@askdb/core 1.0.0-beta.42 → 1.0.0-beta.44

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (121) hide show
  1. package/README.md +14 -8
  2. package/dist/ask.d.ts +101 -4
  3. package/dist/ask.d.ts.map +1 -1
  4. package/dist/ask.js +243 -25
  5. package/dist/ask.js.map +1 -1
  6. package/dist/enrichment/suggest.d.ts.map +1 -1
  7. package/dist/enrichment/suggest.js +3 -1
  8. package/dist/enrichment/suggest.js.map +1 -1
  9. package/dist/errors.d.ts +41 -5
  10. package/dist/errors.d.ts.map +1 -1
  11. package/dist/errors.js +9 -0
  12. package/dist/errors.js.map +1 -1
  13. package/dist/index.d.ts +8 -6
  14. package/dist/index.d.ts.map +1 -1
  15. package/dist/index.js +5 -3
  16. package/dist/index.js.map +1 -1
  17. package/dist/retrieval/synthesize-ddl.d.ts +4 -0
  18. package/dist/retrieval/synthesize-ddl.d.ts.map +1 -1
  19. package/dist/retrieval/synthesize-ddl.js +5 -3
  20. package/dist/retrieval/synthesize-ddl.js.map +1 -1
  21. package/dist/schema/normalize.d.ts +10 -0
  22. package/dist/schema/normalize.d.ts.map +1 -1
  23. package/dist/schema/normalize.js.map +1 -1
  24. package/dist/schema/v2/format.d.ts +7 -0
  25. package/dist/schema/v2/format.d.ts.map +1 -1
  26. package/dist/schema/v2/format.js +20 -7
  27. package/dist/schema/v2/format.js.map +1 -1
  28. package/dist/schema/v2/index.d.ts +3 -1
  29. package/dist/schema/v2/index.d.ts.map +1 -1
  30. package/dist/schema/v2/index.js +1 -0
  31. package/dist/schema/v2/index.js.map +1 -1
  32. package/dist/schema/v2/loader.d.ts +32 -1
  33. package/dist/schema/v2/loader.d.ts.map +1 -1
  34. package/dist/schema/v2/loader.js +173 -49
  35. package/dist/schema/v2/loader.js.map +1 -1
  36. package/dist/schema/v2/mentions.d.ts +31 -0
  37. package/dist/schema/v2/mentions.d.ts.map +1 -0
  38. package/dist/schema/v2/mentions.js +47 -0
  39. package/dist/schema/v2/mentions.js.map +1 -0
  40. package/dist/schema/v2/normalized.d.ts +38 -0
  41. package/dist/schema/v2/normalized.d.ts.map +1 -1
  42. package/dist/schema/v2/parser.d.ts +9 -0
  43. package/dist/schema/v2/parser.d.ts.map +1 -1
  44. package/dist/schema/v2/parser.js +18 -2
  45. package/dist/schema/v2/parser.js.map +1 -1
  46. package/dist/schema/v2/tenant-policy-loader.d.ts.map +1 -1
  47. package/dist/schema/v2/tenant-policy-loader.js +7 -3
  48. package/dist/schema/v2/tenant-policy-loader.js.map +1 -1
  49. package/dist/schema/v2/tenant-policy.d.ts +28 -21
  50. package/dist/schema/v2/tenant-policy.d.ts.map +1 -1
  51. package/dist/schema/v2/tenant-policy.js +67 -11
  52. package/dist/schema/v2/tenant-policy.js.map +1 -1
  53. package/dist/sql/bind.d.ts +17 -15
  54. package/dist/sql/bind.d.ts.map +1 -1
  55. package/dist/sql/bind.js +38 -173
  56. package/dist/sql/bind.js.map +1 -1
  57. package/dist/sql/dialect-spec.d.ts +48 -3
  58. package/dist/sql/dialect-spec.d.ts.map +1 -1
  59. package/dist/sql/dialect-spec.js +89 -3
  60. package/dist/sql/dialect-spec.js.map +1 -1
  61. package/dist/sql/generate.d.ts +14 -0
  62. package/dist/sql/generate.d.ts.map +1 -1
  63. package/dist/sql/generate.js +31 -17
  64. package/dist/sql/generate.js.map +1 -1
  65. package/dist/sql/index.d.ts +2 -1
  66. package/dist/sql/index.d.ts.map +1 -1
  67. package/dist/sql/index.js +2 -1
  68. package/dist/sql/index.js.map +1 -1
  69. package/dist/sql/lexer.d.ts +114 -0
  70. package/dist/sql/lexer.d.ts.map +1 -0
  71. package/dist/sql/lexer.js +397 -0
  72. package/dist/sql/lexer.js.map +1 -0
  73. package/dist/sql/prompt-identifiers.d.ts +20 -0
  74. package/dist/sql/prompt-identifiers.d.ts.map +1 -0
  75. package/dist/sql/prompt-identifiers.js +64 -0
  76. package/dist/sql/prompt-identifiers.js.map +1 -0
  77. package/dist/sql/prompt.d.ts +7 -1
  78. package/dist/sql/prompt.d.ts.map +1 -1
  79. package/dist/sql/prompt.js +22 -2
  80. package/dist/sql/prompt.js.map +1 -1
  81. package/dist/sql/reserved-words.d.ts +15 -0
  82. package/dist/sql/reserved-words.d.ts.map +1 -0
  83. package/dist/sql/reserved-words.js +102 -0
  84. package/dist/sql/reserved-words.js.map +1 -0
  85. package/dist/sql/sensitive-guardrail.d.ts +18 -3
  86. package/dist/sql/sensitive-guardrail.d.ts.map +1 -1
  87. package/dist/sql/sensitive-guardrail.js +446 -157
  88. package/dist/sql/sensitive-guardrail.js.map +1 -1
  89. package/dist/sql/tenant-guardrail.d.ts +70 -8
  90. package/dist/sql/tenant-guardrail.d.ts.map +1 -1
  91. package/dist/sql/tenant-guardrail.js +799 -52
  92. package/dist/sql/tenant-guardrail.js.map +1 -1
  93. package/dist/sql/tenant-hierarchy.d.ts +19 -0
  94. package/dist/sql/tenant-hierarchy.d.ts.map +1 -0
