Directories
¶
| Path | Synopsis |
|---|---|
|
Package agentinit implements `locksql init <agent>` and the user-scope wiring of bare `locksql` and `locksql doctor --fix`: it holds locksql's texts (templates/) and wires them through lockkit's agentwire, which owns the file mechanics.
|
Package agentinit implements `locksql init <agent>` and the user-scope wiring of bare `locksql` and `locksql doctor --fix`: it holds locksql's texts (templates/) and wires them through lockkit's agentwire, which owns the file mechanics. |
|
Package client is the secret-free side of locksql: lockkit's client (dial, hello, call) with locksql's names and its SQL methods.
|
Package client is the secret-free side of locksql: lockkit's client (dial, hello, call) with locksql's names and its SQL methods. |
|
Package config loads locksql profiles from the project and user config files, applies defaults, refuses anything that looks like a secret, and computes the security-relevant policy of a profile.
|
Package config loads locksql profiles from the project and user config files, applies defaults, refuses anything that looks like a secret, and computes the security-relevant policy of a profile. |
|
Package console is the human side of locksql: it holds the credentials and the only database connection, enforces the approved policy, shows every query to the human for approval, masks the results and writes the audit trail.
|
Package console is the human side of locksql: it holds the credentials and the only database connection, enforces the approved policy, shows every query to the human for approval, masks the results and writes the audit trail. |
|
Package engine defines the database engine interface the console drives, and the engine-independent types it returns: catalog descriptions, result sets and normalised query plans.
|
Package engine defines the database engine interface the console drives, and the engine-independent types it returns: catalog descriptions, result sets and normalised query plans. |
|
mysql
Package mysql is the MariaDB and MySQL engine, on the go-mysql-org client (chosen because it reports each result column's origin schema, table and column).
|
Package mysql is the MariaDB and MySQL engine, on the go-mysql-org client (chosen because it reports each result column's origin schema, table and column). |
|
postgres
Package postgres is the PostgreSQL engine, on pgx v5.
|
Package postgres is the PostgreSQL engine, on pgx v5. |
|
sqlite
Package sqlite is the SQLite engine, on the pure-Go modernc.org/sqlite driver.
|
Package sqlite is the SQLite engine, on the pure-Go modernc.org/sqlite driver. |
|
Package ipc is locksql's console protocol: lockkit's transport and methods (package lockkit/ipc, re-exported here under the same names) plus the SQL methods and their types.
|
Package ipc is locksql's console protocol: lockkit's transport and methods (package lockkit/ipc, re-exported here under the same names) plus the SQL methods and their types. |
|
Package mcpserver exposes the locksql console to agents as MCP tools (spec §12).
|
Package mcpserver exposes the locksql console to agents as MCP tools (spec §12). |
|
Package pii decides which result cells must be masked: column rules kept in .locksql/pii.toml, rules proposed from the schema, value detectors (email, phone, IBAN, card, national ids) and the masking itself.
|
Package pii decides which result cells must be masked: column rules kept in .locksql/pii.toml, rules proposed from the schema, value detectors (email, phone, IBAN, card, national ids) and the masking itself. |
|
Package product is locksql's identity on lockkit: its names, accounts, directories and keychain service.
|
Package product is locksql's identity on lockkit: its names, accounts, directories and keychain service. |
|
Package render turns a (masked) result into the text an agent sees: TSV or JSON, within the profile's row, cell and output caps.
|
Package render turns a (masked) result into the text an agent sees: TSV or JSON, within the profile's row, cell and output caps. |
|
Package sqlast parses the read statements an agent may run (SELECT, WITH ...
|
Package sqlast parses the read statements an agent may run (SELECT, WITH ... |
|
Package sqlaudit is locksql's audit record on lockkit's audit log: one JSONL record per event, never secrets and never row data.
|
Package sqlaudit is locksql's audit record on lockkit's audit log: one JSONL record per event, never secrets and never row data. |
|
Package sqlclass is locksql's first gate: a conservative, dialect-aware lexer and statement classifier.
|
Package sqlclass is locksql's first gate: a conservative, dialect-aware lexer and statement classifier. |
|
Package sqlrefusal holds locksql's refusal codes, registered with lockkit's refusal package, and re-exports that package so call sites import one name.
|
Package sqlrefusal holds locksql's refusal codes, registered with lockkit's refusal package, and re-exports that package so call sites import one name. |
|
Package stats reads the console's audit log and counts the refusals by code and by the token or node that triggered them, so that grammar work starts with the constructs users hit most.
|
Package stats reads the console's audit log and counts the refusals by code and by the token or node that triggered them, so that grammar work starts with the constructs users hit most. |
|
Package weight turns a normalised engine plan into a verdict: OK, WARN or REFUSE.
|
Package weight turns a normalised engine plan into a verdict: OK, WARN or REFUSE. |
Click to show internal directories.
Click to hide internal directories.