuthConfig;
 const node_crypto_1 = require("node:crypto");
@@ -12,18 +12,18 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const types_1 = require("./types");
 let cachedFallbackSecret = null;
-function resetPersistentSecretCache() {
+const resetPersistentSecretCache = () => {
     cachedFallbackSecret = null;
-}
+};
+exports.resetPersistentSecretCache = resetPersistentSecretCache;
 function getOrCreatePersistentSecret(env = process.env) {
     const envSecret = env.ADMINDB_SECRET ?? env.SESSION_SECRET;
     if (envSecret && String(envSecret).trim()) {
         return String(envSecret).trim();
     }
     const customSecretFile = env.ADMINDB_SECRET_FILE ? String(env.ADMINDB_SECRET_FILE).trim() : undefined;
-    if (!customSecretFile && cachedFallbackSecret) {
+    if (!customSecretFile && cachedFallbackSecret)
         return cachedFallbackSecret;
-    }
     const candidatePaths = [];
     if (customSecretFile) {
         candidatePaths.push(node_path_1.default.resolve(customSecretFile));
@@ -31,66 +31,54 @@ function getOrCreatePersistentSecret(env = process.env) {
     else {
         try {
             const home = node_os_1.default.homedir();
-            if (home) {
+            if (home)
                 candidatePaths.push(node_path_1.default.join(home, '.admindb-secret'));
-            }
-        }
-        catch {
         }
+        catch { }
         try {
             const tmp = node_os_1.default.tmpdir();
-            if (tmp) {
+            if (tmp)
                 candidatePaths.push(node_path_1.default.join(tmp, '.admindb-secret'));
-            }
-        }
-        catch {
         }
+        catch { }
     }
     for (const filePath of candidatePaths) {
         try {
             if ((0, node_fs_1.existsSync)(filePath)) {
                 const content = (0, node_fs_1.readFileSync)(filePath, 'utf8').trim();
                 if (content.length >= 16) {
-                    if (!customSecretFile) {
+                    if (!customSecretFile)
                         cachedFallbackSecret = content;
-                    }
                     return content;
                 }
             }
         }
-        catch {
-        }
+        catch { }
     }
     const newSecret = (0, node_crypto_1.randomBytes)(32).toString('hex');
     for (const filePath of candidatePaths) {
         try {
             const dir = node_path_1.default.dirname(filePath);
-            if (!(0, node_fs_1.existsSync)(dir)) {
+            if (!(0, node_fs_1.existsSync)(dir))
                 (0, node_fs_1.mkdirSync)(dir, { recursive: true });
-            }
             (0, node_fs_1.writeFileSync)(filePath, newSecret, { encoding: 'utf8', mode: 0o600 });
-            if (!customSecretFile) {
+            if (!customSecretFile)
                 cachedFallbackSecret = newSecret;
-            }
             return newSecret;
         }
-        catch {
-        }
+        catch { }
     }
-    if (!customSecretFile) {
+    if (!customSecretFile)
         cachedFallbackSecret = newSecret;
-    }
     return newSecret;
 }
 function resolveAuthConfig(optionsAuth, env = process.env) {
     const envDisabled = ['0', 'false', 'no', 'off'].includes(String(env.ADMINDB_AUTH ?? '').trim().toLowerCase()) ||
         ['1', 'true', 'yes'].includes(String(env.ADMINDB_NO_AUTH ?? env.ADMINDB_DISABLE_AUTH ?? '').trim().toLowerCase());
     let enabled = true;
-    let username = (env.ADMINDB_USERNAME ?? env.ADMINDB_USER) ? String(env.ADMINDB_USERNAME ?? env.ADMINDB_USER).trim() : types_1.DEFAULT_USERNAME;
-    let password = (env.ADMINDB_PASSWORD ?? env.ADMINDB_PASS) ? String(env.ADMINDB_PASSWORD ?? env.ADMINDB_PASS).trim() : types_1.DEFAULT_PASSWORD_HASH;
-    let secret = (env.ADMINDB_SECRET ?? env.SESSION_SECRET)
-        ? String(env.ADMINDB_SECRET ?? env.SESSION_SECRET).trim()
-        : getOrCreatePersistentSecret(env);
+    let username = String(env.ADMINDB_USERNAME ?? env.ADMINDB_USER ?? types_1.DEFAULT_USERNAME).trim();
+    let password = String(env.ADMINDB_PASSWORD ?? env.ADMINDB_PASS ?? types_1.DEFAULT_PASSWORD_HASH).trim();
+    let secret = String(env.ADMINDB_SECRET ?? env.SESSION_SECRET ?? '').trim() || getOrCreatePersistentSecret(env);
     let sessionDurationMs = types_1.DEFAULT_SESSION_DURATION_MS;
     if (optionsAuth === false || envDisabled) {
         enabled = false;

