dsh-db-tool 0.1.0

package/dist/manager.js

@@ -0,0 +1,469 @@
+import { getAdapter } from './adapters/index.js';
+import { ChallengeStore, classifyStatement, } from './guard/index.js';
+import { normalizeProjectKey, } from './store/index.js';
+import { runScriptInChild } from './script/runner.js';
+/* ---------------- 错误与结果类型 ---------------- */
+/** 携带机器可读 code 的业务错误（HTTP 层直接映射 {ok:false,error,code}） */
+export class DbToolError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'DbToolError';
+    }
+}
+function assertNonEmpty(v, label) {
+    const s = typeof v === 'string' ? v.trim() : '';
+    if (s === '')
+        throw new DbToolError('INVALID_ARGUMENT', `缺少必填参数: ${label}`);
+    return s;
+}
+/* ---------------- 服务核心 ---------------- */
+export class DbToolService {
+    store;
+    adapterCache = new Map();
+    challenges;
+    resolver;
+    disposed = false;
+    constructor(store, opts) {
+        this.store = store;
+        this.resolver = opts?.adapterResolver ?? getAdapter;
+        this.challenges = opts?.challenges ?? new ChallengeStore();
+    }
+    /* -- 连接管理（无需授权） -- */
+    listConnections() {
+        return this.store.connections.list();
+    }
+    createConnection(input) {
+        const meta = this.store.connections.create(input);
+        this.audit('', input.id, 'create_connection', input.id, 'none', false, true);
+        return meta;
+    }
+    updateConnection(id, patch) {
+        const meta = this.store.connections.update(id, patch);
+        if (!meta)
+            throw new DbToolError('NOT_FOUND', `连接不存在: ${id}`);
+        // url/凭证/ssl 变更后旧适配器仍持旧连接串，必须作废重建
+        void this.dropAdapters(id);
+        this.audit('', id, 'update_connection', id, 'none', false, true);
+        return meta;
+    }
+    removeConnection(id) {
+        const ok = this.store.connections.remove(id);
+        if (!ok)
+            throw new DbToolError('NOT_FOUND', `连接不存在: ${id}`);
+        void this.dropAdapters(id);
+        this.audit('', id, 'remove_connection', id, 'none', false, true);
+        return ok;
+    }
+    async testConnection(id) {
+        const rc = this.requireConn(id);
+        try {
+            const factory = await this.resolver(rc.meta.kind);
+            const adapter = await factory(rc);
+            try {
+                return await adapter.testConnect();
+            }
+            finally {
+                await adapter.close().catch(() => { });
+            }
+        }
+        catch (e) {
+            throw this.toDriverError(e);
+        }
+    }
+    /**
+     * 测试未保存的连接草稿（侧边栏「保存前测试」）。不落库、不写审计，
+     * 一次性适配器用完即关。url/fields 校验交给适配器层（与保存后测试同口径）。
+     */
+    async testDraft(input) {
+        const rc = {
+            meta: { id: '(draft)', kind: input.kind, name: '(draft)' },
+        };
+        if (input.url !== undefined)
+            rc.url = input.url;
+        if (input.fields !== undefined)
+            rc.fields = { ...input.fields };
+        if (input.ssl !== undefined)
+            rc.ssl = input.ssl;
+        try {
+            const factory = await this.resolver(input.kind);
+            const adapter = await factory(rc);
+            try {
+                return await adapter.testConnect();
+            }
+            finally {
+                await adapter.close().catch(() => { });
+            }
+        }
+        catch (e) {
+            throw this.toDriverError(e);
+        }
+    }
+    /* -- 授权管理 -- */
+    /** 项目路径归一化（/api/project-context 无会话解析器时的回退路径） */
+    projectKey(projectPath) {
+        return normalizeProjectKey(projectPath);
+    }
+    grantsFor(projectPath) {
+        return this.store.grants.grantsFor(normalizeProjectKey(projectPath));
+    }
+    grant(projectPath, connId, mode) {
+        const key = normalizeProjectKey(projectPath);
+        this.store.grants.grant(key, connId, mode);
+        // 授权模式变更（含 rw→ro 降级）必须作废旧会话适配器，否则降级不生效
+        void this.dropAdapters(connId);
+        this.audit(key, connId, 'grant', `${connId} -> ${mode}`, 'none', false, true);
+    }
+    revokeGrant(projectPath, connId) {
+        const key = normalizeProjectKey(projectPath);
