patchwork-os 0.2.0-beta.6.canary.21 → 0.2.0-beta.6.canary.22

package/dist/connectors/mongodb.js

@@ -0,0 +1,455 @@
+/**
+ * MongoDB connector — direct-connection-string database connector.
+ *
+ * Stores a MongoDB connection URI ("mongodb://" or "mongodb+srv://") in
+ * secure token storage and exposes a small read-only query surface:
+ * listDatabases, listCollections, describeCollection, find, aggregate,
+ * count.
+ *
+ * The `mongodb` driver is loaded lazily via dynamic import so callers
+ * without the package installed see a friendly message instead of a
+ * module-resolution crash at startup. Tests inject a fake module via
+ * `__setMongoModuleForTest`.
+ *
+ * HTTP routes (wired centrally in src/connectorRoutes.ts):
+ *   POST   /connections/mongodb/connect    — body: { connectionString, database? }
+ *   POST   /connections/mongodb/test       — ping admin
+ *   DELETE /connections/mongodb            — disconnect + delete token
+ */
+import { BaseConnector, } from "./baseConnector.js";
+import { escHtml } from "./htmlEscape.js";
+import { deleteSecretJsonSync, getSecretJsonSync, storeSecretJsonSync, } from "./tokenStorage.js";
+let _injectedModule = null;
+let _modulePromise = null;
+/** Inject a fake `mongodb` module for hermetic tests. */
+export function __setMongoModuleForTest(mod) {
+    _injectedModule = mod;
+    _modulePromise = null;
+    // Reset the singleton client so a re-injected fake takes effect.
+    if (_client) {
+        void _client.close().catch(() => undefined);
+        _client = null;
+    }
+}
+async function loadMongoModule() {
+    if (_injectedModule)
+        return _injectedModule;
+    if (_modulePromise)
+        return _modulePromise;
+    _modulePromise = (async () => {
+        try {
+            // @ts-expect-error optional peer dep; resolved at runtime
+            const mod = (await import("mongodb"));
+            return mod;
+        }
+        catch {
+            throw new Error("MongoDB driver not installed. Run: npm install mongodb");
+        }
+    })();
+    return _modulePromise;
+}
+// ── Singleton client ─────────────────────────────────────────────────────────
+let _client = null;
+let _clientUri = null;
+async function getClient(uri) {
+    if (_client && _clientUri === uri)
+        return _client;
+    if (_client && _clientUri !== uri) {
+        try {
+            await _client.close();
+        }
+        catch {
+            // Best-effort close
+        }
+        _client = null;
+    }
+    const mod = await loadMongoModule();
+    const client = new mod.MongoClient(uri);
+    await client.connect();
+    _client = client;
+    _clientUri = uri;
+    return client;
+}
+async function disconnectClient() {
+    if (!_client)
+        return;
+    try {
+        await _client.close();
+    }
+    catch {
+        // Best-effort
+    }
+    _client = null;
+    _clientUri = null;
+}
+// ── Token persistence ────────────────────────────────────────────────────────
+const PROVIDER = "mongodb";
+export function loadTokens() {
+    const envUri = process.env.MONGODB_URI;
+    if (envUri) {
+        return {
+            connectionString: envUri,
+            database: process.env.MONGODB_DATABASE,
+            connected_at: new Date().toISOString(),
+        };
+    }
+    return getSecretJsonSync(PROVIDER);
+}
+export function saveTokens(tokens) {
+    storeSecretJsonSync(PROVIDER, tokens);
+}
+export function clearTokens() {
+    deleteSecretJsonSync(PROVIDER);
+}
+// ── Connection string validation ─────────────────────────────────────────────
+function validateConnectionString(uri) {
+    if (typeof uri !== "string" || uri.length === 0) {
+        throw new Error("connectionString must be a non-empty string");
+    }
+    if (!/^mongodb(\+srv)?:\/\//i.test(uri)) {
+        throw new Error("connectionString must start with mongodb:// or mongodb+srv://");
+    }
+    // Catch obvious tampering up front (control chars, newlines).
