@agent-native/core 0.201.0-nightly-20261005153421 → 0.201.0

package/dist/scripts/db/safety.js

@@ -1,97 +1,203 @@
+import { AgentSqlPolicyError, assertAgentPostgresTokenPolicy, readAgentPostgresStatement, verifyAgentPostgresResolution, } from "../../agent-sql/postgres.js";
+import { toPostgresParams } from "../../db/client.js";
 import { fail } from "../utils.js";
-const SENSITIVE_FRAMEWORK_TABLE_RE = /\b(app_secrets|oauth_tokens|user|users|session|sessions|account|accounts|verification|jwks|organization|member|invitation|org_members|org_invitations|pg_catalog|information_schema|pg_class|pg_proc|pg_namespace|pg_user|pg_roles|pg_authid|pg_shadow)\b/i;
-function stripSqlNonIdentifiers(sql) {
-    let out = "";
-    let state = "normal";
-    for (let i = 0; i < sql.length; i++) {
-        const ch = sql[i];
-        const next = sql[i + 1];
-        if (state === "line-comment") {
-            if (ch === "\n") {
-                out += " ";
-                state = "normal";
-            }
-            continue;
+// Every guard here reads the SQL with the shared agent-SQL lexer, so strings,
+// comments, quoted identifiers and dollar quotes are seen the way Postgres
+// sees them. Text the lexer cannot read is refused rather than skipped.
+function guarded(check, label) {
+    try {
+        return check();
+    }
+    catch (error) {
+        if (error instanceof AgentSqlPolicyError) {
+            fail(prefixed(label, error.message));
         }
-        if (state === "block-comment") {
-            if (ch === "*" && next === "/") {
-                i++;
-                out += " ";
-                state = "normal";
-            }
-            continue;
+        throw error;
+    }
+}
+async function guardedAsync(check, label) {
+    try {
+        await check();
+    }
+    catch (error) {
+        if (error instanceof AgentSqlPolicyError) {
+            fail(prefixed(label, error.message));
         }
-        if (state === "single") {
-            if (ch === "'" && next === "'") {
-                i++;
-            }
-            else if (ch === "'") {
-                out += " ";
-                state = "normal";
-            }
+        throw error;
+    }
+}
+function prefixed(label, message) {
+    return label ? `${label}: ${message}` : message;
+}
+function isName(token) {
+    return token?.kind === "word" || token?.kind === "quoted-identifier";
+}
+function isWord(token, value) {
+    return token?.kind === "word" && token.value === value;
+}
+function isPunctuation(token, text) {
+    return token?.kind === "punctuation" && token.text === text;
+}
+const SENSITIVE_FRAMEWORK_TABLES = new Set([
+    "app_secrets",
+    "oauth_tokens",
+    "mcp_oauth_clients",
+    "mcp_oauth_codes",
+    "mcp_oauth_refresh_tokens",
+    "mcp_connect_tokens",
+    "mcp_device_codes",
+    "user",
+    "users",
+    "session",
+    "sessions",
+    "account",
+    "accounts",
+    "verification",
+    "jwks",
+    "organization",
+    "member",
+    "invitation",
+    "org_members",
+    "org_invitations",
+    "pg_catalog",
+    "information_schema",
+    "pg_class",
+    "pg_proc",
+    "pg_namespace",
+    "pg_user",
+    "pg_roles",
+    "pg_authid",
+    "pg_shadow",
+]);
+function sensitiveVerb(operation) {
+    return operation === "read"
+        ? "readable"
+        : operation === "write"
+            ? "writable"
+            : "patchable";
+}
+function assertNoSensitiveFrameworkTableTokens(tokens, operation) {
+    for (const token of tokens) {
+        if (!isName(token))
             continue;
-        }
-        if (ch === "-" && next === "-") {
-            i++;
-            state = "line-comment";
+        const name = token.value.toLowerCase();
+        if (!SENSITIVE_FRAMEWORK_TABLES.has(name))
             continue;
+        fail(`Sensitive framework table "${name}" is not ${sensitiveVerb(operation)} through raw DB tools. Use the framework auth, secrets, or OAuth APIs instead.`);
+    }
+}
+export function assertNoSensitiveFrameworkTables(sql, operation) {
+    const statement = guarded(() => readAgentPostgresStatement(sql));
+    assertNoSensitiveFrameworkTableTokens(statement.tokens, operation);
+}
+const READ_KEYWORDS = new Set(["select", "with", "explain"]);
+const WRITE_KEYWORDS = new Set(["insert", "update", "delete"]);
+/**
+ * Reads one db-query statement and applies every check that needs no
+ * database. Returns the statement as it will run.