+        this.store.grants.revoke(key, connId);
+        void this.dropAdapters(connId);
+        this.audit(key, connId, 'revoke', connId, 'none', false, true);
+    }
+    /* -- 浏览（ro 即可） -- */
+    async databases(projectPath, connId) {
+        const { key, adapter } = await this.authorize(projectPath, connId, false);
+        try {
+            const result = await adapter.listDatabases();
+            this.audit(key, connId, 'databases', 'listDatabases', 'none', false, true);
+            return result;
+        }
+        catch (e) {
+            this.audit(key, connId, 'databases', 'listDatabases', 'none', false, false, this.errText(e));
+            throw this.toDriverError(e);
+        }
+    }
+    async tables(projectPath, connId, database) {
+        const { key, adapter } = await this.authorize(projectPath, connId, false);
+        try {
+            const result = await adapter.listTables(database);
+            this.audit(key, connId, 'tables', database ?? 'default', 'none', false, true);
+            return result;
+        }
+        catch (e) {
+            this.audit(key, connId, 'tables', database ?? 'default', 'none', false, false, this.errText(e));
+            throw this.toDriverError(e);
+        }
+    }
+    async schema(projectPath, connId, table, database) {
+        const t = assertNonEmpty(table, 'table');
+        const { key, adapter } = await this.authorize(projectPath, connId, false);
+        try {
+            const result = await adapter.describeTable(t, database);
+            this.audit(key, connId, 'schema', t, 'none', false, true);
+            return result;
+        }
+        catch (e) {
+            this.audit(key, connId, 'schema', t, 'none', false, false, this.errText(e));
+            throw this.toDriverError(e);
+        }
+    }
+    async preview(projectPath, connId, table, limit, database, offset) {
+        const t = assertNonEmpty(table, 'table');
+        const capped = Math.max(1, Math.min(50, Math.floor(Number(limit) || 10)));
+        const off = Math.max(0, Math.floor(Number(offset) || 0));
+        const { key, adapter } = await this.authorize(projectPath, connId, false);
+        try {
+            const result = await adapter.previewRows(t, capped, database, off);
+            this.audit(key, connId, 'preview', `PREVIEW ${t} LIMIT ${capped} OFFSET ${off}`, 'none', false, true, undefined, result.rowCount);
+            return result;
+        }
+        catch (e) {
+            this.audit(key, connId, 'preview', `PREVIEW ${t} LIMIT ${capped} OFFSET ${off}`, 'none', false, false, this.errText(e));
+            throw this.toDriverError(e);
+        }
+    }
+    /* -- SQL 控制台（guard + challenge） -- */
+    async query(projectPath, connId, sql, params, challengeId) {
+        const statement = assertNonEmpty(sql, 'sql');
+        return this.runGuarded({
+            projectPath,
+            connId,
+            op: 'query',
+            statement,
+            challengeId,
+            run: (adapter) => adapter.query(statement, params),
+            rowsAffected: (r) => r.rowCount,
+        });
+    }
+    async execute(projectPath, connId, statement, params, challengeId) {
+        const stmt = assertNonEmpty(statement, 'statement');
+        return this.runGuarded({
+            projectPath,
+            connId,
+            op: 'execute',
+            statement: stmt,
+            challengeId,
+            run: (adapter) => adapter.execute(stmt, params),
+            rowsAffected: (r) => r.affectedRows,
+        });
+    }
+    /**
+     * run_script：子进程隔离执行（lib/script/worker.cjs + permission model + 新 vm realm）。
+     *  - 会话专用适配器（不走缓存，超时即 close 中断在途调用，不污染共享缓存）；
+     *  - db 句柄经 IPC 回父进程，走完整 guard/challenge/审计链路；
+     *  - 脚本内 NEEDS_CONFIRMATION 以 DbToolError 形式抛出（message 为 JSON），
+     *    由入口层还原为 NEEDS_CONFIRMATION 响应；
+     *  - 审计后置：仅在拿到真实执行结果（成功/失败）后落盘。
+     */
+    async runScript(projectPath, connId, code, challengeId) {
+        const src = assertNonEmpty(code, 'code');
+        // authorize(needWrite=true) 已拒绝 ro 授权；脚本内写句柄再经 runGuarded 双重校验
+        const { key, mode } = await this.authorize(projectPath, connId, true);