  95. package/dist/sql/tenant-hierarchy.js +53 -0
  96. package/dist/sql/tenant-hierarchy.js.map +1 -0
  97. package/dist/sql/tenant-placeholders.d.ts +47 -19
  98. package/dist/sql/tenant-placeholders.d.ts.map +1 -1
  99. package/dist/sql/tenant-placeholders.js +229 -58
  100. package/dist/sql/tenant-placeholders.js.map +1 -1
  101. package/dist/sql/tenant-prompt.d.ts +4 -0
  102. package/dist/sql/tenant-prompt.d.ts.map +1 -1
  103. package/dist/sql/tenant-prompt.js +79 -11
  104. package/dist/sql/tenant-prompt.js.map +1 -1
  105. package/dist/sql/tenant-scope-validate.d.ts +3 -1
  106. package/dist/sql/tenant-scope-validate.d.ts.map +1 -1
  107. package/dist/sql/tenant-scope-validate.js +5 -2
  108. package/dist/sql/tenant-scope-validate.js.map +1 -1
  109. package/dist/sql/validate.d.ts +34 -4
  110. package/dist/sql/validate.d.ts.map +1 -1
  111. package/dist/sql/validate.js +138 -37
  112. package/dist/sql/validate.js.map +1 -1
  113. package/package.json +11 -7
  114. package/dist/exec/postgres.d.ts +0 -6
  115. package/dist/exec/postgres.d.ts.map +0 -1
  116. package/dist/exec/postgres.js +0 -30
  117. package/dist/exec/postgres.js.map +0 -1
  118. package/dist/modes/post-execute-log.d.ts +0 -9
  119. package/dist/modes/post-execute-log.d.ts.map +0 -1
  120. package/dist/modes/post-execute-log.js +0 -26
  121. package/dist/modes/post-execute-log.js.map +0 -1
@@ -1 +1 @@
1
- {"version":3,"file":"tenant-placeholders.js","sourceRoot":"","sources":["../../src/sql/tenant-placeholders.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAyBnB,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,WAAW,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAQD,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,MAA8B,EAC9B,KAAkB;IAElB,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA6C,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACrD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,MAAM,CAAC,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM;QACR,KAAK,SAAS;YACZ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM;QACR,KAAK,YAAY;YACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC3C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM;QACR,KAAK,QAAQ;YACX,MAAM;IACV,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,SAAS,cAAc,CAAC,KAAa,EAAE,OAA+C;IACpF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,GAAW,EACX,QAA+B,EAC/B,OAA+C;IAE/C,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,OAAO,GACX,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAChB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC;YACpC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAEvE,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,MAAM,UAAU,6BAA6B,CAC3C,GAAW,EACX,QAA+B,EAC/B,aAAqB,CAAC;IAEtB,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,GAAG,GAAG,UAAU,CAAC;IAErB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEjC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;YACvB,GAAG,EAAE,CAAC;QACR,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9C,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,SAAS,oBAAoB,CAC3B,GAAW,EACX,WAAmB,EACnB,WAAmB,EACnB,UAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,QAAQ,WAAW,CAAC,WAAW,CAAC,EAAE,EAClC,GAAG,CACJ,CAAC;QACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,WAAW,EAAE,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,gBAAgB,WAAW,CAAC,WAAW,CAAC,SAAS,EACjD,IAAI,CACL,CAAC;QACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,MAA8B,EAC9B,KAAkB,EAClB,OAA4B,UAAU,EACtC,kBAA0B,CAAC,EAC3B,OAA+C;IAE/C,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,KAAK,UAAU;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAoB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;KACX,CAAC,CAAC,CAAC;IAEJ,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,+BAA+B,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC;YAC5D,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAClF,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,WAAW,CAAC,GAAG;QACpB,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,QAAQ;QACR,eAAe;KAChB,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"tenant-placeholders.js","sourceRoot":"","sources":["../../src/sql/tenant-placeholders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,GAIzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAoB,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,GAGjB,MAAM,WAAW,CAAC;AAwCnB,6FAA6F;AAC7F,SAAS,YAAY,CACnB,OAAqC;IAErC,OAAO,OAAO,EAAE,EAAE,KAAK,SAAS;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,oFAAoF;AACpF,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;AAExD,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