+    if (/[\x00-\x1f]/.test(uri)) {
+        throw new Error("connectionString contains control characters");
+    }
+    return uri;
+}
+// ── Read-only operation guard ────────────────────────────────────────────────
+const FORBIDDEN_KEY_RE = /^\$(where|function|accumulator|out|merge)$/i;
+/**
+ * Walk a filter/projection/pipeline value and reject any object key that
+ * matches dangerous Mongo operators at any depth:
+ *
+ *   $where       — server-side JS evaluation
+ *   $function    — server-side JS in aggregation
+ *   $accumulator — server-side JS accumulator
+ *   $out         — pipeline stage that writes a collection
+ *   $merge       — pipeline stage that writes/upserts into a collection
+ *
+ * Returns true when the input is safe; throws otherwise so callers don't
+ * have to remember to check a boolean.
+ */
+export function isReadOnlyMongoOp(value) {
+    walk(value, 0);
+    return true;
+}
+function walk(value, depth) {
+    if (depth > 64) {
+        throw new Error("MongoDB filter/pipeline nested too deeply");
+    }
+    if (value === null || value === undefined)
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            walk(item, depth + 1);
+        return;
+    }
+    if (typeof value !== "object")
+        return;
+    for (const key of Object.keys(value)) {
+        if (FORBIDDEN_KEY_RE.test(key)) {
+            throw new Error(`MongoDB operator not allowed (read-only guard): ${key}`);
+        }
+        walk(value[key], depth + 1);
+    }
+}
+// ── Connector class ──────────────────────────────────────────────────────────
+export class MongoConnector extends BaseConnector {
+    providerName = "mongodb";
+    getOAuthConfig() {
+        return null; // Direct connection string, no OAuth.
+    }
+    async authenticate() {
+        const tokens = loadTokens();
+        if (!tokens) {
+            throw new Error("MongoDB not connected. POST /connections/mongodb/connect first.");
+        }
+        return { token: tokens.connectionString };
+    }
+    getStatus() {
+        const tokens = loadTokens();
+        return {
+            id: PROVIDER,
+            status: tokens ? "connected" : "disconnected",
+            lastSync: tokens?.connected_at,
+            workspace: tokens?.database,
+        };
+    }
+    async healthCheck() {
+        const tokens = loadTokens();
+        if (!tokens) {
+            return {
+                ok: false,
+                error: {
+                    code: "auth_expired",
+                    message: "MongoDB not connected",
+                    retryable: false,
+                },
+            };
+        }
+        try {
+            const client = await getClient(tokens.connectionString);
+            await client.db("admin").command({ ping: 1 });
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: this.normalizeError(err) };
+        }
+    }
+    normalizeError(error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const codeRaw = error?.code;
+        const code = typeof codeRaw === "number" ? codeRaw : undefined;
+        const name = error?.name;
+        // Network errors — check name first since some have no numeric code.
+        if (name === "MongoNetworkError" ||
+            name === "MongoServerSelectionError" ||
+            name === "MongoNetworkTimeoutError" ||
+            /ECONNREFUSED|ENOTFOUND|ETIMEDOUT|network/i.test(message)) {
+            return {
+                code: "network_error",
+                message,
+                providerDetail: error,
+                retryable: true,
+            };
+        }
+        switch (code) {
+            case 18: // AuthenticationFailed
+                return {
+                    code: "auth_expired",
+                    message,
+                    providerDetail: error,
+                    retryable: false,
+                    suggestedAction: "Re-connect MongoDB via POST /connections/mongodb/connect",
+                };
+            case 13: // Unauthorized
+                return {
+                    code: "permission_denied",
+                    message,
+                    providerDetail: error,
+                    retryable: false,
+                };
+            case 11: // UserNotFound
+            case 26: // NamespaceNotFound
+                return {
+                    code: "not_found",
+                    message,
+                    providerDetail: error,
+                    retryable: false,
+                };
+            default:
+                return {
+                    code: "provider_error",
