narai-primitives 2.0.0-rc.1

package/dist/connectors/db/lib/credentials.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Default credentials file location — `~/.config/wiki_db/credentials.json`.
+ * Exported as a mutable object wrapper so tests can monkeypatch it at
+ * runtime (Python tests use `monkeypatch.setattr` on the module-level
+ * `_DEFAULT_CREDS_PATH`). Direct reassignment of the exported name would
+ * not work in strict-ESM, so we expose `.path` instead.
+ */
+export declare const _DEFAULT_CREDS: {
+    path: string;
+};
+/** Abstract base class — mirrors Python's ABC + `@abstractmethod`. */
+export declare abstract class CredentialProvider {
+    /** Return `[username, password]` for the given environment. */
+    abstract get(env: string): [string, string];
+}
+/**
+ * Read credentials from a JSON file.
+ *
+ * Expected format:
+ *   {
+ *     "db-<env>": {"username": "...", "password": "..."},
+ *     ...
+ *   }
+ *
+ * Delegates the actual file reading to `@narai/credential-providers`' FileProvider
+ * so the file-mode safety check (refuses 0644+ on POSIX) and plaintext
+ * warning fire here too. Nested `db-<env>.username` / `db-<env>.password`
+ * lookups are resolved by FileProvider's dot-path traversal.
+ */
+export declare class FileCredentialProvider extends CredentialProvider {
+    private readonly _path;
+    private readonly _provider;
+    constructor(filePath: string);
+    get(env: string): [string, string];
+}
+/**
+ * Read credentials from `WIKI_DB_{ENV}_USER` / `WIKI_DB_{ENV}_PASSWORD`.
+ *
+ * Delegates to the shared `EnvVarProvider` so the env lookup logic lives
+ * in a single place.
+ */
+export declare class EnvVarCredentialProvider extends CredentialProvider {
+    private readonly _inner;
+    get(env: string): [string, string];
+}
+export interface GetCredentialsOptions {
+    /** Either "file" (default) or "env". */
+    provider?: "file" | "env";
+    /** Path override for the file provider. */
+    config?: string | null;
+}
+/**
+ * Convenience function to fetch credentials.
+ *
+ * @param env       Environment name (e.g. "dev", "prod").
+ * @param options.provider  "file" (default) or "env".
+ * @param options.config    Path override for the file provider.
+ */
+export declare function getCredentials(env: string, options?: GetCredentialsOptions): [string, string];
+//# sourceMappingURL=credentials.d.ts.map

package/dist/connectors/db/lib/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../src/connectors/db/lib/credentials.ts"],"names":[],"mappings":"AAuBA;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;CAE1B,CAAC;AAEF,sEAAsE;AACtE,8BAAsB,kBAAkB;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;CAC5C;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,QAAQ,EAAE,MAAM;IAMnB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;CAqB5C;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,kBAAkB;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8C;IAE5D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;CAgB5C;AAED,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC1B,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,qBAA0B,GAClC,CAAC,MAAM,EAAE,MAAM,CAAC,CAUlB"}