,OAA0B;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,sBAAsB,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAQD,SAAS,mBAAmB,CAC1B,GAAW,EACX,MAA8B,EAC9B,KAAkB,EAClB,OAA0B;IAE1B,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,8BAA8B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA6C,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,kBAAkB,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE;YACrD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,MAAM,CAAC,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM;QACR,KAAK,SAAS;YACZ,yEAAyE;YACzE,MAAM,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACxE,KAAK,YAAY;YACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC3C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM;QACR,KAAK,QAAQ;YACX,MAAM;IACV,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,MAAyD;IAEzD,OAAO,IAAI,gBAAgB,CACzB,qDAAqD,UAAU,MAAM,MAAM,iBAAiB;QAC1F,yEAAyE;QACzE,0FAA0F;QAC1F,qFAAqF,EACvF,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,SAAS,cAAc,CAAC,KAAa,EAAE,OAA0B;IAC/D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAChD,IAAI,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACjG,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC;IACjE,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,OAAO,CAAC,EAAE,IAAI,SAAS,iBAAiB;YACxF,yFAAyF;YACzF,oCAAoC,EACtC,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAID;;;;;;;;;;;;;;;GAeG;AACH,SAAS,4BAA4B,CACnC,GAAW,EACX,QAA+B,EAC/B,MAA4C,EAC5C,OAA0B;IAE1B,mCAAmC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CACxB,CAAC;gBACC,CAAC,CAAC,4BAA4B,GAAG,CAAC,WAAW,yCAAyC;oBAClF,oBAAoB,CAAC,CAAC,MAAM,mEAAmE;gBACnG,CAAC,CAAC,4BAA4B,GAAG,CAAC,WAAW,gDAAgD;oBACzF,gEAAgE,EACtE,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAE7D;;;;;;GAMG;AACH,SAAS,mCAAmC,CAAC,GAAW,EAAE,OAA0B;IAClF,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACnC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YACvE,MAAM,IAAI,gBAAgB,CACxB,4BAA4B,CAAC,CAAC,CAAC,CAAC,2DAA2D;gBACzF,YAAY,KAAK,kEAAkE,EACrF,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,iBAAiB,GAAG,oDAAoD,CAAC;AAC/E,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAElE;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,GAA0B,EAAE,KAAe;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE5C,IAAI,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,UAAU,KAAK,KAAK,CAAC;QACrE,MAAM,QAAQ,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,UAAU,KAAK,KAAK,CAAC;QACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;QAChD,OAAO;YACL,KAAK;YACL,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM;YAC/B,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,IAAI,GAAG,CAAC,EAAE,CAAC;QAC/E,CAAC;QACD,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,IAAY;IACtD,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA0B,EAAE,EAAsB;IAC9E,MAAM,KAAK,GACT,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,kBAAkB,EAAE,GAAG,CAAC;IACjF,OAAO,IAAI,gBAAgB,CACzB,sBAAsB,GAAG,CAAC,WAAW,IAAI,KAAK,iDAAiD;QAC7F,wFAAwF;QACxF,wDAAwD,EAC1D,8BAA8B,CAC/B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,SAAS,+BAA+B,CACtC,GAAW,EACX,QAA+B,EAC/B,OAA0B;IAE1B,OAAO,4BAA4B,CACjC,GAAG,EACH,QAAQ,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,EACrD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,OAAqC;IAC9D,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;IACvB,OAAO,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAkB,EAAE,OAAe;IACvD,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,6BAA6B,CACpC,GAAW,EACX,QAA+B,EAC/B,aAAqB,CAAC,EACtB,OAA0B;IAE1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,GAAG,GAAG,UAAU,CAAC;IACrB,MAAM,GAAG,GAAG,4BAA4B,CACtC,GAAG,EACH,QAAQ,EACR,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,EACJ,OAAO,CACR,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,MAA8B,EAC9B,KAAkB,EAClB,OAA4B,UAAU,EACtC,kBAA0B,CAAC,EAC3B,OAA0B;IAE1B,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,KAAK,UAAU;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAoB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;KACX,CAAC,CAAC,CAAC;IAEJ,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,+BAA+B,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC;YAC5D,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3F,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,WAAW,CAAC,GAAG;QACpB,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,QAAQ;QACR,eAAe;KAChB,CAAC;AACJ,CAAC"}
@@ -3,6 +3,10 @@ import type { TenantScope } from "../schema/v2/tenant-policy.js";
3
3
  /**
4
4
  * Build the tenant policy + runtime scope block for NL→SQL prompts.