+        // 会话专用适配器：独立于缓存实例，脚本超时可立即 close（中断在途查询）
+        const rc = this.requireConn(connId);
+        const factory = await this.resolver(rc.meta.kind);
+        const sessionAdapter = await factory(rc, { mode }).catch((e) => {
+            throw e instanceof DbToolError ? e : this.toDriverError(e);
+        });
+        const auditStmt = src.length > 200 ? src.slice(0, 200) + '…' : src;
+        try {
+            const result = await runScriptInChild({
+                code: src,
+                dbQuery: async (sql, params) => this.unwrapForScript(await this.query(key, connId, sql, params, challengeId)),
+                dbExecute: async (statement, params) => this.unwrapForScript(await this.execute(key, connId, statement, params, challengeId)),
+                onLog: (level, text) => level === 'error' ? console.error('[db-script]', text) : console.log('[db-script]', text),
+                onTimeout: () => {
+                    void sessionAdapter.close().catch(() => { });
+                },
+            });
+            this.audit(key, connId, 'script', auditStmt, 'none', false, true);
+            return result;
+        }
+        catch (e) {
+            if (!(e instanceof DbToolError && e.code === 'NEEDS_CONFIRMATION')) {
+                this.audit(key, connId, 'script', auditStmt, 'none', false, false, this.errText(e));
+            }
+            if (e instanceof DbToolError)
+                throw e;
+            throw this.toDriverError(e);
+        }
+        finally {
+            await sessionAdapter.close().catch(() => { });
+        }
+    }
+    /* -- 审计与状态 -- */
+    auditTail(projectPath, limit) {
+        const n = Math.max(1, Math.min(500, Math.floor(Number(limit) || 50)));
+        if (!projectPath || projectPath.trim() === '')
+            return this.store.audit.tail(n);
+        const key = normalizeProjectKey(projectPath);
+        return this.store.audit.tail(n).filter((e) => e.projectPathKey === key);
+    }
+    state(projectPath) {
+        const grants = projectPath && projectPath.trim() !== '' ? this.grantsFor(projectPath) : [];
+        return {
+            connections: this.listConnections(),
+            grants,
+            auditTail: this.auditTail(projectPath, 50),
+        };
+    }
+    /** 关闭缓存的适配器并停止 challenge 清理 */
+    async dispose() {
+        this.disposed = true;
+        this.challenges.dispose();
+        const pending = [...this.adapterCache.values()];
+        this.adapterCache.clear();
+        for (const p of pending) {
+            try {
+                const a = await p;
+                await a.close().catch(() => { });
+            }
+            catch {
+                // 缓存里的加载失败项直接忽略
+            }
+        }
+    }
+    /* ---------------- 内部 ---------------- */
+    requireConn(connId) {
+        try {
+            return this.store.connections.testTarget(connId);
+        }
+        catch {
+            throw new DbToolError('NOT_FOUND', `连接不存在: ${connId}`);
+        }
+    }
+    /** 授权校验 + 取（缓存的）适配器 */
+    async authorize(projectPath, connId, needWrite) {
+        if (this.disposed)
+            throw new DbToolError('INVALID_ARGUMENT', '服务已关闭');
+        if (!projectPath || projectPath.trim() === '') {
+            throw new DbToolError('UNAUTHORIZED_PROJECT', '业务操作需要 projectPath（匿名项目仅可管理连接）');
+        }
+        const key = normalizeProjectKey(projectPath);
+        const mode = this.store.grants.check(key, connId);
+        if (!mode)
+            throw new DbToolError('UNAUTHORIZED_PROJECT', `项目未授权该连接: ${connId}`);
+        if (needWrite && mode === 'ro') {
+            throw new DbToolError('READ_ONLY', '该连接对本项目为只读授权（ro），拒绝写操作');
+        }
+        const adapter = await this.adapterFor(connId, mode);
+        return { key, mode, adapter };
+    }
+    /** 关闭指定连接的全部缓存适配器（mode 变更/凭证变更/删除时） */
+    async dropAdapters(connId) {
+        const keys = [...this.adapterCache.keys()].filter((k) => k.startsWith(`${connId}@mode=`));
+        for (const k of keys) {
+            const p = this.adapterCache.get(k);
+            this.adapterCache.delete(k);
