narai-primitives 2.0.0-rc.1

package/dist/connectors/db/index.js

@@ -0,0 +1,26 @@
+/**
+ * @narai/db-agent-connector — public API barrel.
+ *
+ * Default export: a ready-to-use `Connector` built on
+ * `@narai/connector-toolkit`. Use `import connector from "narai-primitives/db"`
+ * and call `connector.fetch(action, params)` / `connector.main(argv)`.
+ *
+ * Legacy surface: `fetch(action, params)` is re-exported from the internal
+ * dispatcher for programmatic callers that want the pre-framework envelope
+ * shape (`{status: "ok"|"denied"|..., rows, columns, ...}`). The framework
+ * connector translates that into the canonical envelope at the boundary.
+ */
+import { buildDbConnector } from "./connector.js";
+const connector = buildDbConnector();
+export default connector;
+export const { main, fetch, validActions } = connector;
+export { buildDbConnector };
+// Legacy dispatcher surface (pre-2.0 envelope shape, still useful for
+// programmatic callers embedding the DB policy gate directly).
+export { fetch as dispatcherFetch, VALID_ACTIONS, HELP_TEXT, } from "./dispatcher.js";
+export * from "./lib/index.js";
+// Selective re-export to avoid `CredentialProvider` name clash with the
+// legacy class in `lib/credentials.ts`.
+export { registerProvider, getProvider, clearProviders, listProviders, resolveSecret, FileProvider, EnvVarProvider, KeychainProvider, CloudSecretsProvider, parseCredentialRef, KNOWN_PROVIDERS, } from "@narai/credential-providers";
+export { parseConfig, ConfigFileNotFoundError, } from "./config.js";
+//# sourceMappingURL=index.js.map

package/dist/connectors/db/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectors/db/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;AACrC,eAAe,SAAS,CAAC;AACzB,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,sEAAsE;AACtE,+DAA+D;AAC/D,OAAO,EACL,KAAK,IAAI,eAAe,EACxB,aAAa,EACb,SAAS,GAIV,MAAM,iBAAiB,CAAC;AAEzB,cAAc,gBAAgB,CAAC;AAE/B,wEAAwE;AACxE,wCAAwC;AACxC,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,aAAa,EACb,aAAa,EACb,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,GAKhB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,WAAW,EAEX,uBAAuB,GACxB,MAAM,aAAa,CAAC"}

package/dist/connectors/db/lib/audit.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Enable audit logging to `path` (JSONL file).
+ * If `sessionId` is not provided, a random 12-char hex string is generated.
+ */
+export declare function enableAudit(filePath: string, sessionId?: string | null): void;
+/** Disable audit logging and clear state. */
+export declare function disableAudit(): void;
+export interface LogQueryParams {
+    env: string;
+    query: string;
+    status: string;
+    row_count: number;
+    execution_time_ms: number;
+    error?: string | null;
+    context?: string | null;
+}
+export declare function scrubSqlSecrets(sql: string): string;
+/** Log a query execution event. */
+export declare function logQuery(params: LogQueryParams): void;
+export interface LogEventParams {
+    event_type: string;
+    details?: Record<string, unknown> | null;
+}
+/** Log a non-query event (e.g. connect, schema_inspect). */
+export declare function logEvent(params: LogEventParams): void;
+/** Internal: state snapshot exposed only for tests. */
+export declare function _auditState(): {
+    enabled: boolean;
+    path: string | null;
+    sessionId: string | null;
+};
+//# sourceMappingURL=audit.d.ts.map

package/dist/connectors/db/lib/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../../src/connectors/db/lib/audit.ts"],"names":[],"mappings":"AAwBA;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAQ7E;AAED,6CAA6C;AAC7C,wBAAgB,YAAY,IAAI,IAAI,CAInC;AAiCD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAgBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAED,mCAAmC;AACnC,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAmBrD;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1C;AAED,4DAA4D;AAC5D,wBAAgB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAUrD;AAED,uDAAuD;AACvD,wBAAgB,WAAW,IAAI;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAMA"}