5
5
  * This block is always injected when a tenant policy exists (security boundary).
6
+ *
7
+ * A `subtree` scope must be expanded into per-root IDs first (`ask()` does this
8
+ * through `resolveTenantDescendants`); an unexpanded one throws
9
+ * `SUBTREE_NOT_RESOLVABLE`.
6
10
  */
7
11
  export declare function buildTenantPromptBlock(policy: NormalizedTenantPolicy, scope: TenantScope): string;
8
12
  //# sourceMappingURL=tenant-prompt.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"tenant-prompt.d.ts","sourceRoot":"","sources":["../../src/sql/tenant-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,WAAW,GACjB,MAAM,CA4HR"}
1
+ {"version":3,"file":"tenant-prompt.d.ts","sourceRoot":"","sources":["../../src/sql/tenant-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAQjE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,WAAW,GACjB,MAAM,CAiJR"}
@@ -1,6 +1,14 @@
1
+ import { placeholderForTenantRoot } from "../schema/v2/tenant-policy.js";
2
+ import { unexpandedSubtreeError } from "./tenant-placeholders.js";
3
+ const NEVER_CROSS_ROOTS = " The same ID value can name different tenants in different root tables: " +
4
+ "never compare one root's placeholder with another root's column.";
1
5
  /**
2
6
  * Build the tenant policy + runtime scope block for NL→SQL prompts.
3
7
  * This block is always injected when a tenant policy exists (security boundary).
8
+ *
9
+ * A `subtree` scope must be expanded into per-root IDs first (`ask()` does this
10
+ * through `resolveTenantDescendants`); an unexpanded one throws
11
+ * `SUBTREE_NOT_RESOLVABLE`.
4
12
  */
5
13
  export function buildTenantPromptBlock(policy, scope) {
6
14
  const lines = [];
@@ -58,25 +66,45 @@ export function buildTenantPromptBlock(policy, scope) {
58
66
  switch (access.kind) {
59
67
  case "ids": {
60
68
  const rootLabel = policy.roots.find((r) => r.id === access.tenantRoot)?.label ?? access.tenantRoot;
61
- const placeholder = `:tenant_${rootLabel.toLowerCase().replace(/[^a-z0-9]+/g, "_")}_ids`;
69
+ const placeholder = placeholderForTenantRoot({ id: access.tenantRoot, label: rootLabel });
62
70
  lines.push(` Access: ${rootLabel} IDs = ${placeholder}`);
71
+ // With several roots the model also sees other roots' columns (an expanded
72
+ // subtree with IDs at its root only is an `ids` scope), so pair this one too.
73
+ // A single-root policy keeps its block unchanged.
74
+ const pairColumns = policy.roots.length > 1;
75
+ if (pairColumns) {
76
+ const columns = columnsHoldingRootIds(policy, access.tenantRoot);
77
+ if (columns.length > 0)
78
+ lines.push(` columns: ${columns.join(", ")}`);
79
+ }
63
80
  lines.push(` Use ${placeholder} as the parameter placeholder for tenant predicates.`);
81
+ if (pairColumns)
82
+ lines.push(NEVER_CROSS_ROOTS);
64
83
  break;
65
84
  }
66
- case "subtree": {
67
- const rootLabel = policy.roots.find((r) => r.id === access.tenantRoot)?.label ?? access.tenantRoot;
68
- const placeholder = `:tenant_${rootLabel.toLowerCase().replace(/[^a-z0-9]+/g, "_")}_ids`;
69
- lines.push(` Access: ${rootLabel} subtree from IDs = ${placeholder} (include all descendants)`);
70
- lines.push(` Use ${placeholder} as the parameter placeholder for tenant predicates.`);
71
- break;
72
- }
85
+ case "subtree":
86
+ throw unexpandedSubtreeError(access.tenantRoot, "buildTenantPromptBlock()");
73
87
  case "multi_root": {
74
- lines.push(" Access: multiple roots —");
88
+ // Each root table has its own ID space (an expanded subtree is a multi_root
89
+ // scope), so name the columns each placeholder may be compared with.
90
+ lines.push(" Access: multiple roots. Each placeholder holds the IDs of one tenant root; " +
91
+ "compare it only with the columns listed under it:");
92
+ // The tenant guardrail checks every root the scope names as a root table (#341), so a
93
+ // child root in the scope can't be filtered through its parent's foreign key: don't
94
+ // offer that column under the parent's placeholder.