+            if (!p)
+                continue;
+            try {
+                const a = await p;
+                await a.close().catch(() => { });
+            }
+            catch {
+                // 加载失败或已断开的旧实例直接忽略
+            }
+        }
+    }
+    adapterFor(connId, mode) {
+        const cacheKey = `${connId}@mode=${mode}`;
+        let p = this.adapterCache.get(cacheKey);
+        if (!p) {
+            p = (async () => {
+                const rc = this.requireConn(connId);
+                const factory = await this.resolver(rc.meta.kind);
+                return factory(rc, { mode });
+            })().catch((e) => {
+                this.adapterCache.delete(cacheKey);
+                throw e instanceof DbToolError ? e : this.toDriverError(e);
+            });
+            this.adapterCache.set(cacheKey, p);
+        }
+        return p;
+    }
+    /** guard 主流程：分类 → challenge → 执行 → 审计 */
+    async runGuarded(args) {
+        const { projectPath, connId, op, statement, challengeId } = args;
+        if (args.params !== undefined && !Array.isArray(args.params)) {
+            throw new DbToolError('INVALID_ARGUMENT', 'params 必须是数组（绑定参数）');
+        }
+        const { key, adapter } = await this.authorize(projectPath, connId, op === 'execute');
+        const kind = adapter.kind;
+        const verdict = classifyStatement(kind, statement, op);
+        if (verdict.level === 'danger') {
+            const scope = { connId, projectKey: key };
+            if (!challengeId) {
+                const { id: cid } = this.challenges.create(statement, scope);
+                this.audit(key, connId, op, statement, 'danger', false, false, 'NEEDS_CONFIRMATION');
+                return { needConfirmation: true, challengeId: cid, statement, danger: 'danger', reason: verdict.reason ?? '危险操作，需要用户确认' };
+            }
+            if (!this.challenges.consume(challengeId, statement, scope)) {
+                this.audit(key, connId, op, statement, 'danger', false, false, 'INVALID_CHALLENGE');
+                throw new DbToolError('INVALID_CHALLENGE', '确认凭据无效（不存在、已使用、已过期或语句已变更），请重新发起');
+            }
+        }
+        try {
+            const result = await args.run(adapter);
+            this.audit(key, connId, op, statement, verdict.level, verdict.level === 'danger', true, undefined, args.rowsAffected?.(result));
+            return result;
+        }
+        catch (e) {
+            this.audit(key, connId, op, statement, verdict.level, verdict.level === 'danger', false, this.errText(e));
+            throw this.toDriverError(e);
+        }
+    }
+    /** 脚本内句柄：NeedConfirm 无法在脚本中交互，转为可还原的 DbToolError */
+    unwrapForScript(r) {
+        if (r && typeof r === 'object' && r.needConfirmation === true) {
+            const nc = r;
+            throw new DbToolError('NEEDS_CONFIRMATION', JSON.stringify(nc));
+        }
+        return r;
+    }
+    audit(projectPathKey, connId, action, statement, danger, confirmed, ok, error, rowsAffected) {
+        try {
+            this.store.audit.append({
+                projectPathKey, connId, action, statement, danger, confirmed, ok,
+                ...(error !== undefined ? { error } : {}),
+                ...(rowsAffected !== undefined ? { rowsAffected } : {}),
+            });
+        }
+        catch {
+            // 审计失败不阻塞业务（best-effort）
+        }
+    }
+    errText(e) {
+        return e instanceof Error ? e.message : String(e);
+    }
+    toDriverError(e) {
+        if (e instanceof DbToolError)
+            return e;
+        return new DbToolError('DRIVER_ERROR', this.errText(e));
+    }
+}
+function pick(args, snake) {
+    return args[snake] ?? (snake === 'conn_id' ? args.connId : args.challengeId);
+}
+/**
+ * 工具 action 分发。危险待确认时文本内含确认指引，
+ * 提示模型向用户 ask 确认后带 challenge_id 重试。
+ * 返回 { text, isError } 对象：harness 工具契约要求结构化结果，
+ * isError=true 仅用于被拒/失败；NEEDS_CONFIRMATION 不是失败。
+ */
+export async function handleToolAction(service, args, projectPath) {
+    const action = args.action;
+    const connId = pick(args, 'conn_id');
+    const challengeId = pick(args, 'challenge_id');