package/dist/connectors/db/lib/credentials.js

@@ -0,0 +1,117 @@
+/**
+ * credentials.ts — Credential providers for wiki_db.
+ *
+ * Thin compatibility shim: the legacy `FileCredentialProvider` /
+ * `EnvVarCredentialProvider` / `getCredentials()` surface is retained
+ * (imported by `connection.ts` and the Phase E drivers arriving later),
+ * but the implementations now delegate to the new
+ * `@narai/credential-providers` package.
+ *
+ * Contract:
+ *  - `FileCredentialProvider` reads a JSON file keyed by `db-<env>`.
+ *  - `EnvVarCredentialProvider` reads `WIKI_DB_<ENV>_USER` / `..._PASSWORD`.
+ *  - `getCredentials(env, {provider, config})` is the convenience dispatcher.
+ *
+ * The return type is `[string, string]` (username, password) — unchanged
+ * from the Python port so existing tests pass verbatim.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { FileProvider, EnvVarProvider } from "@narai/credential-providers";
+/**
+ * Default credentials file location — `~/.config/wiki_db/credentials.json`.
+ * Exported as a mutable object wrapper so tests can monkeypatch it at
+ * runtime (Python tests use `monkeypatch.setattr` on the module-level
+ * `_DEFAULT_CREDS_PATH`). Direct reassignment of the exported name would
+ * not work in strict-ESM, so we expose `.path` instead.
+ */
+export const _DEFAULT_CREDS = {
+    path: path.join(os.homedir(), ".config", "wiki_db", "credentials.json"),
+};
+/** Abstract base class — mirrors Python's ABC + `@abstractmethod`. */
+export class CredentialProvider {
+}
+/**
+ * Read credentials from a JSON file.
+ *
+ * Expected format:
+ *   {
+ *     "db-<env>": {"username": "...", "password": "..."},
+ *     ...
+ *   }
+ *
+ * Delegates the actual file reading to `@narai/credential-providers`' FileProvider
+ * so the file-mode safety check (refuses 0644+ on POSIX) and plaintext
+ * warning fire here too. Nested `db-<env>.username` / `db-<env>.password`
+ * lookups are resolved by FileProvider's dot-path traversal.
+ */
+export class FileCredentialProvider extends CredentialProvider {
+    _path;
+    _provider;
+    constructor(filePath) {
+        super();
+        this._path = filePath;
+        this._provider = new FileProvider({ path: filePath });
+    }
+    get(env) {
+        if (!fs.existsSync(this._path)) {
+            const err = new Error(`Credentials file not found: ${this._path}`);
+            err.name = "CredentialsFileNotFoundError";
+            err.code = "ENOENT";
+            throw err;
+        }
+        const key = `db-${env}`;
+        const user = this._provider.getSecretSync(`${key}.username`);
+        const password = this._provider.getSecretSync(`${key}.password`);
+        if (user === null || password === null) {
+            const err = new Error(`No credentials found for environment '${env}' (key '${key}')`);
+            err.name = "EnvironmentNotConfiguredError";
+            throw err;
+        }
+        return [user, password];
+    }
+}
+/**
+ * Read credentials from `WIKI_DB_{ENV}_USER` / `WIKI_DB_{ENV}_PASSWORD`.
+ *
+ * Delegates to the shared `EnvVarProvider` so the env lookup logic lives
+ * in a single place.
+ */
+export class EnvVarCredentialProvider extends CredentialProvider {
+    _inner = new EnvVarProvider({ prefix: "WIKI_DB_" });
+    get(env) {
+        const envUpper = env.toUpperCase();
+        const user = this._inner.getSecretSync(`${envUpper}_USER`);
+        const password = this._inner.getSecretSync(`${envUpper}_PASSWORD`);
+        if (user === null || password === null) {
+            const missing = [];
+            if (user === null)
+                missing.push(`WIKI_DB_${envUpper}_USER`);
+            if (password === null)
+                missing.push(`WIKI_DB_${envUpper}_PASSWORD`);
+            const err = new Error(`Missing environment variable(s): ${missing.join(", ")}`);
+            err.name = "EnvironmentVariableMissingError";
+            throw err;
+        }
+        return [user, password];
+    }
+}
+/**
+ * Convenience function to fetch credentials.
+ *
+ * @param env       Environment name (e.g. "dev", "prod").
+ * @param options.provider  "file" (default) or "env".
+ * @param options.config    Path override for the file provider.
+ */
+export function getCredentials(env, options = {}) {
+    const provider = options.provider ?? "file";
+    const config = options.config ?? null;
+    if (provider === "env") {
+        return new EnvVarCredentialProvider().get(env);
+    }
+    // default: file
+    const p = config !== null ? config : _DEFAULT_CREDS.path;
+    return new FileCredentialProvider(p).get(env);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/connectors/db/lib/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../../src/connectors/db/lib/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC;CACxE,CAAC;AAEF,sEAAsE;AACtE,MAAM,OAAgB,kBAAkB;CAGvC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC3C,KAAK,CAAS;IACd,SAAS,CAAe;IAEzC,YAAY,QAAgB;QAC1B,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAEQ,GAAG,CAAC,GAAW;QACtB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,+BAA+B,IAAI,CAAC,KAAK,EAAE,CACf,CAAC;YAC/B,GAAG,CAAC,IAAI,GAAG,8BAA8B,CAAC;YAC1C,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;YACpB,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC;QACjE,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,yCAAyC,GAAG,WAAW,GAAG,IAAI,CAC/D,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,+BAA+B,CAAC;YAC3C,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,kBAAkB;IAC7C,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAE5D,GAAG,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,QAAQ,WAAW,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,WAAW,QAAQ,OAAO,CAAC,CAAC;YAC5D,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,WAAW,QAAQ,WAAW,CAAC,CAAC;YACpE,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,iCAAiC,CAAC;YAC7C,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1B,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IAEtC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,IAAI,wBAAwB,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,gBAAgB;IAChB,MAAM,CAAC,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC;IACzD,OAAO,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC"}