package/dist/auth/crypto.js

@@ -28,17 +28,14 @@ function constantTimeCompare(a, b) {
     }
 }
 function verifyPassword(candidatePassword, storedPasswordOrHash) {
-    if (typeof candidatePassword !== 'string' || typeof storedPasswordOrHash !== 'string') {
+    if (typeof candidatePassword !== 'string' || typeof storedPasswordOrHash !== 'string')
         return false;
-    }
     if (storedPasswordOrHash.startsWith('scrypt:')) {
         const parts = storedPasswordOrHash.split(':');
         if (parts.length === 3 && parts[1] && parts[2]) {
-            const salt = parts[1];
-            const expectedKeyHex = parts[2];
             try {
-                const derivedKey = (0, node_crypto_1.scryptSync)(candidatePassword, salt, 64).toString('hex');
-                return constantTimeCompare(derivedKey, expectedKeyHex);
+                const derivedKey = (0, node_crypto_1.scryptSync)(candidatePassword, parts[1], 64).toString('hex');
+                return constantTimeCompare(derivedKey, parts[2]);
             }
             catch {
                 return false;
@@ -57,9 +54,8 @@ function parseCookies(cookieHeader) {
             continue;
         const key = pair.slice(0, idx).trim();
         let val = pair.slice(idx + 1).trim();
-        if (val.startsWith('"') && val.endsWith('"') && val.length >= 2) {
+        if (val.startsWith('"') && val.endsWith('"') && val.length >= 2)
             val = val.slice(1, -1);
-        }
         if (key) {
             try {
                 cookies[key] = decodeURIComponent(val);
@@ -72,9 +68,7 @@ function parseCookies(cookieHeader) {
     return cookies;
 }
 function createSessionToken(username, secret, durationMs = types_1.DEFAULT_SESSION_DURATION_MS) {
-    const expiresAt = Date.now() + durationMs;
-    const userPayload = Buffer.from(username, 'utf8').toString('base64url');
-    const data = `${userPayload}.${expiresAt}`;
+    const data = `${Buffer.from(username, 'utf8').toString('base64url')}.${Date.now() + durationMs}`;
     const signature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
     return `${data}.${signature}`;
 }
@@ -87,22 +81,18 @@ function verifySessionToken(token, secret, expectedUser) {
     const [userPayload, expiresStr, providedSignature] = parts;
     const data = `${userPayload}.${expiresStr}`;
     const expectedSignature = (0, node_crypto_1.createHmac)('sha256', secret).update(data).digest('base64url');
-    if (!constantTimeCompare(providedSignature, expectedSignature)) {
+    if (!constantTimeCompare(providedSignature, expectedSignature))
         return null;
-    }
     const expiresAt = Number.parseInt(expiresStr, 10);
-    if (!Number.isFinite(expiresAt) || Date.now() > expiresAt) {
+    if (!Number.isFinite(expiresAt) || Date.now() > expiresAt)
         return null;
-    }
-    let username;
     try {
-        username = Buffer.from(userPayload, 'base64url').toString('utf8');
+        const username = Buffer.from(userPayload, 'base64url').toString('utf8');
+        if (expectedUser && !constantTimeCompare(username, expectedUser))
+            return null;
+        return username;
     }
     catch {
         return null;
     }
-    if (expectedUser && !constantTimeCompare(username, expectedUser)) {
-        return null;
-    }
-    return username;
 }