+    const j = (v) => JSON.stringify(v, null, 2);
+    const ok = (t) => ({ text: t, isError: false });
+    try {
+        switch (action) {
+            case 'list_connections':
+                return ok(j(service.listConnections()));
+            case 'query': {
+                const r = await service.query(projectPath, requireConn(connId), assertArg(args.sql, 'sql'), args.params, challengeId);
+                return ok(needConfirmText(r) ?? j(r));
+            }
+            case 'execute': {
+                const r = await service.execute(projectPath, requireConn(connId), assertArg(args.statement ?? args.sql, 'statement'), args.params, challengeId);
+                return ok(needConfirmText(r) ?? j(r));
+            }
+            case 'schema': {
+                const conn = requireConn(connId);
+                if (args.table)
+                    return ok(j(await service.schema(projectPath, conn, args.table, args.database)));
+                if (args.database)
+                    return ok(j(await service.tables(projectPath, conn, args.database)));
+                return ok(j(await service.databases(projectPath, conn)));
+            }
+            case 'preview': {
+                const r = await service.preview(projectPath, requireConn(connId), assertArg(args.table, 'table'), args.limit, args.database, args.offset);
+                return ok(j(r));
+            }
+            case 'run_script': {
+                const r = await service.runScript(projectPath, requireConn(connId), assertArg(args.code, 'code'), challengeId);
+                return ok(needConfirmText(r) ?? j(r));
+            }
+            default:
+                throw new DbToolError('INVALID_ARGUMENT', `未知 action: ${action}（可用: list_connections/query/execute/schema/preview/run_script）`);
+        }
+    }
+    catch (e) {
+        const code = e instanceof DbToolError ? e.code : 'DRIVER_ERROR';
+        return { text: j({ ok: false, error: e instanceof Error ? e.message : String(e), code }), isError: true };
+    }
+}
+function requireConn(connId) {
+    if (!connId || connId.trim() === '')
+        throw new DbToolError('INVALID_ARGUMENT', '缺少必填参数: conn_id');
+    return connId;
+}
+function assertArg(v, label) {
+    if (!v || v.trim() === '')
+        throw new DbToolError('INVALID_ARGUMENT', `缺少必填参数: ${label}`);
+    return v;
+}
+function needConfirmText(r) {
+    if (!(r && typeof r === 'object' && r.needConfirmation === true))
+        return null;
+    const nc = r;
+    return JSON.stringify({
+        ok: false,
+        code: 'NEEDS_CONFIRMATION',
+        ...nc,
+        hint: `该操作危险（${nc.reason}）。请先向用户说明并征得确认，用户同意后携带 challenge_id=${nc.challengeId} 重试同一语句；challenge 一次性、5 分钟内有效、绑定本语句。`,
+    }, null, 2);
+}

package/dist/script/runner.js

@@ -0,0 +1,147 @@
+/**
+ * run_script 子进程执行器。
+ *
+ * 为什么不用 node:vm 同进程沙箱：node:vm 官方明确不是安全边界，脚本可经
+ * Function constructor 等已知路径逃逸到宿主 realm 拿到 process/require，
+ * 读取 secrets.json 与任意文件。子进程 + Node permission model（禁 fs）+
+ * 新 vm realm 双层隔离：vm 逃逸后仍是无文件权限的 worker 进程。
+ * 超时用 SIGKILL 进程级强杀（vm timeout 管不到异步调用），并对会话专用
+ * 适配器立即 close，中断在途调用。
+ */
+import { fork } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import * as path from 'node:path';
+import { DbToolError } from '../manager.js';
+const WORKER_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), 'worker.cjs');
+/** permission model 的版本兼容 flag：Node ≥22 用稳定名，20/21 用 experimental 别名 */
+function permissionFlags() {
+    const major = Number(process.versions.node.split('.')[0]);
+    return major >= 22 ? ['--permission'] : ['--experimental-permission'];
+}
+/** worker 启动/运行所需的环境变量白名单（Windows/Unix 各取所需），其余一律不透传 */
+const ENV_ALLOWLIST = [
+    'PATH', 'SYSTEMROOT', 'SYSTEMDRIVE', 'TEMP', 'TMP', 'COMSPEC', 'PATHEXT',
+    'USERPROFILE', 'HOME', 'LANG', 'TZ',
+];
+/** 最小化环境变量：--permission 只禁 fs，脚本仍可读 process.env，故 fork 时按白名单裁剪 */
+export function minimalEnv() {
+    const env = {};
+    for (const key of ENV_ALLOWLIST) {
+        const value = process.env[key];
+        if (value !== undefined)
+            env[key] = value;
+    }
+    return env;
+}
+export async function runScriptInChild(opts) {