package/dist/connectors/db/lib/drivers/base.d.ts

@@ -0,0 +1,83 @@
+/**
+ * drivers/base.ts — Abstract base class for database drivers.
+ *
+ * `Column` and `Table` carry metadata with a `toDict()` helper.
+ * `DatabaseDriver` exposes `connect`, `executeRead`, `getSchema`, `close`,
+ * and `classifyOperation`.
+ *
+ * G-DB-1: `classifyOperation(query)` is the driver-level hook that lets
+ * non-relational drivers (MongoDB, DynamoDB) classify their JSON envelope
+ * queries (V2.0 vocab: `db.users.insertOne({...})` → WRITE; `find` →
+ * READ; `deleteMany` → DELETE) without going through the SQL keyword
+ * path. SQL drivers delegate to `classifySqlKeywords` from `policy.ts`.
+ */
+import type { OperationType } from "../policy.js";
+/** Represents a database column. */
+export declare class Column {
+    readonly name: string;
+    readonly data_type: string;
+    readonly nullable: boolean;
+    readonly is_primary_key: boolean;
+    readonly default: string | null;
+    constructor(opts: {
+        name: string;
+        data_type: string;
+        nullable?: boolean;
+        is_primary_key?: boolean;
+        default?: string | null;
+    });
+    toDict(): {
+        name: string;
+        data_type: string;
+        nullable: boolean;
+        is_primary_key: boolean;
+        default: string | null;
+    };
+}
+/** Represents a database table with its columns. */
+export declare class Table {
+    readonly name: string;
+    readonly schema: string;
+    readonly columns: Column[];
+    constructor(opts: {
+        name: string;
+        schema?: string;
+        columns?: Column[];
+    });
+    toDict(): {
+        name: string;
+        schema: string;
+        columns: ReturnType<Column["toDict"]>[];
+    };
+}
+export interface ExecuteReadResult {
+    status: "success" | "error";
+    rows?: Record<string, unknown>[];
+    row_count?: number;
+    columns?: string[];
+    execution_time_ms: number;
+    truncated?: boolean;
+    error_code?: string;
+    error?: string;
+}
+/** Abstract base for all database drivers. */
+export declare abstract class DatabaseDriver {
+    /** Create a connection to the database. */
+    abstract connect(envConfig: Record<string, unknown>): unknown;
+    /** Execute a read query. Returns structured result dict. */
+    abstract executeRead(conn: unknown, query: string, params?: unknown[] | null, maxRows?: number, timeoutMs?: number): ExecuteReadResult;
+    /** Get schema information (tables + columns). */
+    abstract getSchema(conn: unknown, schemaName?: string, tableFilter?: string | null): Table[];
+    /** Close a connection. */
+    abstract close(conn: unknown): void;
+    /**
+     * Classify a query string by its operation kind (V2.0 vocab:
+     * read/write/delete/admin/privilege).
+     *
+     * SQL drivers delegate to `classifySqlKeywords`. Document-store drivers
+     * override with envelope-aware mapping. Default-deny: unknown verbs
+     * classify as `"admin"` (most restrictive). Throws on empty input.
+     */
+    abstract classifyOperation(query: string): OperationType;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/connectors/db/lib/drivers/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../src/connectors/db/lib/drivers/base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,oCAAoC;AACpC,qBAAa,MAAM;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;gBAG9B,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB;IASH,MAAM,IAAI;QACR,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAO,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB;CASF;AAED,oDAAoD;AACpD,qBAAa,KAAK;IAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAEf,IAAI,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB;IAMD,MAAM,IAAI;QACR,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;KACzC;CAOF;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,8BAAsB,cAAc;IAClC,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IAE7D,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAClB,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,iBAAiB;IAEpB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,CAChB,IAAI,EAAE,OAAO,EACb,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,KAAK,EAAE;IAEV,0BAA0B;IAC1B,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa;CACzD"}