package/dist/auth/middleware.js

@@ -5,14 +5,14 @@ exports.createAuthMiddleware = createAuthMiddleware;
 const types_1 = require("./types");
 const crypto_1 = require("./crypto");
 function authenticateRequest(req, config) {
-    if (!config.enabled) {
+    if (!config.enabled)
         return { authenticated: true, user: 'anonymous' };
-    }
     const authHeader = req.headers.authorization;
     if (authHeader) {
         const [scheme, credentials] = authHeader.split(/\s+/, 2);
         if (scheme && credentials) {
-            if (scheme.toLowerCase() === 'basic') {
+            const lowerScheme = scheme.toLowerCase();
+            if (lowerScheme === 'basic') {
                 try {
                     const decoded = Buffer.from(credentials, 'base64').toString('utf8');
                     const colonIdx = decoded.indexOf(':');
@@ -27,24 +27,21 @@ function authenticateRequest(req, config) {
                 catch {
                 }
             }
-            else if (scheme.toLowerCase() === 'bearer') {
+            else if (lowerScheme === 'bearer') {
                 const user = (0, crypto_1.verifySessionToken)(credentials, config.secret, config.username);
-                if (user) {
+                if (user)
                     return { authenticated: true, user };
-                }
                 if ((0, crypto_1.verifyPassword)(credentials, config.password)) {
                     return { authenticated: true, user: config.username };
                 }
             }
         }
     }
-    const cookies = (0, crypto_1.parseCookies)(req.headers.cookie);
-    const sessionCookie = cookies[types_1.SESSION_COOKIE_NAME];
+    const sessionCookie = (0, crypto_1.parseCookies)(req.headers.cookie)[types_1.SESSION_COOKIE_NAME];
     if (sessionCookie) {
         const user = (0, crypto_1.verifySessionToken)(sessionCookie, config.secret, config.username);
-        if (user) {
+        if (user)
             return { authenticated: true, user };
-        }
     }
     return { authenticated: false };
 }
@@ -57,11 +54,7 @@ function createAuthMiddleware(config, basePath, _logger) {
             return next();
         }
         const p = req.path;
-        if (p.startsWith('/css/') ||
-            p.startsWith('/js/') ||
-            p === '/favicon.ico' ||
-            p === '/login' ||
-            p === '/logout') {
+        if (p.startsWith('/css/') || p.startsWith('/js/') || p === '/favicon.ico' || p === '/login' || p === '/logout') {
             return next();
         }
         const auth = authenticateRequest(req, config);
@@ -70,7 +63,7 @@ function createAuthMiddleware(config, basePath, _logger) {
             req.user = auth.user;
             return next();
         }
-        if (p.startsWith('/api/') || req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
+        if (p.startsWith('/api/') || req.xhr || req.headers.accept?.includes('application/json')) {
             res.setHeader('WWW-Authenticate', 'Basic realm="AdminDB", Bearer');
             res.status(401).json({
                 success: false,

package/dist/auth/routes.js

@@ -6,15 +6,13 @@ const middleware_1 = require("./middleware");
 const crypto_1 = require("./crypto");
 function registerAuthRoutes(router, config, basePath, logger) {
     router.get('/login', (req, res) => {
-        if (!config.enabled) {
+        if (!config.enabled)
             return res.redirect(`${basePath}/`);
-        }
         const auth = (0, middleware_1.authenticateRequest)(req, config);
+        const nextUrl = String(req.query.next ?? '').trim();
         if (auth.authenticated) {
-            const nextUrl = String(req.query.next ?? '').trim();
             return res.redirect(nextUrl.startsWith('/') ? nextUrl : `${basePath}/`);
         }
-        const nextUrl = String(req.query.next ?? '').trim();
         res.render('pages/login', {
             title: 'Sign in',
             noSidebar: true,
@@ -24,17 +22,15 @@ function registerAuthRoutes(router, config, basePath, logger) {
         });
     });
     router.post('/login', (req, res) => {
-        if (!config.enabled) {
+        if (!config.enabled)
             return res.redirect(`${basePath}/`);
-        }
         const username = String(req.body?.username ?? '').trim();
         const password = String(req.body?.password ?? '').trim();
         const nextUrl = String(req.body?.next ?? req.query.next ?? '').trim();
-        const isValid = (0, crypto_1.constantTimeCompare)(username, config.username) &&
-            (0, crypto_1.verifyPassword)(password, config.password);
+        const isValid = (0, crypto_1.constantTimeCompare)(username, config.username) && (0, crypto_1.verifyPassword)(password, config.password);
         if (!isValid) {
             logger.warn(`Failed login attempt for user "${username || '<empty>'}"`);
-            if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
+            if (req.xhr || req.headers.accept?.includes('application/json')) {
                 return res.status(401).json({ success: false, error: 'Invalid username or password.' });
             }
             return res.status(401).render('pages/login', {
@@ -51,16 +47,14 @@ function registerAuthRoutes(router, config, basePath, logger) {
         const expiresUtc = new Date(Date.now() + config.sessionDurationMs).toUTCString();
         const cookiePath = basePath || '/';
         res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=${encodeURIComponent(token)}; Path=${cookiePath}; Max-Age=${maxAgeSec}; Expires=${expiresUtc}; HttpOnly; SameSite=Lax`);
-        if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
+        if (req.xhr || req.headers.accept?.includes('application/json')) {
             return res.json({ success: true, message: 'Logged in successfully.', user: config.username, token });
         }
-        const target = nextUrl.startsWith('/') ? nextUrl : `${basePath}/`;
-        res.redirect(target);
+        res.redirect(nextUrl.startsWith('/') ? nextUrl : `${basePath}/`);
     });
     const handleLogout = (req, res) => {
-        const cookiePath = basePath || '/';
-        res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=; Path=${cookiePath}; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax`);
-        if (req.xhr || (req.headers.accept && req.headers.accept.includes('application/json'))) {
+        res.setHeader('Set-Cookie', `${types_1.SESSION_COOKIE_NAME}=; Path=${basePath || '/'}; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; HttpOnly; SameSite=Lax`);
+        if (req.xhr || req.headers.accept?.includes('application/json')) {
             return res.json({ success: true, message: 'Logged out successfully.' });
         }
         res.redirect(`${basePath}/login`);