package/dist/connectors/db/lib/audit.js

@@ -0,0 +1,130 @@
+/**
+ * audit.ts — Audit logging for wiki_db (JSONL format, non-failing).
+ *
+ * Mirrors `audit.py`:
+ *  - Module-level state holds `enabled`, `path`, and `session_id`.
+ *  - `enableAudit` / `disableAudit` toggle the state.
+ *  - `logQuery` / `logEvent` append a single JSON line each; errors are
+ *    swallowed so logging never raises into the caller.
+ *
+ * JSONL format parity: JSON.stringify uses compact separators (",", ":"),
+ * which matches Python's `json.dumps(record)` output byte-for-byte for
+ * dict+string+number payloads. Keys appear in insertion order in both
+ * languages.
+ */
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+// Module-level state
+const _state = {
+    enabled: false,
+    path: null,
+    sessionId: null,
+};
+/**
+ * Enable audit logging to `path` (JSONL file).
+ * If `sessionId` is not provided, a random 12-char hex string is generated.
+ */
+export function enableAudit(filePath, sessionId) {
+    _state.enabled = true;
+    _state.path = filePath;
+    _state.sessionId =
+        sessionId !== undefined && sessionId !== null
+            ? sessionId
+            // Python: secrets.token_hex(6) → 12 hex chars.
+            : crypto.randomBytes(6).toString("hex");
+}
+/** Disable audit logging and clear state. */
+export function disableAudit() {
+    _state.enabled = false;
+    _state.path = null;
+    _state.sessionId = null;
+}
+/** Append a JSON record to the audit file. Never raises.
+ *
+ *  Uses JSON.stringify (compact form) so each record fits on one line.
+ */
+function _writeRecord(record) {
+    if (!_state.enabled || _state.path === null)
+        return;
+    try {
+        // fs.appendFileSync creates the file if missing but NOT parent dirs,
+        // matching Python's `open(path, "a")` semantics.
+        fs.appendFileSync(_state.path, JSON.stringify(record) + "\n", "utf-8");
+    }
+    catch {
+        // best-effort, same as Python's `except OSError: pass`
+    }
+}
+/**
+ * Python-compatible ISO-8601 UTC timestamp with trailing "Z".
+ *
+ * Python's `datetime.datetime.utcnow().isoformat() + "Z"` produces a
+ * format like `"2026-04-12T10:55:50.123456"` (microseconds) + `"Z"`.
+ * JS's `Date().toISOString()` yields `"2026-04-12T10:55:50.123Z"`
+ * (millisecond precision). Both are valid ISO-8601 so downstream parsers
+ * accept them; the test only checks for the key's presence.
+ */
+function _isoTimestamp() {
+    // Strip trailing Z that toISOString includes, then re-append to match
+    // Python's explicit `+ "Z"` composition.
+    const iso = new Date().toISOString();
+    return iso.endsWith("Z") ? iso : iso + "Z";
+}
+/**
+ * Mask values of common credential-bearing identifiers in a SQL string.
+ *
+ * Catches `password='…'`, `token="…"`, `api_key='…'`, etc. so that
+ * read-only queries against the user's own DB don't persist embedded
+ * credentials to events.jsonl. Intentionally only handles complete
+ * single/double-quoted literals — partial or concatenated literals are
+ * out of scope.
+ */
+const _SENSITIVE_LITERAL_SQUOTE_RE = /\b(password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|auth)\s*=\s*'[^']*'/gi;
+const _SENSITIVE_LITERAL_DQUOTE_RE = /\b(password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|auth)\s*=\s*"[^"]*"/gi;
+export function scrubSqlSecrets(sql) {
+    return sql
+        .replace(_SENSITIVE_LITERAL_SQUOTE_RE, (_m, key) => `${key}='[REDACTED]'`)
+        .replace(_SENSITIVE_LITERAL_DQUOTE_RE, (_m, key) => `${key}="[REDACTED]"`);
+}
+/** Log a query execution event. */
+export function logQuery(params) {
+    const record = {
+        event_type: "query",
+        timestamp: _isoTimestamp(),
+        session_id: _state.sessionId,
+        env: params.env,
+        // Scrub before truncate so a credential split by truncation can't leak.
+        query: scrubSqlSecrets(params.query).slice(0, 2000),
+        status: params.status,
+        row_count: params.row_count,
+        execution_time_ms: params.execution_time_ms,
+    };
+    if (params.error !== undefined && params.error !== null) {
+        record["error"] = params.error;
+    }
+    if (params.context !== undefined && params.context !== null) {
+        record["context"] = params.context;
+    }
+    _writeRecord(record);
+}
+/** Log a non-query event (e.g. connect, schema_inspect). */
+export function logEvent(params) {
+    const record = {
+        event_type: params.event_type,
+        timestamp: _isoTimestamp(),
+        session_id: _state.sessionId,
+    };
+    if (params.details !== undefined && params.details !== null) {
+        record["details"] = params.details;
+    }
+    _writeRecord(record);
+}
+/** Internal: state snapshot exposed only for tests. */
+export function _auditState() {
+    return {
+        enabled: _state.enabled,
+        path: _state.path,
+        sessionId: _state.sessionId,
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/connectors/db/lib/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../src/connectors/db/lib/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,qBAAqB;AACrB,MAAM,MAAM,GAAG;IACb,OAAO,EAAE,KAAgB;IACzB,IAAI,EAAE,IAAqB;IAC3B,SAAS,EAAE,IAAqB;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,SAAyB;IACrE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;IACvB,MAAM,CAAC,SAAS;QACd,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;YAC3C,CAAC,CAAC,SAAS;YACX,+CAA+C;YAC/C,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,MAA+B;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO;IACpD,IAAI,CAAC;QACH,qEAAqE;QACrE,iDAAiD;QACjD,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa;IACpB,sEAAsE;IACtE,yCAAyC;IACzC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAChC,sFAAsF,CAAC;AACzF,MAAM,4BAA4B,GAChC,sFAAsF,CAAC;AAEzF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG;SACP,OAAO,CAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,eAAe,CAAC;SACjF,OAAO,CAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;AACvF,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,QAAQ,CAAC,MAAsB;IAC7C,MAAM,MAAM,GAA4B;QACtC,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,aAAa,EAAE;QAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,wEAAwE;QACxE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;KAC5C,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACrC,CAAC;IACD,YAAY,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAOD,4DAA4D;AAC5D,MAAM,UAAU,QAAQ,CAAC,MAAsB;IAC7C,MAAM,MAAM,GAA4B;QACtC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,aAAa,EAAE;QAC1B,UAAU,EAAE,MAAM,CAAC,SAAS;KAC7B,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACrC,CAAC;IACD,YAAY,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW;IAKzB,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC"}