95
+ const covered = new Set(access.scopes.map((s) => s.tenantRoot));
75
96
  for (const s of access.scopes) {
76
97
  const rootLabel = policy.roots.find((r) => r.id === s.tenantRoot)?.label ?? s.tenantRoot;
77
- const placeholder = `:tenant_${rootLabel.toLowerCase().replace(/[^a-z0-9]+/g, "_")}_ids`;
78
- lines.push(` - ${rootLabel} IDs = ${placeholder}`);
98
+ // A level an expanded subtree covers with no IDs: its placeholder binds nothing.
99
+ const empty = s.ids.length === 0 ? " (no IDs in this scope: don't read this table)" : "";
100
+ lines.push(` - ${rootLabel} IDs = ${placeholderForTenantRoot({ id: s.tenantRoot, label: rootLabel })}${empty}`);
101
+ const columns = columnsHoldingRootIds(policy, s.tenantRoot, covered);
102
+ if (columns.length > 0)
103
+ lines.push(` columns: ${columns.join(", ")}`);
79
104
  }
105
+ lines.push(NEVER_CROSS_ROOTS);
106
+ lines.push(" A root table listed here that the query reads must itself be filtered with its own placeholder; " +
107
+ "filtering it only through its parent's foreign key or a joined ancestor is not enough.");
80
108
  break;
81
109
  }
82
110
  case "global":
@@ -124,4 +152,44 @@ export function buildTenantPromptBlock(policy, scope) {
124
152
  lines.push("--- END TENANT POLICY ---");
125
153
  return lines.join("\n");
126
154
  }
155
+ /**
156
+ * The columns whose values are IDs of `rootId`, per the policy, in a stable order:
157
+ * the root's own `tenantIdColumn`; each child root's foreign key to it
158
+ * (`roots[].parent`, `hierarchy[]`), unless that child is in `coveredRoots` (the guardrail
159
+ * checks a covered child on its own placeholder); each scoped table's direct column for it;
160
+ * and each polymorphic ID column, with the discriminator value that points at it.
161
+ * A table scoped through a join path is filtered on the root's own column after
162
+ * the join, as the join-path lines of the prompt say, so it adds no column here.
163
+ */
164
+ function columnsHoldingRootIds(policy, rootId, coveredRoots = new Set()) {
165
+ const root = policy.roots.find((r) => r.id === rootId);
166
+ const columns = [];
167
+ const add = (column) => {
168
+ if (!columns.includes(column))
169
+ columns.push(column);
170
+ };
171
+ if (root)
172
+ add(root.tenantIdColumn);
173
+ for (const child of policy.roots) {
174
+ if (child.parent?.root === rootId && !coveredRoots.has(child.id))
175
+ add(child.parent.foreignKey);
176
+ }
177
+ for (const edge of policy.hierarchy) {
178
+ if (edge.parent === rootId && !coveredRoots.has(edge.child))
179
+ add(edge.foreignKey);
180
+ }
181
+ for (const st of policy.scopedTables) {
182
+ for (const path of st.scopeThrough) {
183
+ if (path.root === rootId && "column" in path)
184
+ add(path.column);
185
+ }
186
+ }
187
+ for (const pt of policy.polymorphicTables) {
188
+ for (const [typeValue, target] of Object.entries(pt.mapping)) {
189
+ if (target === rootId)
190
+ add(`${pt.idColumn} (where ${pt.typeColumn} = '${typeValue}')`);
191
+ }
192
+ }
193
+ return columns;
194
+ }
127
195
  //# sourceMappingURL=tenant-prompt.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"tenant-prompt.js","sourceRoot":"","sources":["../../src/sql/tenant-prompt.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,KAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,YAAY;IACZ,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;YAC5B,CAAC,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG;YAClG,CAAC,CAAC,cAAc,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACpE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;gBACnF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,iBAAiB,IAAI,CAAC,MAAM,KAAK,SAAS,SAAS,CAAC,CAAC;gBAC9E,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,iBAAiB,QAAQ,KAAK,SAAS,SAAS,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,qBAAqB;IACrB,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAClF,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,UAAU,iBAAiB,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,KAAK,IAAI,UAAU,CAAC;gBACrF,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC;YACnG,MAAM,WAAW,GAAG,WAAW,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,UAAU,WAAW,EAAE,CAAC,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,WAAW,sDAAsD,CAAC,CAAC;YACvF,MAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC;YACnG,MAAM,WAAW,GAAG,WAAW,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,uBAAuB,WAAW,4BAA4B,CAAC,CAAC;YACjG,KAAK,CAAC,IAAI,CAAC,SAAS,WAAW,sDAAsD,CAAC,CAAC;YACvF,MAAM;QACR,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC;gBACzF,MAAM,WAAW,GAAG,WAAW,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC;gBACzF,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,UAAU,WAAW,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,QAAQ;YACX,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,MAAM,kCAAkC,CAAC,CAAC;YACzF,MAAM;IACV,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mBAAmB;IACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IACxF,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IAClF,KAAK,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC/F,KAAK,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC/F,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAExC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