package/dist/connectors/db/lib/drivers/base.js

@@ -0,0 +1,46 @@
+/** Represents a database column. */
+export class Column {
+    name;
+    data_type;
+    nullable;
+    is_primary_key;
+    default;
+    constructor(opts) {
+        this.name = opts.name;
+        this.data_type = opts.data_type;
+        this.nullable = opts.nullable ?? true;
+        this.is_primary_key = opts.is_primary_key ?? false;
+        this.default = opts.default ?? null;
+    }
+    toDict() {
+        return {
+            name: this.name,
+            data_type: this.data_type,
+            nullable: this.nullable,
+            is_primary_key: this.is_primary_key,
+            default: this.default,
+        };
+    }
+}
+/** Represents a database table with its columns. */
+export class Table {
+    name;
+    schema;
+    columns;
+    constructor(opts) {
+        this.name = opts.name;
+        this.schema = opts.schema ?? "";
+        this.columns = opts.columns ?? [];
+    }
+    toDict() {
+        return {
+            name: this.name,
+            schema: this.schema,
+            columns: this.columns.map((c) => c.toDict()),
+        };
+    }
+}
+/** Abstract base for all database drivers. */
+export class DatabaseDriver {
+}
+//# sourceMappingURL=base.js.map

package/dist/connectors/db/lib/drivers/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../src/connectors/db/lib/drivers/base.ts"],"names":[],"mappings":"AAeA,oCAAoC;AACpC,MAAM,OAAO,MAAM;IACR,IAAI,CAAS;IACb,SAAS,CAAS;IAClB,QAAQ,CAAU;IAClB,cAAc,CAAU;IACxB,OAAO,CAAgB;IAEhC,YACE,IAMC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,MAAM;QAOJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;CACF;AAED,oDAAoD;AACpD,MAAM,OAAO,KAAK;IACP,IAAI,CAAS;IACb,MAAM,CAAS;IACf,OAAO,CAAW;IAE3B,YAAY,IAIX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,MAAM;QAKJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC7C,CAAC;IACJ,CAAC;CACF;AAaD,8CAA8C;AAC9C,MAAM,OAAgB,cAAc;CAgCnC"}

package/dist/connectors/db/lib/drivers/dynamodb.d.ts

@@ -0,0 +1,108 @@
+import { DatabaseDriver, Table, type ExecuteReadResult } from "./base.js";
+import { OperationType } from "../policy.js";
+/**
+ * G-DYNAMO-PARSE-ERROR: distinguishes a malformed envelope JSON from
+ * the default-deny "ADMIN" fall-through. `Policy.checkQuery` converts
+ * thrown errors into `{ decision: "deny", reason: <message> }` so this
+ * surfaces as a helpful diagnostic instead of "ADMIN statements are
+ * never allowed".
+ */
+export declare class DynamoEnvelopeParseError extends Error {
+    constructor(message: string);
+}
+interface DynamoAttributeValue {
+    S?: string;
+    N?: string;
+    BOOL?: boolean;
+    NULL?: boolean;
+    L?: DynamoAttributeValue[];
+    M?: Record<string, DynamoAttributeValue>;
+}
+type DynamoItem = Record<string, DynamoAttributeValue>;
+interface ListTablesOutput {
+    TableNames?: string[];
+    LastEvaluatedTableName?: string;
+}
+interface DescribeTableOutput {
+    Table?: {
+        TableName?: string;
+        KeySchema?: {
+            AttributeName: string;
+            KeyType: "HASH" | "RANGE";
+        }[];
+        AttributeDefinitions?: {
+            AttributeName: string;
+            AttributeType: string;
+        }[];
+        ItemCount?: number;
+        CreationDateTime?: Date;
+    };
+}
+interface QueryScanOutput {
+    Items?: DynamoItem[];
+    Count?: number;
+    LastEvaluatedKey?: DynamoItem;
+    ConsumedCapacity?: unknown;
+}
+interface GetOutput {
+    Item?: DynamoItem;
+    ConsumedCapacity?: unknown;
+}
+interface DynamoClient {
+    send(cmd: unknown): Promise<unknown>;
+    destroy(): void;
+}
+interface DynamoCommandCtor<I, O> {
+    new (input: I): {
+        __output__?: O;
+    };
+}
+interface DynamoModule {
+    DynamoDBClient: new (config: Record<string, unknown>) => DynamoClient;
+    ListTablesCommand: DynamoCommandCtor<Record<string, unknown>, ListTablesOutput>;
+    DescribeTableCommand: DynamoCommandCtor<{
+        TableName: string;
+    }, DescribeTableOutput>;
+    GetItemCommand: DynamoCommandCtor<{
+        TableName: string;
+        Key: DynamoItem;
+    }, GetOutput>;
+    QueryCommand: DynamoCommandCtor<Record<string, unknown>, QueryScanOutput>;
+    ScanCommand: DynamoCommandCtor<Record<string, unknown>, QueryScanOutput>;
+}
+interface DynamoHandle {
+    client: DynamoClient;
+    module: DynamoModule;
+}
+export declare class DynamoDriver extends DatabaseDriver {
+    private _dynamoModule;
+    private _client;
+    private _clientPromise;
+    private _loadDynamo;
+    private _ensureClient;
+    connect(envConfig: Record<string, unknown>): Promise<DynamoHandle>;
+    executeRead(_conn: unknown, _query: string, _params?: unknown[] | null, _maxRows?: number, _timeoutMs?: number): ExecuteReadResult;
+    executeReadAsync(conn: unknown, query: string, _params?: unknown[] | null, maxRows?: number, _timeoutMs?: number): Promise<ExecuteReadResult>;
+    getSchema(_conn: unknown, _schemaName?: string, _tableFilter?: string | null): Table[];
+    getSchemaAsync(conn: unknown, schemaName?: string, tableFilter?: string | null): Promise<Table[]>;
+    /**
+     * No-op: DynamoDB is HTTP-based with a shared client. {@link shutdown}
+     * destroys the client at process teardown.
+     */
+    close(_conn: unknown): void;
+    closeAsync(_conn: unknown): Promise<void>;
+    /** Per-driver health check via `ListTablesCommand` with Limit=1. */
+    healthCheck(conn: unknown): Promise<boolean>;
+    /**
+     * G-DB-1: classify a DynamoDB op for the policy gate (V2.0 vocab).
+     *
+     * Accepts the JSON envelope `{table, op, ...}`, AWS SDK command names
+     * like `PutItemCommand`, and dot-notation invocations. Unknown ops
+     * default to ADMIN.
+     */
+    classifyOperation(query: string): OperationType;
+    /** Destroy the shared DynamoDBClient. */
+    shutdown(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=dynamodb.d.ts.map