package/dist/cli/args.d.ts

@@ -1 +1 @@
-import type {LogLevel} from '../utils/logger';export interface CliArgs{help:boolean;version:boolean;host?:string;port?:number;dbPath?:string;connection?:string;connections?:Record<string,string>;configPath?:string;dbDir?:string;dbFiles?:string[];basePath?:string;logLevel?:LogLevel;readonly :boolean;serverless?:boolean;auth?:boolean;authUsername?:string;authPassword?:string;authSecret?:string;}export declare function helpText():string;export declare function getPackageVersion():string;export declare function versionText():string;export declare function parseArgs(argv:string[]):{args:CliArgs;error?:string;};
+import type {LogLevel} from '../utils/logger';export interface CliArgs{help:boolean;version:boolean;host?:string;port?:number;dbPath?:string;connection?:string;connections?:Record<string,string>;configPath?:string;dbDir?:string;dbFiles?:string[];basePath?:string;logLevel?:LogLevel;readonly :boolean;explicitReadonly?:boolean;serverless?:boolean;auth?:boolean;authUsername?:string;authPassword?:string;authSecret?:string;}export declare function helpText():string;export declare const getPackageVersion:()=>string;export declare const versionText:()=>string;export declare function parseArgs(argv:string[]):{args:CliArgs;error?:string;};