1
+ {"version":3,"file":"tenant-prompt.js","sourceRoot":"","sources":["../../src/sql/tenant-prompt.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,iBAAiB,GACrB,2EAA2E;IAC3E,kEAAkE,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,KAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,YAAY;IACZ,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;YAC5B,CAAC,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG;YAClG,CAAC,CAAC,cAAc,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACpE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;gBACnF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,iBAAiB,IAAI,CAAC,MAAM,KAAK,SAAS,SAAS,CAAC,CAAC;gBAC9E,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,iBAAiB,QAAQ,KAAK,SAAS,SAAS,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,qBAAqB;IACrB,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAClF,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,UAAU,iBAAiB,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,KAAK,IAAI,UAAU,CAAC;gBACrF,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC;YACnG,MAAM,WAAW,GAAG,wBAAwB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,UAAU,WAAW,EAAE,CAAC,CAAC;YAC1D,2EAA2E;YAC3E,8EAA8E;YAC9E,kDAAkD;YAClD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,SAAS,WAAW,sDAAsD,CAAC,CAAC;YACvF,IAAI,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC/C,MAAM;QACR,CAAC;QACD,KAAK,SAAS;YACZ,MAAM,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;QAC9E,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,4EAA4E;YAC5E,qEAAqE;YACrE,KAAK,CAAC,IAAI,CACR,+EAA+E;gBAC7E,mDAAmD,CACtD,CAAC;YACF,sFAAsF;YACtF,oFAAoF;YACpF,oDAAoD;YACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC;gBACzF,iFAAiF;gBACjF,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,UAAU,wBAAwB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;gBACnH,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,oGAAoG;gBAClG,wFAAwF,CAC3F,CAAC;YACF,MAAM;QACR,CAAC;QACD,KAAK,QAAQ;YACX,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,MAAM,kCAAkC,CAAC,CAAC;YACzF,MAAM;IACV,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mBAAmB;IACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IACxF,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IAClF,KAAK,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC/F,KAAK,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC/F,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAExC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAC5B,MAA8B,EAC9B,MAAc,EACd,eAAoC,IAAI,GAAG,EAAE;IAE7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC;IACF,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,WAAW,EAAE,CAAC,UAAU,OAAO,SAAS,IAAI,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
@@ -2,7 +2,9 @@ import type { NormalizedTenantPolicy } from "../schema/v2/tenant-policy.js";
2
2
  import { type TenantScope } from "../schema/v2/tenant-policy.js";
3
3
  /**
4
4
  * Validate a `TenantScope` input against a tenant policy before prompt generation.
5
- * Throws `TenantScopeError` on failure.
5
+ * Throws `TenantScopeError` on failure, and `SchemaParseError` when two of the
6
+ * policy's roots derive the same placeholder (the loader rejects that too; this
7
+ * covers a policy built in code).
6
8
  */
7
9
  export declare function validateTenantScope(tenantPolicy: NormalizedTenantPolicy, tenantScope: TenantScope | undefined): void;
8
10
  //# sourceMappingURL=tenant-scope-validate.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"tenant-scope-validate.d.ts","sourceRoot":"","sources":["../../src/sql/tenant-scope-validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEpF;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,sBAAsB,EACpC,WAAW,EAAE,WAAW,GAAG,SAAS,GACnC,IAAI,CA2DN"}
1
+ {"version":3,"file":"tenant-scope-validate.d.ts","sourceRoot":"","sources":["../../src/sql/tenant-scope-validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,sBAAsB,EACpC,WAAW,EAAE,WAAW,GAAG,SAAS,GACnC,IAAI,CA6DN"}
@@ -1,10 +1,13 @@
1
1
  import { TenantScopeError } from "../errors.js";
2
- import { tenantScopeSchema } from "../schema/v2/tenant-policy.js";
2
+ import { assertDistinctRootPlaceholders, tenantScopeSchema, } from "../schema/v2/tenant-policy.js";
3
3
  /**
4
4
  * Validate a `TenantScope` input against a tenant policy before prompt generation.
5
- * Throws `TenantScopeError` on failure.
5
+ * Throws `TenantScopeError` on failure, and `SchemaParseError` when two of the
6
+ * policy's roots derive the same placeholder (the loader rejects that too; this
7
+ * covers a policy built in code).