package/dist/connectors/db/lib/connection.d.ts

@@ -0,0 +1,61 @@
+import { DatabaseDriver } from "./drivers/base.js";
+/**
+ * Returns a concrete `DatabaseDriver` for a given environment's config.
+ *
+ * For pool-aware drivers (Phase E: pg, mysql, mssql, mongo, dynamo) the
+ * factory is expected to return a driver that wraps a connection pool
+ * internally — one driver instance per environment, reused across calls.
+ */
+export type DriverFactory = (envConfig: Record<string, unknown>) => DatabaseDriver;
+/** Register a factory under a driver name (e.g. "sqlite", "postgresql"). */
+export declare function registerDriverFactory(name: string, factory: DriverFactory): void;
+/** Remove all registered factories (test helper). */
+export declare function clearDriverFactories(): void;
+/** Return registered driver names (test helper). */
+export declare function listDriverFactories(): string[];
+/** A handle returned by {@link getConnection}. */
+export interface Connection {
+    /** The environment name this handle was opened for. */
+    envName: string;
+    /** Driver-native connection object (opaque). */
+    native: unknown;
+    /** Driver used to create this connection (used by release/healthCheck). */
+    driver: DatabaseDriver;
+}
+/**
+ * Obtain a connection for the named environment. Creates the driver and
+ * pool lazily on first call. Returns a handle that must be passed to
+ * {@link releaseConnection} when done.
+ *
+ * G-CONN-AWAIT: async drivers (pg, mysql, mssql, mongo, dynamo) return
+ * a Promise from `connect()`. We await the resolved handle before
+ * registering it in `openConnections` so identity-based lookups in
+ * `releaseConnection`/`shutdownAll` match the same object the caller
+ * holds. `Promise.resolve(x)` no-ops on the sync SQLite path.
+ */
+export declare function getConnection(envName: string): Promise<Connection>;
+/** Release a connection back to its pool (closes native handle). */
+export declare function releaseConnection(envName: string, conn: Connection): void;
+/**
+ * Cheap liveness check. Returns `true` on success, `false` on any error.
+ *
+ * Preference order:
+ *  1. `driver.healthCheck(native)` — Phase E drivers use engine-appropriate
+ *     probes (Mongo `ping`, DynamoDB `ListTables`, etc.) that `SELECT 1`
+ *     cannot express.
+ *  2. `driver.executeReadAsync(..., "SELECT 1", ...)` — SQL drivers.
+ *  3. `driver.executeRead(..., "SELECT 1", ...)` — legacy sync path
+ *     (SQLite, mocked test drivers).
+ */
+export declare function healthCheck(envName: string): Promise<boolean>;
+/**
+ * Close every pool and drop the registry. Awaits each driver's
+ * `shutdown()` so native connection pools (pg.Pool, mysql2 pool,
+ * mssql.ConnectionPool, MongoClient) are fully drained before we return.
+ */
+export declare function shutdownAll(): Promise<void>;
+/** Return whether a pool exists for the given env (test helper). */
+export declare function _hasPool(envName: string): boolean;
+/** Return the number of open connections in a pool (test helper). */
+export declare function _openCount(envName: string): number;
+//# sourceMappingURL=connection.d.ts.map

package/dist/connectors/db/lib/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../../src/connectors/db/lib/connection.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQnD;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,cAAc,CAAC;AAIpB,4EAA4E;AAC5E,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,GACrB,IAAI,CAEN;AAED,qDAAqD;AACrD,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED,oDAAoD;AACpD,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAWD,kDAAkD;AAClD,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,cAAc,CAAC;CACxB;AAqDD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAcxE;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,IAAI,CAoBzE;AAuBD;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA2BnE;AAED;;;;GAIG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAyBjD;AA2ID,oEAAoE;AACpE,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD"}