+ */
+export function readRawDbReadStatement(sql) {
+    const statement = guarded(() => readAgentPostgresStatement(sql));
+    if (!statement.keyword || !READ_KEYWORDS.has(statement.keyword)) {
+        fail("Only SELECT, WITH, and EXPLAIN queries are allowed. Use db-exec for writes.");
+    }
+    guarded(() => assertAgentPostgresTokenPolicy(statement));
+    assertNoSensitiveFrameworkTableTokens(statement.tokens, "read");
+    return statement;
+}
+/**
+ * Reads one db-exec statement and applies every check that needs no
+ * database, including the access-control write rules. `label` prefixes
+ * errors, e.g. "Statement 2".
+ */
+export function readRawDbWriteStatement(sql, label) {
+    const statement = guarded(() => {
+        try {
+            return readAgentPostgresStatement(sql);
         }
-        if (ch === "/" && next === "*") {
-            i++;
-            state = "block-comment";
-            continue;
+        catch (error) {
+            if (!(error instanceof AgentSqlPolicyError))
+                throw error;
+            const subject = label ?? "The statement";
+            if (error.code === "multiple_statements") {
+                fail(`${subject} contains multiple SQL statements. Use --statements for batches so each write can be validated and run transactionally.`);
+            }
+            if (error.code === "empty")
+                fail(`${subject} is empty`);
+            throw error;
         }
-        if (ch === "'") {
-            state = "single";
-            continue;
+    }, label);
+    assertRawDbWriteKeyword(statement, label);
+    guarded(() => assertAgentPostgresTokenPolicy(statement), label);
+    assertNoSensitiveFrameworkTableTokens(statement.tokens, "write");
+    assertNoRawDbAccessControlWriteTokens(statement, label);
+    return statement;
+}
+function assertRawDbWriteKeyword(statement, label) {
+    const keyword = statement.keyword ?? "";
+    if (READ_KEYWORDS.has(keyword)) {
+        fail(prefixed(label, "use db-query for read statements. db-exec is for writes only."));
+    }
+    if (keyword === "create" || keyword === "alter") {
+        fail(prefixed(label, "schema changes are not allowed through db-exec. Additive schema changes must go through reviewed migrations or startup code."));
+    }
+    if (!WRITE_KEYWORDS.has(keyword)) {
+        fail(prefixed(label, "only INSERT, UPDATE, DELETE statements are allowed. Dangerous operations such as DROP, TRUNCATE, GRANT, and REVOKE are blocked."));
+    }
+}
+/**
+ * Converts `?` placeholders and re-reads the result, so the guards have seen
+ * exactly the text that executes. Refuses if converting again would change
+ * the text, since the PGlite client converts a second time.
+ */
+export function finalRawDbSql(sql, kind, label) {
+    const finalSql = toPostgresParams(sql);
+    if (toPostgresParams(finalSql) !== finalSql) {
+        fail(prefixed(label, "The SQL could not be read safely: its placeholders are ambiguous."));
+    }
+    const statement = guarded(() => readAgentPostgresStatement(finalSql), label);
+    // toPostgresParams converts every "?" it reads as code. One left over means
+    // it read that text as a string or comment and Postgres will not, so the
+    // two disagree about where the statement's code is.