+                    message,
+                    providerDetail: error,
+                    retryable: false,
+                };
+        }
+    }
+    async disconnect() {
+        await disconnectClient();
+        clearTokens();
+        this.auth = null;
+    }
+}
+// ── Singleton ────────────────────────────────────────────────────────────────
+let _connector = null;
+export function mongoConnector() {
+    if (!_connector)
+        _connector = new MongoConnector();
+    return _connector;
+}
+// ── Read-only tool surface ───────────────────────────────────────────────────
+const DEFAULT_LIMIT = 100;
+const MAX_LIMIT = 1000;
+function clampLimit(n) {
+    if (typeof n !== "number" || !Number.isFinite(n) || n <= 0) {
+        return DEFAULT_LIMIT;
+    }
+    return Math.min(Math.floor(n), MAX_LIMIT);
+}
+async function activeDb(name) {
+    const tokens = loadTokens();
+    if (!tokens) {
+        throw new Error("MongoDB not connected. POST /connections/mongodb/connect first.");
+    }
+    const client = await getClient(tokens.connectionString);
+    return client.db(name);
+}
+export async function listDatabases() {
+    const tokens = loadTokens();
+    if (!tokens) {
+        throw new Error("MongoDB not connected");
+    }
+    const client = await getClient(tokens.connectionString);
+    const res = await client.db().admin().listDatabases();
+    return (res.databases ?? []).map((d) => d.name);
+}
+export async function listCollections(database) {
+    if (!database)
+        throw new Error("database is required");
+    const db = await activeDb(database);
+    const rows = await db.listCollections({}, { nameOnly: true }).toArray();
+    return rows.map((r) => r.name);
+}
+export async function describeCollection(database, collection) {
+    if (!database)
+        throw new Error("database is required");
+    if (!collection)
+        throw new Error("collection is required");
+    const db = await activeDb(database);
+    const col = db.collection(collection);
+    const [sample, indexes] = await Promise.all([col.findOne({}), col.indexes()]);
+    return { sample, indexes };
+}
+export async function find(database, collection, filter = {}, options = {}) {
+    if (!database)
+        throw new Error("database is required");
+    if (!collection)
+        throw new Error("collection is required");
+    isReadOnlyMongoOp(filter);
+    if (options.projection)
+        isReadOnlyMongoOp(options.projection);
+    const db = await activeDb(database);
+    const cursor = db.collection(collection).find(filter, {
+        projection: options.projection,
+        limit: clampLimit(options.limit),
+    });
+    return cursor.toArray();
+}
+const FORBIDDEN_STAGE_RE = /^\$(out|merge|function|where|accumulator)$/i;
+function rejectForbiddenStages(pipeline) {
+    for (const stage of pipeline) {
+        if (!stage || typeof stage !== "object")
+            continue;
+        for (const key of Object.keys(stage)) {
+            if (FORBIDDEN_STAGE_RE.test(key)) {
+                throw new Error(`MongoDB aggregation stage not allowed (read-only guard): ${key}`);
+            }
+        }
+    }
+}
+export async function aggregate(database, collection, pipeline, limit = DEFAULT_LIMIT) {
+    if (!database)
+        throw new Error("database is required");
+    if (!collection)
+        throw new Error("collection is required");
+    if (!Array.isArray(pipeline))
+        throw new Error("pipeline must be an array");
+    rejectForbiddenStages(pipeline);
+    isReadOnlyMongoOp(pipeline);
+    const cappedLimit = clampLimit(limit);
+    const capped = [...pipeline, { $limit: cappedLimit }];
+    const db = await activeDb(database);
+    return db.collection(collection).aggregate(capped).toArray();
+}
+export async function count(database, collection, filter) {
+    if (!database)
+        throw new Error("database is required");
+    if (!collection)
+        throw new Error("collection is required");
+    const db = await activeDb(database);
+    const col = db.collection(collection);
+    if (!filter || Object.keys(filter).length === 0) {
+        return col.estimatedDocumentCount();
+    }
+    isReadOnlyMongoOp(filter);
+    return col.countDocuments(filter);
+}
+function jsonResult(status, payload) {
+    return {
+        status,
+        contentType: "application/json",
+        body: JSON.stringify(payload),
+    };
+}
+/**
+ * POST /connections/mongodb/connect
+ * Body: { connectionString: string, database?: string }
+ *
+ * Validates by issuing a ping. On success persists the credential.