package/dist/connectors/db/lib/connection.js

@@ -0,0 +1,326 @@
+/**
+ * connection.ts — Connection-pool registry keyed by environment name.
+ *
+ * Wraps driver-native connection pools behind a uniform acquire/release
+ * API. For Phase F the only shipped driver is `SQLiteDriver` (no native
+ * pool; each `getConnection()` opens a fresh handle and `release` closes
+ * it). Phase E drivers (pg, mysql, mssql, mongo, dynamo) will register
+ * themselves with pool-aware factories via {@link registerDriverFactory}.
+ *
+ * Shutdown:
+ *  - `shutdownAll()` closes every driver in the registry.
+ *  - We register `SIGINT`, `SIGTERM`, and `exit` handlers the first time
+ *    `getConnection()` is called, so long-running scripts release their
+ *    pools on process teardown.
+ */
+import { getEnvironment } from "./environments.js";
+import { logEvent } from "./audit.js";
+import { parseCredentialRef, resolveSecret } from "@narai/credential-providers";
+const _driverFactories = new Map();
+/** Register a factory under a driver name (e.g. "sqlite", "postgresql"). */
+export function registerDriverFactory(name, factory) {
+    _driverFactories.set(name, factory);
+}
+/** Remove all registered factories (test helper). */
+export function clearDriverFactories() {
+    _driverFactories.clear();
+}
+/** Return registered driver names (test helper). */
+export function listDriverFactories() {
+    return [..._driverFactories.keys()];
+}
+const _pools = new Map();
+// ---------------------------------------------------------------------------
+// Lifecycle handlers
+// ---------------------------------------------------------------------------
+let _handlersInstalled = false;
+function _installShutdownHandlers() {
+    if (_handlersInstalled)
+        return;
+    _handlersInstalled = true;
+    // `exit` fires once per process; make the cleanup best-effort and
+    // synchronous where possible so pools are released before Node exits.
+    process.on("exit", () => {
+        try {
+            _shutdownAllSync();
+        }
+        catch {
+            /* best-effort */
+        }
+    });
+    // Signals: flush pools so native connections release promptly, then
+    // leave the exit decision to the host. Calling `process.exit()` here
+    // would clobber any user-installed SIGINT/SIGTERM handler in an
+    // application that embeds wiki_db, so we deliberately do not do that.
+    // Node's default behavior (exit with 128+signum when no other listener
+    // calls `preventDefault`-equivalent) still applies when no handler
+    // keeps the process alive.
+    for (const sig of ["SIGINT", "SIGTERM"]) {
+        process.on(sig, () => {
+            try {
+                _shutdownAllSync();
+            }
+            catch {
+                /* best-effort */
+            }
+        });
+    }
+}
+// ---------------------------------------------------------------------------
+// Pool operations
+// ---------------------------------------------------------------------------
+/**
+ * Obtain a connection for the named environment. Creates the driver and
+ * pool lazily on first call. Returns a handle that must be passed to
+ * {@link releaseConnection} when done.
+ *
+ * G-CONN-AWAIT: async drivers (pg, mysql, mssql, mongo, dynamo) return
+ * a Promise from `connect()`. We await the resolved handle before
+ * registering it in `openConnections` so identity-based lookups in
+ * `releaseConnection`/`shutdownAll` match the same object the caller
+ * holds. `Promise.resolve(x)` no-ops on the sync SQLite path.
+ */
+export async function getConnection(envName) {
+    _installShutdownHandlers();
+    let entry = _pools.get(envName);
+    if (entry === undefined) {
+        entry = await _buildPoolAsync(envName);
+        _pools.set(envName, entry);
+    }
+    const envCfg = _resolveEnvConfig(envName);
+    const resolvedCfg = await _resolveCredentials(envCfg);
+    const native = await Promise.resolve(entry.driver.connect(resolvedCfg));
+    entry.openConnections.add(native);
+    return { envName, native, driver: entry.driver };
+}
+/** Release a connection back to its pool (closes native handle). */