+    if (statement.tokens.some((token) => (token.kind === "parameter" || token.kind === "operator") &&
+        token.text.includes("?"))) {
+        fail(prefixed(label, "The SQL could not be read safely: its placeholders are ambiguous."));
+    }
+    if (kind === "read") {
+        if (!statement.keyword || !READ_KEYWORDS.has(statement.keyword)) {
+            fail("Only SELECT, WITH, and EXPLAIN queries are allowed.");
+        }
+    }
+    else if (kind === "patch") {
+        if (statement.keyword !== "update") {
+            fail("--where must be a single condition.");
         }
-        out += ch;
     }
-    return out;
+    else {
+        assertRawDbWriteKeyword(statement, label);
+    }
+    guarded(() => assertAgentPostgresTokenPolicy(statement), label);
+    assertNoSensitiveFrameworkTableTokens(statement.tokens, kind);
+    return { sql: finalSql, statement };
 }
-export function assertNoSensitiveFrameworkTables(sql, operation) {
-    const cleanSql = stripSqlNonIdentifiers(sql);
-    const match = cleanSql.match(SENSITIVE_FRAMEWORK_TABLE_RE);
-    if (!match)
+/**
+ * The database-side checks: run inside the transaction, after the per-user
+ * views exist and immediately before the statement executes.
+ * `columnsByTable` comes from the scoping context; it lets an INSERT without a
+ * column list be refused when the table has access-control columns.
+ */
+export async function verifyRawDbStatement(db, statement, options = {}) {
+    await guardedAsync(() => verifyAgentPostgresResolution(db, statement), options.label);
+    if (statement.keyword !== "insert" || !options.columnsByTable)
         return;
-    const verb = operation === "read"
-        ? "readable"
-        : operation === "write"
-            ? "writable"
-            : "patchable";
-    fail(`Sensitive framework table "${match[1]}" is not ${verb} through raw DB tools. Use the framework auth, secrets, or OAuth APIs instead.`);
-}
-// Schema/database-qualified table references (e.g. `public.notes`,
-// `pg_temp.notes`) BYPASS the per-user/per-org temporary views that scope
-// db-query / db-exec, because those views only shadow UNQUALIFIED table names.
-// A qualified reference resolves straight to the real base table, defeating the
-// owner_email / org_id scoping and exposing (or letting writes touch) every
-// tenant's rows. db-patch already rejects dotted identifiers via
-// isValidIdentifier; db-query / db-exec must reject them too.
-//
-// Two complementary detectors run on the comment/string-stripped SQL:
-//   1. The schemas that actually HOLD base tables and so defeat scoping when
-//      named explicitly: `public` (Postgres deployments),
-//      and the Postgres system catalogs. This fires in ANY position, so it also
-//      catches comma-joins (`FROM notes, public.other`) and `USING public.x`.
-//      `temp` / `pg_temp` are intentionally NOT listed — temporary objects (our
-//      scoping views) live there, so `temp.notes` resolves to the *scoped* view,
-//      not a bypass, and `temp` is a common table alias we must not reject.
-//      The schema may be bare or double-quoted (`"public"."notes"`).
-//   2. Any dotted reference in table position (FROM/JOIN/INTO/UPDATE, incl.
-//      ONLY/LATERAL), which also catches non-standard schema names. Column /
-//      alias references like `f.id` sit in select/where/on position, not table
-//      position, so they do not match — no false positives on ordinary joins.