6
8
  */
7
9
  export function validateTenantScope(tenantPolicy, tenantScope) {
10
+ assertDistinctRootPlaceholders(tenantPolicy.roots);
8
11
  // Fail closed: policy exists but no scope
9
12
  if (!tenantScope) {
10
13
  throw new TenantScopeError("Tenant policy is active but no tenantScope was provided. " +
@@ -1 +1 @@
1
- {"version":3,"file":"tenant-scope-validate.js","sourceRoot":"","sources":["../../src/sql/tenant-scope-validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,iBAAiB,EAAoB,MAAM,+BAA+B,CAAC;AAEpF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoC,EACpC,WAAoC;IAEpC,0CAA0C;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,gBAAgB,CACxB,2DAA2D;YACzD,gFAAgF,EAClF,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CACxB,8BAA8B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACpD,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAElC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CACxB,sDAAsD,MAAM,CAAC,UAAU,KAAK;oBAC1E,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,SAAS;YACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CACxB,sDAAsD,MAAM,CAAC,UAAU,KAAK;oBAC1E,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,YAAY;YACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,gBAAgB,CACxB,6DAA6D,KAAK,CAAC,UAAU,KAAK;wBAChF,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM;QAER,KAAK,QAAQ;YACX,kDAAkD;YAClD,MAAM;IACV,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"tenant-scope-validate.js","sourceRoot":"","sources":["../../src/sql/tenant-scope-validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoC,EACpC,WAAoC;IAEpC,8BAA8B,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAEnD,0CAA0C;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,gBAAgB,CACxB,2DAA2D;YACzD,gFAAgF,EAClF,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CACxB,8BAA8B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACpD,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAElC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CACxB,sDAAsD,MAAM,CAAC,UAAU,KAAK;oBAC1E,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,SAAS;YACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CACxB,sDAAsD,MAAM,CAAC,UAAU,KAAK;oBAC1E,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,YAAY;YACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,gBAAgB,CACxB,6DAA6D,KAAK,CAAC,UAAU,KAAK;wBAChF,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM;QAER,KAAK,QAAQ;YACX,kDAAkD;YAClD,MAAM;IACV,CAAC;AACH,CAAC"}
@@ -1,10 +1,40 @@
1
- import type { DialectSpec } from "./dialect-spec.js";
1
+ import { type DialectSpec } from "./dialect-spec.js";
2
2
  /**
3
- * Dialect-agnostic read-only SELECT guardrail. Not a SQL parser — blocks obvious
4
- * foot-guns and multi-statement abuse. The dialect's `extraForbiddenKeywords`
5
- * augment the base list; `extraValidate` runs after base checks pass.
3
+ * Read-only SELECT check for model-generated SQL. It is **defense in depth**, not a
4
+ * security boundary: it lexes SQL the way the target engine does and rejects shapes
5
+ * that are clearly not a single read-only query, but it is not a SQL parser and cannot
6
+ * prove a statement is harmless. Run generated SQL under a database role that can only
7
+ * read what the caller may see.
8
+ *
9
+ * Checks, in order (the first failure throws {@link SqlValidationError}):
10
+ *
11
+ * 1. `SQL_EMPTY` — nothing left after trimming.
12
+ * 2. `SQL_UNTERMINATED` — a string, quoted identifier, dollar-quoted string, or block
13
+ * comment never closes. Fails closed rather than guessing where it ends.
14
+ * 3. `SQL_MULTI_STATEMENT` — any `;` other than a single trailing one.
15
+ * 4. `SQL_COMMENT` — any comment (`--`, `/* *\/`, and MySQL `#`).
16
+ * 5. `SQL_NOT_SELECT_OR_WITH` — the first token (after any `(`) is not `SELECT`/`WITH`.
17
+ * 6. `SQL_FORBIDDEN_KEYWORD` — an unquoted keyword from the shared denylist or the
18
+ * dialect's `extraForbiddenKeywords`.
19
+ * 7. `SQL_FORBIDDEN_FUNCTION` — a call (`name(`) to a function in the dialect's
20
+ * `blockedFunctions` (side-effecting or file/network/sleep functions).
21
+ *
22
+ * Then the dialect's `extraValidate` runs on the statement without its trailing `;`.
23
+ *
24
+ * Returns the SQL trimmed and otherwise as written: a single trailing `;` (and any
25
+ * whitespace before it) is kept. A host that wraps the statement, for example in a
26
+ * row-cap subquery, removes the terminator first.
27
+ *
28
+ * The lexer follows `dialect.id`. When the id is not a built-in engine family, the SQL
29
+ * must pass under every built-in lexer with every built-in denylist.
6
30
  */
7
31
  export declare function validateSelectSql(dialect: DialectSpec, sql: string): string;
32
+ /**
33
+ * The words `validateSelectSql` rejects unquoted for a dialect, lowercase: the shared denylist
34
+ * and the spec's `extraForbiddenKeywords`, plus every built-in spec's for an id that is no
35
+ * built-in engine family. The NL→SQL prompt quotes names in this set.