package/dist/connectors/db/lib/drivers/dynamodb.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamodb.d.ts","sourceRoot":"","sources":["../../../../../src/connectors/db/lib/drivers/dynamodb.ts"],"names":[],"mappings":"AA8BA,OAAO,EAEL,cAAc,EACd,KAAK,EACL,KAAK,iBAAiB,EACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AA2CD,UAAU,oBAAoB;IAC5B,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAC3B,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC1C;AACD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAEvD,UAAU,gBAAgB;IACxB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AACD,UAAU,mBAAmB;IAC3B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,EAAE,CAAC;QACnE,oBAAoB,CAAC,EAAE;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,IAAI,CAAC;KACzB,CAAC;CACH;AACD,UAAU,eAAe;IACvB,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,UAAU,CAAC;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AACD,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,UAAU,YAAY;IACpB,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC;CACjB;AACD,UAAU,iBAAiB,CAAC,CAAC,EAAE,CAAC;IAC9B,KAAK,KAAK,EAAE,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;CACpC;AACD,UAAU,YAAY;IACpB,cAAc,EAAE,KAAK,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,YAAY,CAAC;IACtE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAChF,oBAAoB,EAAE,iBAAiB,CACrC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EACrB,mBAAmB,CACpB,CAAC;IACF,cAAc,EAAE,iBAAiB,CAC/B;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAA;KAAE,EACtC,SAAS,CACV,CAAC;IACF,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;IAC1E,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;CAC1E;AA6BD,UAAU,YAAY;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,qBAAa,YAAa,SAAQ,cAAc;IAC9C,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,cAAc,CAAsC;YAE9C,WAAW;IAoBzB,OAAO,CAAC,aAAa;IA+BZ,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IASlE,WAAW,CAClB,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,OAAO,EAAE,GAAG,IAAW,EAChC,QAAQ,GAAE,MAAa,EACvB,UAAU,GAAE,MAAe,GAC1B,iBAAiB;IAUd,gBAAgB,CACpB,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,OAAO,EAAE,GAAG,IAAW,EAChC,OAAO,GAAE,MAAa,EACtB,UAAU,GAAE,MAAe,GAC1B,OAAO,CAAC,iBAAiB,CAAC;IAwIpB,SAAS,CAChB,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,MAAW,EACxB,YAAY,GAAE,MAAM,GAAG,IAAW,GACjC,KAAK,EAAE;IAIJ,cAAc,CAClB,IAAI,EAAE,OAAO,EACb,UAAU,GAAE,MAAW,EACvB,WAAW,GAAE,MAAM,GAAG,IAAW,GAChC,OAAO,CAAC,KAAK,EAAE,CAAC;IAgEnB;;;OAGG;IACM,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI9B,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,oEAAoE;IAC9D,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlD;;;;;;OAMG;IACM,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa;IA2CxD,yCAAyC;IACnC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAYhC"}