+export function releaseConnection(envName, conn) {
+    const entry = _pools.get(envName);
+    if (entry === undefined)
+        return;
+    if (!entry.openConnections.has(conn.native))
+        return;
+    entry.openConnections.delete(conn.native);
+    try {
+        entry.driver.close(conn.native);
+    }
+    catch {
+        /* best-effort */
+    }
+    // A5 (G-DB-AUDIT extension): emit `connection_released` so the audit
+    // trail of a schema or query call has a clean lifecycle marker —
+    // `[pool_created, schema_inspect, connection_released]` rather than
+    // just `[pool_created]`. logEvent is best-effort and silently no-ops
+    // when audit isn't enabled, so the new emit is safe in every code
+    // path that releases a pooled connection.
+    logEvent({
+        event_type: "connection_released",
+        details: { env: envName },
+    });
+}
+/**
+ * Cheap liveness check. Returns `true` on success, `false` on any error.
+ *
+ * Preference order:
+ *  1. `driver.healthCheck(native)` — Phase E drivers use engine-appropriate
+ *     probes (Mongo `ping`, DynamoDB `ListTables`, etc.) that `SELECT 1`
+ *     cannot express.
+ *  2. `driver.executeReadAsync(..., "SELECT 1", ...)` — SQL drivers.
+ *  3. `driver.executeRead(..., "SELECT 1", ...)` — legacy sync path
+ *     (SQLite, mocked test drivers).
+ */
+export async function healthCheck(envName) {
+    let conn = null;
+    try {
+        conn = await getConnection(envName);
+        const driverHealthCheck = conn.driver.healthCheck;
+        if (typeof driverHealthCheck === "function") {
+            return Boolean(await driverHealthCheck.call(conn.driver, conn.native));
+        }
+        const asyncHook = conn.driver.executeReadAsync;
+        if (typeof asyncHook === "function") {
+            const result = await asyncHook.call(conn.driver, conn.native, "SELECT 1", [], 1, 5000);
+            return result.status === "success";
+        }
+        const result = conn.driver.executeRead(conn.native, "SELECT 1", [], 1, 5000);
+        return result.status === "success";
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (conn !== null)
+            releaseConnection(envName, conn);
+    }
+}
+/**
+ * Close every pool and drop the registry. Awaits each driver's
+ * `shutdown()` so native connection pools (pg.Pool, mysql2 pool,
+ * mssql.ConnectionPool, MongoClient) are fully drained before we return.
+ */
+export async function shutdownAll() {
+    const drains = [];
+    for (const entry of _pools.values()) {
+        for (const native of [...entry.openConnections]) {
+            try {
+                entry.driver.close(native);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+        entry.openConnections.clear();
+        const shutdownFn = entry.driver.shutdown;
+        if (typeof shutdownFn === "function") {
+            try {
+                const result = shutdownFn.call(entry.driver);
+                if (result instanceof Promise) {
+                    drains.push(result.catch(() => undefined));
+                }
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    _pools.clear();
+    await Promise.all(drains);
+}
+/**
+ * Synchronous variant used from the `exit` handler (Node's `exit` event
+ * is strictly synchronous — we cannot await there). We still call each
+ * driver's `shutdown()` fire-and-forget so pool teardown starts; any
+ * rejected promises get an empty catch handler attached so they do not
+ * crash the exiting process.
+ */
+function _shutdownAllSync() {
+    for (const entry of _pools.values()) {
+        for (const native of [...entry.openConnections]) {
+            try {
+                entry.driver.close(native);
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+        entry.openConnections.clear();
+        const shutdownFn = entry.driver.shutdown;
+        if (typeof shutdownFn === "function") {
+            try {
+                const result = shutdownFn.call(entry.driver);
+                if (result instanceof Promise) {
+                    result.catch(() => undefined);
+                }
+            }