+ */
+export async function handleMongoConnect(body) {
+    let connectionString;
+    let database;
+    try {
+        const parsed = (body ?? {});
+        connectionString = validateConnectionString(parsed.connectionString);
+        if (parsed.database !== undefined) {
+            if (typeof parsed.database !== "string") {
+                throw new Error("database must be a string");
+            }
+            database = parsed.database;
+        }
+    }
+    catch (err) {
+        return jsonResult(400, {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    // Verify by pinging admin before persisting.
+    try {
+        const client = await getClient(connectionString);
+        await client.db("admin").command({ ping: 1 });
+    }
+    catch (err) {
+        // Close the failed client so a retry uses fresh state.
+        await disconnectClient();
+        return jsonResult(400, {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    const tokens = {
+        connectionString,
+        database,
+        connected_at: new Date().toISOString(),
+    };
+    saveTokens(tokens);
+    return jsonResult(200, {
+        ok: true,
+        status: mongoConnector().getStatus(),
+    });
+}
+/**
+ * POST /connections/mongodb/test — re-ping the stored connection.
+ */
+export async function handleMongoTest() {
+    const tokens = loadTokens();
+    if (!tokens) {
+        return jsonResult(400, { ok: false, error: "MongoDB not connected" });
+    }
+    try {
+        const client = await getClient(tokens.connectionString);
+        await client.db("admin").command({ ping: 1 });
+        return jsonResult(200, { ok: true, message: "connected" });
+    }
+    catch (err) {
+        return jsonResult(400, {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/**
+ * DELETE /connections/mongodb — close client, drop token.
+ */
+export async function handleMongoDisconnect() {
+    await mongoConnector().disconnect();
+    return jsonResult(200, { ok: true });
+}
+/**
+ * Optional HTML status page parity with other connectors. Not wired by
+ * default — exported for symmetry should the router need it.
+ */
+export function renderMongoStatusHtml() {
+    const status = mongoConnector().getStatus();
+    return {
+        status: 200,
+        contentType: "text/html",
+        body: `<html><body><h2>MongoDB</h2><pre>${escHtml(JSON.stringify(status, null, 2))}</pre></body></html>`,
+    };
+}
+//# sourceMappingURL=mongodb.js.map

package/dist/connectors/mongodb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongodb.js","sourceRoot":"","sources":["../../src/connectors/mongodb.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAEL,aAAa,GAId,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AA8D3B,IAAI,eAAe,GAA2B,IAAI,CAAC;AACnD,IAAI,cAAc,GAAoC,IAAI,CAAC;AAE3D,yDAAyD;AACzD,MAAM,UAAU,uBAAuB,CAAC,GAA2B;IACjE,eAAe,GAAG,GAAG,CAAC;IACtB,cAAc,GAAG,IAAI,CAAC;IACtB,iEAAiE;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,IAAI,CAAC;YACH,0DAA0D;YAC1D,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAA+B,CAAC;YACpE,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,gFAAgF;AAEhF,IAAI,OAAO,GAA2B,IAAI,CAAC;AAC3C,IAAI,UAAU,GAAkB,IAAI,CAAC;AAErC,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,IAAI,OAAO,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IAClD,IAAI,OAAO,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,OAAO,GAAG,MAAM,CAAC;IACjB,UAAU,GAAG,GAAG,CAAC;IACjB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,GAAG,IAAI,CAAC;IACf,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,gFAAgF;AAEhF,MAAM,QAAQ,GAAG,SAAS,CAAC;AAE3B,MAAM,UAAU,UAAU;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,gBAAgB,EAAE,MAAM;YACxB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACtC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAc,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,gFAAgF;AAEhF,SAAS,wBAAwB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,8DAA8D;IAC9D,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,EAAE,CAAC;QAChE,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAE,KAAiC,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,cAAe,SAAQ,aAAa;IACtC,YAAY,GAAG,SAAS,CAAC;IAExB,cAAc;QACtB,OAAO,IAAI,CAAC,CAAC,sCAAsC;IACrD,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc;YAC7C,QAAQ,EAAE,MAAM,EAAE,YAAY;YAC9B,SAAS,EAAE,MAAM,EAAE,QAAQ;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,uBAAuB;oBAChC,SAAS,EAAE,KAAK;iBACjB