-const DANGEROUS_SCHEMA_QUALIFIER_RE = /(?:\b|")(?:main|public|pg_catalog|pg_toast|information_schema)"?\s*\.\s*(?:"|`|\[|[A-Za-z_])/i;
-const TABLE_POSITION_QUALIFIED_RE = /\b(?:FROM|JOIN|INTO|UPDATE)\s+(?:ONLY\s+|LATERAL\s+)?(?:"[^"]+"|`[^`]+`|\[[^\]]+\]|[A-Za-z_][A-Za-z0-9_$]*)\s*\.\s*(?:"[^"]+"|`[^`]+`|\[[^\]]+\]|[A-Za-z_][A-Za-z0-9_$]*)/i;
-export function assertNoSchemaQualifiedTables(sql, operation) {
-    const cleanSql = stripSqlNonIdentifiers(sql);
-    if (!DANGEROUS_SCHEMA_QUALIFIER_RE.test(cleanSql) &&
-        !TABLE_POSITION_QUALIFIED_RE.test(cleanSql)) {
+    const target = writeTarget(statement);
+    if (!target || target.insertColumns !== null)
         return;
+    const columns = options.columnsByTable.get(target.table) ?? [];
+    const sensitive = columns.find((column) => hasSensitiveToken(column, ACCESS_CONTROL_COLUMN_TOKENS));
+    if (sensitive) {
+        fail(prefixed(options.label, `INSERT into "${target.table}" must list its columns, because the table has the access-control column "${sensitive}". Name the columns you are setting.`));
     }
-    const verb = operation === "read" ? "queried" : "written";
-    fail(`Schema-qualified table references (e.g. "public.<table>") cannot be ${verb} through raw DB tools — a qualified name bypasses the per-user data scoping that isolates each tenant's rows. Use the bare table name; the current user's scoping is applied automatically.`);
 }
 const ACCESS_CONTROL_TABLE_TOKENS = new Set([
     "acl",
@@ -136,15 +242,8 @@ const ACCESS_CONTROL_COLUMN_TOKENS = new Set([
     "role",
     "roles",
 ]);
-function normalizeIdentifier(value) {
-    return value
-        .trim()
-        .replace(/^["'`[]/, "")
-        .replace(/["'`\]]$/, "")
-        .toLowerCase();
-}
 function identifierTokens(identifier) {
-    const normalized = normalizeIdentifier(identifier);
+    const normalized = identifier.trim().toLowerCase();
     const tokens = new Set([normalized]);
     for (const token of normalized.split(/[^a-z0-9]+/).filter(Boolean)) {
         tokens.add(token);
@@ -158,68 +257,215 @@ function hasSensitiveToken(identifier, sensitiveTokens) {
     }
     return null;
 }
-function tableNameFromWriteSql(sql) {
-    const match = sql.match(/^\s*(?:INSERT(?:\s+OR\s+\w+)?\s+INTO|REPLACE(?:\s+OR\s+\w+)?\s+INTO|UPDATE|DELETE\s+FROM)\s+((?:"[^"]+"|'[^']+'|`[^`]+`|[\w]+)(?:\s*\.\s*(?:"[^"]+"|'[^']+'|`[^`]+`|[\w]+))?)/i);
-    if (!match)
+/** Reads `name` or `a.b.name` at `index`; returns the last name and the next index. */
+function readNameChain(tokens, index) {
+    if (!isName(tokens[index]))
+        return null;
+    let cursor = index;
+    while (isPunctuation(tokens[cursor + 1], ".") && isName(tokens[cursor + 2])) {
+        cursor += 2;
+    }
+    return { name: tokens[cursor].value, next: cursor + 1 };
+}
+const PARENTHESIZED_QUERY_KEYWORDS = new Set([
+    "select",
+    "with",
+    "values",
+    "table",
+]);
+function isOpening(token) {
+    return isPunctuation(token, "(") || isPunctuation(token, "[");
+}
+function isClosing(token) {
+    return isPunctuation(token, ")") || isPunctuation(token, "]");
+}
+/**
+ * The table an INSERT writes and the columns it lists, or null when the
+ * statement is not an INSERT the guards can read. `columns` is null when the
+ * INSERT has no column list.