+            catch {
+                /* best-effort */
+            }
+        }
+    }
+    _pools.clear();
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+async function _buildPoolAsync(envName) {
+    const envCfg = _resolveEnvConfig(envName);
+    const driverName = _driverName(envCfg);
+    // Lazy-load the driver module (and its optional heavy dep) on first use.
+    // Imported here to avoid a static dependency cycle between connection.ts
+    // and drivers/register.ts (register.ts imports `registerDriverFactory`
+    // from this module).
+    const { ensureDriver } = await import("./drivers/register.js");
+    await ensureDriver(driverName);
+    const factory = _driverFactories.get(driverName);
+    if (factory === undefined) {
+        throw new Error(`connection: no driver factory registered for '${driverName}'. ` +
+            `Registered: [${[..._driverFactories.keys()].join(", ") || "none"}]`);
+    }
+    const driver = factory(envCfg);
+    // G-DB-AUDIT: emit `pool_created` once per environment (this function is
+    // only invoked on the first getConnection() for a given envName).
+    logEvent({
+        event_type: "pool_created",
+        details: { env: envName, driver: driverName },
+    });
+    return { envName, driver, openConnections: new Set() };
+}
+/**
+ * Resolve an environment's config. If the env is registered via
+ * `environments.registerEnvironment`, we return that; otherwise we throw
+ * a clear error.
+ *
+ * Returned shape is a plain record so driver factories can consume it
+ * without importing `EnvironmentConfig` directly. Any `extras` stored on
+ * the env record (plugin-config path: user, password, ssl, region,
+ * endpoint, url, pool, ...) are spread on top of the legacy named fields
+ * so driver-specific knobs flow through to `driver.connect()`.
+ */
+function _resolveEnvConfig(envName) {
+    const env = getEnvironment(envName);
+    const base = {
+        host: env.host,
+        port: env.port,
+        database: env.database,
+        schema: env.schema,
+        approval_mode: env.approval_mode,
+        driver: env.driver,
+    };
+    if (env.extras !== undefined) {
+        for (const [k, v] of Object.entries(env.extras)) {
+            base[k] = v;
+        }
+    }
+    return base;
+}
+function _driverName(envCfg) {
+    const d = envCfg["driver"];
+    return typeof d === "string" ? d : "postgresql";
+}
+/**
+ * Walk a resolved env config and expand credential references of the form
+ * `provider:key` into their resolved secret value. Currently handles the
+ * `env_var` provider inline (common case) and defers to `resolveSecret` for
+ * others. Plain strings with no recognized prefix pass through unchanged.
+ */
+async function _resolveCredentials(envCfg) {
+    const out = {};
+    for (const [k, v] of Object.entries(envCfg)) {
+        if (typeof v !== "string") {
+            out[k] = v;
+            continue;
+        }
+        const ref = parseCredentialRef(v);
+        if (ref === null) {
+            out[k] = v;
+            continue;
+        }
+        if (ref.provider === "env_var") {
+            const resolved = process.env[ref.key];
+            out[k] = resolved ?? v;
+            continue;
+        }
+        try {
+            const resolved = await resolveSecret(ref.key, { provider: ref.provider });
+            out[k] = resolved ?? v;
+        }
+        catch {
+            // Secret backend threw — keep the literal reference so the driver's
+            // connect() surfaces an auth error instead of silently mis-configuring.
+            out[k] = v;
+        }
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Introspection helpers (tests)
+// ---------------------------------------------------------------------------
+/** Return whether a pool exists for the given env (test helper). */
+export function _hasPool(envName) {
+    return _pools.has(envName);
+}
+/** Return the number of open connections in a pool (test helper). */
+export function _openCount(envName) {
+    return _pools.get(envName)?.openConnections.size ?? 0;
+}
+//# sourceMappingURL=connection.js.map