package/dist/cli/args.js

@@ -3,9 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.versionText = exports.getPackageVersion = void 0;
 exports.helpText = helpText;
-exports.getPackageVersion = getPackageVersion;
-exports.versionText = versionText;
 exports.parseArgs = parseArgs;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
@@ -39,7 +38,7 @@ function helpText() {
         '      --files, --db-files <list> Comma-separated database file paths [DB_FILES / ADMINDB_DB_FILES]',
         '  -b, --base-path, --base <p>    URL prefix to serve under (default: /) [BASE_PATH / ADMINDB_BASE_PATH]',
         '  -r, --readonly, --read-only    Open databases read-only (writes disabled) [READONLY / ADMINDB_READONLY]',
-        '      --serverless               Enable serverless mode (enforces read-only, disables writes) [SERVERLESS / ADMINDB_SERVERLESS]',
+        '      --serverless               Enable serverless mode (SQLite defaults to read-only; PostgreSQL is editable unless --readonly is specified) [SERVERLESS / ADMINDB_SERVERLESS]',
         '      --auth                     Enable authentication (default: on) [ADMINDB_AUTH=true]',
         '      --no-auth, --disable-auth  Disable authentication completely [ADMINDB_NO_AUTH=1 / ADMINDB_AUTH=false]',
         '  -u, --username, --user <user>  Admin username (default: admin) [ADMINDB_USERNAME / ADMINDB_USER]',
@@ -68,28 +67,23 @@ function packageVersion() {
         ];
         for (const p of candidates) {
             if ((0, node_fs_1.existsSync)(p)) {
-                const raw = (0, node_fs_1.readFileSync)(p, 'utf8');
-                const pkg = JSON.parse(raw);
+                const pkg = JSON.parse((0, node_fs_1.readFileSync)(p, 'utf8'));
                 if (pkg.version)
                     return pkg.version;
             }
         }
-        return '';
     }
-    catch {
-        return '';
-    }
-}
-function getPackageVersion() {
-    return packageVersion();
+    catch { }
+    return '';
 }
-function versionText() {
+const getPackageVersion = () => packageVersion();
+exports.getPackageVersion = getPackageVersion;
+const versionText = () => {
     const v = packageVersion();
     return v ? `admindb v${v}` : 'admindb';
-}
-function isFlag(tok, ...names) {
-    return names.includes(tok) || names.some((n) => n.length > 2 && tok.startsWith(n + '='));
-}
+};
+exports.versionText = versionText;
+const isFlag = (tok, ...names) => names.includes(tok) || names.some((n) => n.length > 2 && tok.startsWith(`${n}=`));
 function parseArgs(argv) {
     const args = { help: false, version: false, readonly: false };
     const positional = [];
@@ -99,7 +93,7 @@ function parseArgs(argv) {
         const eq = argv[i].indexOf('=');
         if (eq !== -1)
             return argv[i].slice(eq + 1);
-        i += 1;
+        i++;
         return argv[i];
     };
     while (i < argv.length) {
@@ -128,8 +122,10 @@ function parseArgs(argv) {
                         args.host = fileConf.host;
                     if (fileConf.basePath !== undefined)
                         args.basePath = fileConf.basePath;
-                    if (fileConf.readonly !== undefined)
+                    if (fileConf.readonly !== undefined) {
                         args.readonly = fileConf.readonly;
+                        args.explicitReadonly = fileConf.readonly;
+                    }
                     if (fileConf.serverless !== undefined)
                         args.serverless = fileConf.serverless;
                     if (fileConf.logLevel !== undefined)
@@ -178,9 +174,8 @@ function parseArgs(argv) {
             if (v === undefined)
                 return invalid('Missing value for --open / --db-path.');
             args.dbPath = v;
-            if ((0, common_1.isPostgresConnectionString)(v)) {
+            if ((0, common_1.isPostgresConnectionString)(v))
                 args.connection = v;
-            }
         }
         else if (isFlag(tok, '-d', '--dir', '--folder', '--db-dir')) {
             const v = takeValue('--dir');
@@ -192,10 +187,7 @@ function parseArgs(argv) {
             const v = takeValue('--files');
             if (v === undefined)
                 return invalid('Missing value for --files / --db-files.');
-            args.dbFiles = v
-                .split(',')
-                .map((s) => s.trim())
-                .filter(Boolean);
+            args.dbFiles = v.split(',').map((s) => s.trim()).filter(Boolean);
         }
         else if (isFlag(tok, '-b', '--base-path', '--base')) {
             const v = takeValue('--base-path');
@@ -214,10 +206,10 @@ function parseArgs(argv) {
         }
         else if (tok === '-r' || tok === '--readonly' || tok === '--read-only') {
             args.readonly = true;
+            args.explicitReadonly = true;
         }
         else if (tok === '--serverless') {
             args.serverless = true;
-            args.readonly = true;
         }
         else if (tok === '--no-auth' || tok === '--disable-auth') {
             args.auth = false;
@@ -249,7 +241,7 @@ function parseArgs(argv) {
         else {
             positional.push(tok);
         }
-        i += 1;
+        i++;
     }
     if (positional.length > 1) {
         return invalid(`Unexpected extra arguments: ${positional.slice(1).join(' ')}.`);
@@ -306,9 +298,8 @@ function parseArgs(argv) {
                 }
             }
             catch (err) {
-                if (p.endsWith('.json')) {
+                if (p.endsWith('.json'))
                     return invalid(err.message);
-                }
                 args.dbPath = p;
             }
         }

package/dist/cli/config.d.ts

@@ -1 +1 @@
-import type {LogLevel} from '../utils/logger';export interface DatabaseConfigFile{connections?:Record<string,string>;connection?:string;port?:number;host?:string;basePath?:string;readonly ?:boolean;serverless?:boolean;auth?:boolean|{username?:string;password?:string;secret?:string;};logLevel?:LogLevel;}export declare function parseConfigFile(filePath:string):DatabaseConfigFile|null;export interface Config{host:string;port:number;dbPath:string;connection?:string;connections?:Record<string,string>;dbDir?:string;dbFiles?:string[];basePath:string;logLevel:LogLevel;readonly :boolean;serverless:boolean;auth:boolean;authUsername?:string;authPassword?:string;authSecret?:string;}export declare function loadConfig(env?:NodeJS.ProcessEnv):Config;
+import type {LogLevel} from '../utils/logger';export interface DatabaseConfigFile{connections?:Record<string,string>;connection?:string;port?:number;host?:string;basePath?:string;readonly ?:boolean;serverless?:boolean;auth?:boolean|{username?:string;password?:string;secret?:string;};logLevel?:LogLevel;}export declare function parseConfigFile(filePath:string):DatabaseConfigFile|null;export interface Config{host:string;port:number;dbPath:string;connection?:string;connections?:Record<string,string>;dbDir?:string;dbFiles?:string[];basePath:string;logLevel:LogLevel;readonly :boolean;explicitReadonly?:boolean;serverless:boolean;auth:boolean;authUsername?:string;authPassword?:string;authSecret?:string;}export declare function loadConfig(env?:NodeJS.ProcessEnv):Config;