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAc;QAC3B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,OAAO,GAAI,KAA4B,EAAE,IAAI,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,MAAM,IAAI,GAAI,KAA4B,EAAE,IAAI,CAAC;QAEjD,qEAAqE;QACrE,IACE,IAAI,KAAK,mBAAmB;YAC5B,IAAI,KAAK,2BAA2B;YACpC,IAAI,KAAK,0BAA0B;YACnC,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,EACzD,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,OAAO;gBACP,cAAc,EAAE,KAAK;gBACrB,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAED,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,EAAE,EAAE,uBAAuB;gBAC9B,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO;oBACP,cAAc,EAAE,KAAK;oBACrB,SAAS,EAAE,KAAK;oBAChB,eAAe,EACb,0DAA0D;iBAC7D,CAAC;YACJ,KAAK,EAAE,EAAE,eAAe;gBACtB,OAAO;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO;oBACP,cAAc,EAAE,KAAK;oBACrB,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,KAAK,EAAE,CAAC,CAAC,eAAe;YACxB,KAAK,EAAE,EAAE,oBAAoB;gBAC3B,OAAO;oBACL,IAAI,EAAE,WAAW;oBACjB,OAAO;oBACP,cAAc,EAAE,KAAK;oBACrB,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ;gBACE,OAAO;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO;oBACP,cAAc,EAAE,KAAK;oBACrB,SAAS,EAAE,KAAK;iBACjB,CAAC;QACN,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,gBAAgB,EAAE,CAAC;QACzB,WAAW,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,gFAAgF;AAEhF,IAAI,UAAU,GAA0B,IAAI,CAAC;AAC7C,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC,UAAU;QAAE,UAAU,GAAG,IAAI,cAAc,EAAE,CAAC;IACnD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAEhF,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACxE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,UAAkB;IAElB,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,QAAgB,EAChB,UAAkB,EAClB,SAAkC,EAAE,EACpC,UAAuB,EAAE;IAEzB,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3D,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,OAAO,CAAC,UAAU;QAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;QACpD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAEzE,SAAS,qBAAqB,CAAC,QAAwC;IACrE,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,4DAA4D,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,UAAkB,EAClB,QAAwC,EACxC,KAAK,GAAG,aAAa;IAErB,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3E,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAChC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,QAAgB,EAChB,UAAkB,EAClB,MAAgC;IAEhC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,GAAG,CAAC,sBAAsB,EAAE,CAAC;IACtC,CAAC;IACD,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAWD,SAAS,UAAU,CAAC,MAAc,EAAE,OAAgB;IAClD,OAAO;QACL,MAAM;QACN,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAa;IAEb,IAAI,gBAAwB,CAAC;IAC7B,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAGzB,CAAC;QACF,gBAAgB,GAAG,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,GAAG,EAAE;YACrB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,MAAM,gBAAgB,EAAE,CAAC;QACzB,OAAO,UAAU,CAAC,GAAG,EAAE;YACrB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,gBAAgB;QAChB,QAAQ;QACR,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC;IACF,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,UAAU,CAAC,GAAG,EAAE;QACrB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,cAAc,EAAE,CAAC,SAAS,EAAE;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,UAAU,CAAC,GAAG,EAAE;YACrB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,cAAc,EAAE,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC,SAAS,EAAE,CAAC;IAC5C,OAAO;QACL,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,WAAW;QACxB,IAAI,EAAE,oCAAoC,OAAO,CAC/C,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChC,sBAAsB;KACxB,CAAC;AACJ,CAAC"}

package/dist/connectors/postgres.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Postgres connector — read-only SQL access via the `pg` driver.
+ *
+ * Auth: connection string OR discrete host/port/database/user/password.
+ *   - Stored: getSecretJsonSync("postgres") → PostgresTokens
+ *
+ * Tools: listTables, describeTable, query (SELECT-only), explain (SELECT-only)
+ *
+ * Driver: `pg` is loaded lazily via dynamic import. It is NOT a project
+ * dependency — operators must `npm install pg` in their workspace before
+ * using this connector.
+ *
+ * Extends BaseConnector for unified auth, retry, rate-limit, error handling.
+ *
+ * This file is the canonical template for the other data-store connectors
+ * (MongoDB, Redis, Elasticsearch). Keep the shape consistent.