package/dist/connectors/db/lib/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../../src/connectors/db/lib/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAiBhF,MAAM,gBAAgB,GAA+B,IAAI,GAAG,EAAE,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,OAAsB;IAEtB,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,oBAAoB;IAClC,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AA4BD,MAAM,MAAM,GAA2B,IAAI,GAAG,EAAE,CAAC;AAEjD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,SAAS,wBAAwB;IAC/B,IAAI,kBAAkB;QAAE,OAAO;IAC/B,kBAAkB,GAAG,IAAI,CAAC;IAE1B,kEAAkE;IAClE,sEAAsE;IACtE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,IAAI,CAAC;YACH,gBAAgB,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,qEAAqE;IACrE,gEAAgE;IAChE,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACjD,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC;gBACH,gBAAgB,EAAE,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IACjD,wBAAwB,EAAE,CAAC;IAE3B,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAgB;IACjE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO;IACpD,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,0CAA0C;IAC1C,QAAQ,CAAC;QACP,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;KAC1B,CAAC,CAAC;AACL,CAAC;AAuBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,iBAAiB,GAAI,IAAI,CAAC,MAA4B,CAAC,WAAW,CAAC;QACzE,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,SAAS,GAAI,IAAI,CAAC,MAA6B,CAAC,gBAAgB,CAAC;QACvE,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CACjC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,UAAU,EACV,EAAE,EACF,CAAC,EACD,IAAI,CACL,CAAC;YACF,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,IAAI,KAAK,IAAI;YAAE,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAI,KAAK,CAAC,MAAyB,CAAC,QAAQ,CAAC;QAC7D,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB;IACvB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAI,KAAK,CAAC,MAAyB,CAAC,QAAQ,CAAC;QAC7D,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;oBAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,KAAK,UAAU,eAAe,CAAC,OAAe;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,qBAAqB;IACrB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC/D,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,iDAAiD,UAAU,KAAK;YAC9D,gBAAgB,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,yEAAyE;IACzE,kEAAkE;IAClE,QAAQ,CAAC;QACP,UAAU,EAAE,cAAc;QAC1B,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE;KAC9C,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAA4B;QACpC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,MAA+B;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,MAA+B;IAE/B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC1E,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,wEAAwE;YACxE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC;AACxD,CAAC"}