+ */
+export function rawDbInsertTarget(statement) {
+    if (statement.keyword !== "insert")
+        return null;
+    const target = writeTarget(statement);
+    return target ? { table: target.table, columns: target.insertColumns } : null;
+}
+function writeTarget(statement) {
+    const { tokens } = statement;
+    let index = 1;
+    if (statement.keyword === "insert") {
+        if (!isWord(tokens[index], "into"))
+            return null;
+        index++;
+    }
+    else if (statement.keyword === "delete") {
+        if (!isWord(tokens[index], "from"))
+            return null;
+        index++;
+    }
+    else if (statement.keyword !== "update") {
         return null;
-    return normalizeIdentifier(match[1].split(".").pop() ?? match[1]);
-}
-function splitColumnList(columns) {
-    return columns
-        .split(",")
-        .map((column) => normalizeIdentifier(column))
-        .filter(Boolean);
-}
-function insertColumnsFromSql(sql) {
-    const match = sql.match(/^\s*(?:INSERT(?:\s+OR\s+\w+)?\s+INTO|REPLACE(?:\s+OR\s+\w+)?\s+INTO)\s+(?:"[^"]+"|'[^']+'|`[^`]+`|[\w]+)(?:\s*\.\s*(?:"[^"]+"|'[^']+'|`[^`]+`|[\w]+))?\s*\(([^)]+)\)/i);
-    return match ? splitColumnList(match[1]) : [];
-}
-function updateColumnsFromSql(sql) {
-    const setMatch = /\bSET\b/i.exec(sql);
-    if (!setMatch)
-        return [];
-    const tail = sql.slice(setMatch.index + setMatch[0].length);
-    const endMatch = /\b(?:WHERE|RETURNING)\b/i.exec(tail);
-    const setClause = endMatch ? tail.slice(0, endMatch.index) : tail;
+    }
+    if (isWord(tokens[index], "only"))
+        index++;
+    const chain = readNameChain(tokens, index);
+    if (!chain)
+        return null;
+    let insertColumns = null;
+    if (statement.keyword === "insert") {
+        let cursor = chain.next;
+        if (isWord(tokens[cursor], "as"))
+            cursor += 2;
+        const opensQuery = isPunctuation(tokens[cursor + 1], "(") ||
+            (tokens[cursor + 1]?.kind === "word" &&
+                PARENTHESIZED_QUERY_KEYWORDS.has(tokens[cursor + 1].value));
+        // `INSERT INTO t (SELECT ...)` is a parenthesized query, not a column list.
+        if (isPunctuation(tokens[cursor], "(") && !opensQuery) {
+            insertColumns = [];
+            let depth = 0;
+            for (; cursor < tokens.length; cursor++) {
+                const token = tokens[cursor];
+                if (isOpening(token))
+                    depth++;
+                else if (isClosing(token) && --depth === 0)
+                    break;
+                else if (isName(token))
+                    insertColumns.push(token.value);
+            }
+        }
+        else if (isWord(tokens[cursor], "default")) {
+            insertColumns = [];
+        }
+    }
+    return {
+        table: chain.name,
+        insertColumns,
+        setColumns: setClauseColumns(tokens),
+    };
+}
+const SET_CLAUSE_END = new Set(["from", "where", "returning"]);
+/**
+ * Every assignment target in every top-level SET clause: `a = 1`,
+ * `(a, b) = (1, 2)`, `a[1] = 1`, and ON CONFLICT DO UPDATE SET.