package/dist/cli/config.js

@@ -41,9 +41,8 @@ function parseConfigFile(filePath) {
                 conns[k.trim()] = v.connection.trim();
             }
         }
-        if (typeof parsed.connection === 'string' && parsed.connection.trim()) {
+        if (typeof parsed.connection === 'string' && parsed.connection.trim())
             result.connection = parsed.connection.trim();
-        }
         if (typeof parsed.port === 'number')
             result.port = parsed.port;
         if (typeof parsed.host === 'string')
@@ -54,14 +53,12 @@ function parseConfigFile(filePath) {
             result.readonly = parsed.readonly;
         if (typeof parsed.serverless === 'boolean')
             result.serverless = parsed.serverless;
-        if (typeof parsed.auth === 'boolean' || (parsed.auth && typeof parsed.auth === 'object')) {
+        if (typeof parsed.auth === 'boolean' || (parsed.auth && typeof parsed.auth === 'object'))
             result.auth = parsed.auth;
-        }
         if (typeof parsed.logLevel === 'string')
             result.logLevel = parsed.logLevel;
-        if (Object.keys(conns).length > 0) {
+        if (Object.keys(conns).length > 0)
             result.connections = conns;
-        }
         return result;
     }
     catch (err) {
@@ -82,19 +79,23 @@ function loadConfig(env = process.env) {
     const serverlessRaw = env.ADMINDB_SERVERLESS ?? env.SERVERLESS ?? env.IS_SERVERLESS ?? '';
     const serverless = ['1', 'true', 'yes', 'on'].includes(String(serverlessRaw).trim().toLowerCase()) ||
         (0, serverless_1.isServerlessEnvironment)(env);
-    const readonlyRaw = env.ADMINDB_READONLY ?? env.READONLY ?? '';
-    const readonly = serverless || ['1', 'true', 'yes', 'on'].includes(String(readonlyRaw).trim().toLowerCase());
+    const readonlyRaw = env.ADMINDB_READONLY ?? env.READONLY;
+    const explicitReadonly = readonlyRaw !== undefined && readonlyRaw !== ''
+        ? ['1', 'true', 'yes', 'on'].includes(String(readonlyRaw).trim().toLowerCase())
+        : undefined;
+    const isPg = Boolean((connectionRaw && (0, common_1.isPostgresConnectionString)(connectionRaw)) ||
+        (dbPathRaw && (0, common_1.isPostgresConnectionString)(dbPathRaw)));
+    const defaultReadonly = serverless ? !isPg : false;
+    const readonly = explicitReadonly !== undefined ? explicitReadonly : defaultReadonly;
     let connections;
     const configJsonRaw = env.ADMINDB_CONFIG_JSON ?? env.ADMINDB_CONNECTIONS;
     if (configJsonRaw) {
         try {
             const parsed = JSON.parse(configJsonRaw);
-            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
                 connections = parsed;
-            }
-        }
-        catch {
         }
+        catch { }
     }
     const configPath = env.ADMINDB_CONFIG;
     if (configPath && (0, node_fs_1.existsSync)(configPath)) {
@@ -110,15 +111,11 @@ function loadConfig(env = process.env) {
         connection: connectionRaw ? String(connectionRaw) : undefined,
         connections,
         dbDir: dbDirRaw ? String(dbDirRaw) : undefined,
-        dbFiles: dbFilesRaw
-            ? String(dbFilesRaw)
-                .split(',')
-                .map((s) => s.trim())
-                .filter(Boolean)
-            : undefined,
+        dbFiles: dbFilesRaw ? String(dbFilesRaw).split(',').map((s) => s.trim()).filter(Boolean) : undefined,
         basePath: String(basePathRaw).replace(/\/+$/, ''),
         logLevel: logLevelRaw,
         readonly,
+        explicitReadonly,
         serverless,
         auth: !authDisabled,
         authUsername: (env.ADMINDB_USERNAME ?? env.ADMINDB_USER) ? String(env.ADMINDB_USERNAME ?? env.ADMINDB_USER).trim() : undefined,