+    const timeoutMs = opts.timeoutMs ?? 60_000;
+    const child = fork(WORKER_PATH, [], {
+        execArgv: permissionFlags(),
+        env: minimalEnv(),
+        stdio: ['ignore', 'ignore', 'inherit', 'ipc'],
+    });
+    const pendingDb = new Map();
+    let dbSeq = 0;
+    let settled = false;
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            child.kill('SIGKILL');
+            opts.onTimeout?.();
+            reject(new DbToolError('SCRIPT_TIMEOUT', `脚本执行超时（${Math.round(timeoutMs / 1000)}s），已强制终止并关闭本次会话连接`));
+        }, timeoutMs);
+        timer.unref?.();
+        child.on('message', (raw) => {
+            if (!raw || typeof raw !== 'object')
+                return;
+            const msg = raw;
+            if (msg.type === 'db') {
+                const reqId = Number(msg.reqId);
+                // 先注册回包通道再发起调用（同一处理器内，保证时序）
+                pendingDb.set(reqId, (r) => {
+                    child.send({ type: 'dbResult', reqId, ...r }, () => {
+                        /* 忽略回包失败（worker 可能已死） */
+                    });
+                });
+                void handleDbCall(String(msg.method ?? ''), Array.isArray(msg.args) ? msg.args : [])
+                    .then((result) => pendingDb.get(reqId)?.({ ok: true, result }))
+                    .catch((e) => pendingDb.get(reqId)?.({ ok: false, error: errorOf(e) }));
+                return;
+            }
+            if (msg.type === 'log') {
+                opts.onLog?.(msg.level === 'error' ? 'error' : 'log', String(msg.text ?? ''));
+                return;
+            }
+            if (msg.type === 'done' && !settled) {
+                settled = true;
+                clearTimeout(timer);
+                child.kill();
+                if (msg.ok) {
+                    resolve(msg.result);
+                }
+                else {
+                    const err = msg.error ?? {};
+                    if (err.code === 'NEEDS_CONFIRMATION' && err.payload) {
+                        reject(needConfirmFromPayload(err.payload));
+                    }
+                    else if (err.code === 'SCRIPT_TIMEOUT') {
+                        reject(new DbToolError('SCRIPT_TIMEOUT', err.message ?? '脚本执行超时'));
+                    }
+                    else if (err.code === 'READ_ONLY') {
+                        reject(new DbToolError('READ_ONLY', err.message ?? '该连接为只读授权，拒绝写操作'));
+                    }
+                    else {
+                        const e = new Error(err.message ?? '脚本执行失败');
+                        reject(e);
+                    }
+                }
+            }
+        });
+        child.on('exit', (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(new Error(`脚本进程异常退出（code=${code ?? 'null'}${signal ? `, signal=${signal}` : ''}）`));
+        });
+        child.on('error', (e) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(new DbToolError('DRIVER_ERROR', `脚本进程启动失败: ${e.message}`));
+        });
+        child.send({ type: 'run', code: opts.code }, () => {
+            /* 入队即可 */
+        });
+    });
+    async function handleDbCall(method, args) {
+        const [statement, params] = args;
+        if (method === 'query')
+            return opts.dbQuery(statement, params);
+        if (method === 'execute')
+            return opts.dbExecute(statement, params);
+        throw new DbToolError('INVALID_ARGUMENT', `未知 db 方法: ${method}`);
+    }
+    function errorOf(e) {
+        if (e instanceof DbToolError) {
+            if (e.code === 'NEEDS_CONFIRMATION') {
+                let payload;
+                try {
+                    payload = JSON.parse(e.message);
+                }
+                catch {
+                    payload = undefined;
+                }
+                return { code: e.code, message: e.message, payload };
+            }
+            return { code: e.code, message: e.message };
+        }
+        return { message: e instanceof Error ? e.message : String(e) };
+    }
+    function needConfirmFromPayload(payload) {
+        return new DbToolError('NEEDS_CONFIRMATION', JSON.stringify(payload));
+    }
+}