+ */
+function setClauseColumns(tokens) {
     const columns = [];
-    const columnRe = /(?:^|,)\s*(?:"([^"]+)"|'([^']+)'|`([^`]+)`|([A-Za-z_][A-Za-z0-9_]*))\s*=/g;
-    let match;
-    while ((match = columnRe.exec(setClause)) !== null) {
-        columns.push(normalizeIdentifier(match[1] ?? match[2] ?? match[3] ?? match[4]));
+    let depth = 0;
+    for (let index = 0; index < tokens.length; index++) {
+        const token = tokens[index];
+        if (isOpening(token))
+            depth++;
+        else if (isClosing(token))
+            depth--;
+        if (depth !== 0 || !isWord(token, "set"))
+            continue;
+        let assignmentDepth = 0;
+        let inTarget = true;
+        for (index++; index < tokens.length; index++) {
+            const inner = tokens[index];
+            if (isOpening(inner))
+                assignmentDepth++;
+            else if (isClosing(inner))
+                assignmentDepth--;
+            if (assignmentDepth === 0) {
+                if (inner.kind === "word" &&
+                    SET_CLAUSE_END.has(inner.value) &&
+                    !isWord(tokens[index - 1], "distinct")) {
+                    break;
+                }
+                if (isPunctuation(inner, ",")) {
+                    inTarget = true;
+                    continue;
+                }
+                if (inner.kind === "operator" && inner.text === "=") {
+                    inTarget = false;
+                    continue;
+                }
+            }
+            if (inTarget && isName(inner))
+                columns.push(inner.value);
+        }
+        index--;
     }
     return columns;
 }
-function writeColumnsFromSql(sql) {
-    const upper = sql.trim().toUpperCase();
-    if (upper.startsWith("UPDATE"))
-        return updateColumnsFromSql(sql);
-    if (upper.startsWith("INSERT") || upper.startsWith("REPLACE")) {
-        return insertColumnsFromSql(sql);
-    }
-    return [];
-}
-export function assertNoRawDbAccessControlWrite(sql) {
-    const tableName = tableNameFromWriteSql(sql);
-    if (tableName) {
-        const tableToken = hasSensitiveToken(tableName, ACCESS_CONTROL_TABLE_TOKENS);
-        if (tableToken) {
-            fail(`Sensitive identity/access-control table "${tableName}" is not writable through raw DB tools. Use a dedicated app action or implement the permission change in reviewed code.`);
-        }
+function assertNoRawDbAccessControlWriteTokens(statement, label) {
+    const target = writeTarget(statement);
+    if (!target) {
+        fail(prefixed(label, "could not identify the table this statement writes. Write one table by its bare name."));
+    }
+    if (hasSensitiveToken(target.table, ACCESS_CONTROL_TABLE_TOKENS)) {
+        fail(prefixed(label, `Sensitive identity/access-control table "${target.table}" is not writable through raw DB tools. Use a dedicated app action or implement the permission change in reviewed code.`));
     }
-    for (const column of writeColumnsFromSql(sql)) {
-        const columnToken = hasSensitiveToken(column, ACCESS_CONTROL_COLUMN_TOKENS);
-        if (!columnToken)
+    for (const column of [
+        ...(target.insertColumns ?? []),
+        ...target.setColumns,
+    ]) {
+        if (!hasSensitiveToken(column, ACCESS_CONTROL_COLUMN_TOKENS))
             continue;
-        fail(`Sensitive identity/access-control column "${column}" is not writable through raw DB tools. Use a dedicated app action or implement the permission change in reviewed code.`);
+        fail(prefixed(label, `Sensitive identity/access-control column "${column}" is not writable through raw DB tools. Use a dedicated app action or implement the permission change in reviewed code.`));
     }
 }
 export function assertNoRawDbAccessControlPatchTarget(table, column) {
-    const tableName = normalizeIdentifier(table);
+    const tableName = table.trim().toLowerCase();
     if (hasSensitiveToken(tableName, ACCESS_CONTROL_TABLE_TOKENS)) {
         fail(`Sensitive identity/access-control table "${tableName}" is not patchable through raw DB tools. Use a dedicated app action or implement the permission change in reviewed code.`);
     }
-    const columnName = normalizeIdentifier(column);
+    const columnName = column.trim().toLowerCase();
     if (hasSensitiveToken(columnName, ACCESS_CONTROL_COLUMN_TOKENS)) {
         fail(`Sensitive identity/access-control column "${columnName}" is not patchable through raw DB tools. Use a dedicated app action or implement the permission change in reviewed code.`);
     }
 }
+const BLOCKED_WHERE_KEYWORDS = new Set([
+    "insert",
+    "update",
+    "delete",
+    "merge",
+    "drop",
+    "alter",
+    "create",
+    "truncate",
+    "grant",
+    "revoke",
+    "copy",
+    "call",
+]);
+/**
+ * Validates db-patch's `--where`, which is spliced into a SELECT and an
+ * UPDATE. Both full statements are read and verified again before they run.
+ */
+export function validateRawDbPatchWhere(where) {
+    // Stricter than the lexer needs: a condition never needs a ';' or a comment.