+ */
+import { type AuthContext, BaseConnector, type ConnectorError, type ConnectorStatus } from "./baseConnector.js";
+export interface PostgresTokens {
+    /** Full DSN: postgres://user:pass@host:port/db */
+    connectionString?: string;
+    host?: string;
+    port?: number;
+    database?: string;
+    user?: string;
+    password?: string;
+    ssl?: boolean;
+    connected_at: string;
+}
+export interface PostgresTable {
+    table_schema: string;
+    table_name: string;
+}
+export interface PostgresColumn {
+    column_name: string;
+    data_type: string;
+    is_nullable: string;
+    column_default: string | null;
+}
+export interface PostgresQueryResult {
+    rows: Record<string, unknown>[];
+    rowCount: number;
+    fields: {
+        name: string;
+        dataTypeID: number;
+    }[];
+    truncated: boolean;
+}
+type PgPoolClient = {
+    query: (text: string, values?: unknown[]) => Promise<PgQueryResultRaw>;
+    release: () => void;
+};
+type PgQueryResultRaw = {
+    rows: Record<string, unknown>[];
+    rowCount: number | null;
+    fields?: {
+        name: string;
+        dataTypeID: number;
+    }[];
+};
+type PgPool = {
+    query: (text: string, values?: unknown[]) => Promise<PgQueryResultRaw>;
+    connect: () => Promise<PgPoolClient>;
+    end: () => Promise<void>;
+};
+type PgModule = {
+    Pool: new (config: Record<string, unknown>) => PgPool;
+};
+export declare function __setPgModuleForTest(mod: PgModule | null): void;
+/**
+ * True iff `sql` is a read-only statement (SELECT / SHOW / EXPLAIN / WITH).
+ * Strips leading comments + whitespace and inspects the first keyword.
+ * Defence in depth: pair with role-level read-only grants on the DB side.
+ */
+export declare function isReadOnlySql(sql: string): boolean;
+/**
+ * Wrap a SELECT-style statement with `LIMIT n` if it does not already cap
+ * rows. Cheap heuristic: case-insensitive "limit" word search. The runtime
+ * row-count cap in `query()` is the real safety net.
+ */
+export declare function applyRowLimit(sql: string, limit: number): string;
+export declare class PostgresConnector extends BaseConnector {
+    readonly providerName = "postgres";
+    private tokens;
+    private pool;
+    protected getOAuthConfig(): null;
+    authenticate(): Promise<AuthContext>;
+    healthCheck(): Promise<{
+        ok: boolean;
+        error?: ConnectorError;
+    }>;
+    normalizeError(error: unknown): ConnectorError;
+    getStatus(): ConnectorStatus;
+    private getPool;
+    /** Close the pool. Called by the HTTP disconnect handler. */
+    disconnect(): Promise<void>;
+    listTables(schema?: string): Promise<PostgresTable[]>;
+    describeTable(table: string, schema?: string): Promise<PostgresColumn[]>;
+    query(sql: string, params?: unknown[], rowLimit?: number): Promise<PostgresQueryResult>;
+    explain(sql: string): Promise<unknown>;
+}
+export declare function loadTokens(): PostgresTokens | null;
+export declare function saveTokens(tokens: PostgresTokens): void;
+export declare function clearTokens(): void;
+export declare function getPostgresConnector(): PostgresConnector;
+export { getPostgresConnector as postgres };
+export interface ConnectorHandlerResult {
+    status: number;
+    body: string;
+    contentType?: string;
+}
+/**
+ * POST /connections/postgres/connect
+ *   body: { connectionString } OR { host, port?, database, user, password, ssl? }
+ *
+ * Validates by opening a connection, running `SELECT 1`, then closing.
+ * Only stores tokens after a successful round-trip.
+ */
+export declare function handlePostgresConnect(body: string): Promise<ConnectorHandlerResult>;
+/**
+ * POST /connections/postgres/test
+ */
+export declare function handlePostgresTest(): Promise<ConnectorHandlerResult>;
+/**
+ * DELETE /connections/postgres
+ */
+export declare function handlePostgresDisconnect(): Promise<ConnectorHandlerResult>;