+    if (where.includes(";"))
+        fail("--where must not contain ';'");
+    const statement = guarded(() => readAgentPostgresStatement(where));
+    let previousEnd = 0;
+    for (const gap of [
+        ...statement.tokens.map((token) => {
+            const text = where.slice(previousEnd, token.start);
+            previousEnd = token.end;
+            return text;
+        }),
+        where.slice(previousEnd),
+    ]) {
+        if (gap.includes("--"))
+            fail('--where must not contain "--"');
+        if (gap.includes("/*"))
+            fail('--where must not contain "/*"');
+    }
+    for (const token of statement.tokens) {
+        if (token.kind === "word" && BLOCKED_WHERE_KEYWORDS.has(token.value)) {
+            fail(`--where must not contain "${token.value.toUpperCase()}"`);
+        }
+    }
+}
+/** Reads a statement db-patch built from its arguments. */
+export function readRawDbPatchStatement(sql, keyword) {
+    const statement = guarded(() => readAgentPostgresStatement(sql));
+    if (statement.keyword !== keyword) {
+        fail("--where must be a single condition.");
+    }
+    guarded(() => assertAgentPostgresTokenPolicy(statement));
+    assertNoSensitiveFrameworkTableTokens(statement.tokens, "patch");
+    return statement;
+}

package/dist/scripts/db/scoping.d.ts

@@ -7,6 +7,7 @@ export interface ScopingContext {
     ownerEmailTables: Set<string>;
     orgIdTables: Set<string>;
     tablePredicates: Map<string, string>;
+    columnsByTable: Map<string, string[]>;
 }
 export declare function buildScopingPostgres(client: {
     unsafe(sql: string, args?: unknown[]): Promise<unknown[]>;

package/dist/scripts/db/scoping.js

@@ -82,8 +82,8 @@ function buildScopedTables(allColumns, userEmail, orgId) {
                 // prompt-injection exfiltration channel (read own secret → send to
                 // attacker URL) and also hides any legacy plaintext rows that predate
                 // encryption plus the recoverable last4/preview. Schema-qualified attempts
-                // to reach the base table (public.settings) are
-                // rejected separately by assertNoSchemaQualifiedTables in safety.ts.
+                // to reach the base table (public.settings) are rejected separately
+                // by the agent-SQL guards in safety.ts.
                 whereSql =
                     `"${coreScoping.column}" LIKE '${prefix}%' ESCAPE '\\'` +
                         ` AND "${coreScoping.column}" NOT LIKE '${prefix}credential:%' ESCAPE '\\'`;
@@ -149,5 +149,6 @@ export async function buildScopingPostgres(client) {
         ownerEmailTables,
         orgIdTables,
         tablePredicates: new Map(scoped.map((s) => [s.name, s.predicate])),
+        columnsByTable,
     };
 }

package/dist/search/index-store.d.ts

@@ -7,3 +7,24 @@ import type { DbExec } from "../db/client.js";
 export declare const SEARCH_RESOURCES_TABLE = "search_resources";
 export declare const SEARCH_INDEX_STATE_TABLE = "search_index_state";
 export declare function ensureSearchIndexTables(injectedClient?: DbExec): Promise<void>;
+/**
+ * Raises an index's target version, leaving the rebuild for the first drain
+ * at that version to claim. A process on a lower version reads the index as
+ * outdated from then on and serves its previous search. Returns the target
+ * now in force, which is higher than `version` when a newer build raised it.
+ */
+export declare function raiseSearchIndexTarget(exec: DbExec, target: {
+    app: string;
+    type: string;
+    version: number;
+}): Promise<number>;
+/**
+ * Marks the index as needing a rebuild at its current version, including a
+ * rebuild still queueing rows: its queue may predate the writes this
+ * invalidation is for. Nothing to do before the search tables exist: there
+ * is no index yet.
+ */
+export declare function invalidateSearchIndex(exec: DbExec, target: {
+    app: string;
+    type: string;
+}): Promise<void>;