36
+ */
37
+ export declare function keywordsRejectedUnquoted(dialect: Pick<DialectSpec, "id" | "backslashEscapes" | "extraForbiddenKeywords">): Set<string>;
8
38
  /** Explanation of guardrails satisfied by a string already passing {@link validateSelectSql}. */
9
39
  export type SelectGuardrailExplain = {
10
40
  statementKind: "select" | "with";
@@ -1 +1 @@
1
- {"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/sql/validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAuBrD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAqD3E;AAED,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC;IACjC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,6FAA6F;AAC7F,wBAAgB,+BAA+B,CAAC,YAAY,EAAE,MAAM,GAAG,sBAAsB,CAgB5F"}
1
+ {"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/sql/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAwCxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAyB3E;AAmFD;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,kBAAkB,GAAG,wBAAwB,CAAC,GAC/E,GAAG,CAAC,MAAM,CAAC,CAIb;AAsCD,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC;IACjC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,6FAA6F;AAC7F,wBAAgB,+BAA+B,CAAC,YAAY,EAAE,MAAM,GAAG,sBAAsB,CAiB5F"}
@@ -1,5 +1,14 @@
1
1
  import { SqlValidationError } from "../errors.js";
2
- import { stripSqlStringLiterals } from "./bind.js";
2
+ import { BUILT_IN_DIALECTS } from "./dialect-spec.js";
3
+ import { ENGINE_LEXER_PROFILES, GENERIC_LEXER, lexSql, lexerProfileFor, } from "./lexer.js";
4
+ /**
5
+ * Keywords rejected in every dialect. Matched against unquoted word tokens only, so
6
+ * `deleted_at`, `"delete"`, and `'delete me'` are unaffected.
7
+ *
8
+ * `into` covers `SELECT … INTO new_table` (creates a table), MySQL `INTO OUTFILE` /
9
+ * `INTO DUMPFILE` / `INTO @var`, and T-SQL `SELECT … INTO`. No read-only SELECT needs it.
10
+ * `merge` covers data-modifying `MERGE` inside a CTE (Postgres 17+) and T-SQL `MERGE`.
11
+ */
3
12
  const BASE_FORBIDDEN = [
4
13
  "insert",
5
14
  "update",
@@ -14,71 +23,163 @@ const BASE_FORBIDDEN = [
14
23
  "analyze",
15
24
  "copy",
16
25
  "call",
26
+ "merge",
27
+ "into",
17
28
  ];
18
29
  function validationError(rule, summary, hint) {
19
30
  return new SqlValidationError(summary, rule, hint);
20
31
  }
21
32
  /**
22
- * Dialect-agnostic read-only SELECT guardrail. Not a SQL parser — blocks obvious
23
- * foot-guns and multi-statement abuse. The dialect's `extraForbiddenKeywords`
24
- * augment the base list; `extraValidate` runs after base checks pass.
33
+ * Read-only SELECT check for model-generated SQL. It is **defense in depth**, not a
34
+ * security boundary: it lexes SQL the way the target engine does and rejects shapes
35
+ * that are clearly not a single read-only query, but it is not a SQL parser and cannot
36
+ * prove a statement is harmless. Run generated SQL under a database role that can only
37
+ * read what the caller may see.
38
+ *
39
+ * Checks, in order (the first failure throws {@link SqlValidationError}):
40
+ *
41
+ * 1. `SQL_EMPTY` — nothing left after trimming.
42
+ * 2. `SQL_UNTERMINATED` — a string, quoted identifier, dollar-quoted string, or block
43
+ * comment never closes. Fails closed rather than guessing where it ends.
44
+ * 3. `SQL_MULTI_STATEMENT` — any `;` other than a single trailing one.
45
+ * 4. `SQL_COMMENT` — any comment (`--`, `/* *\/`, and MySQL `#`).
46
+ * 5. `SQL_NOT_SELECT_OR_WITH` — the first token (after any `(`) is not `SELECT`/`WITH`.
47
+ * 6. `SQL_FORBIDDEN_KEYWORD` — an unquoted keyword from the shared denylist or the
48
+ * dialect's `extraForbiddenKeywords`.
49
+ * 7. `SQL_FORBIDDEN_FUNCTION` — a call (`name(`) to a function in the dialect's
50
+ * `blockedFunctions` (side-effecting or file/network/sleep functions).
51
+ *
52
+ * Then the dialect's `extraValidate` runs on the statement without its trailing `;`.
53
+ *
54
+ * Returns the SQL trimmed and otherwise as written: a single trailing `;` (and any
55
+ * whitespace before it) is kept. A host that wraps the statement, for example in a
56
+ * row-cap subquery, removes the terminator first.
57
+ *
58
+ * The lexer follows `dialect.id`. When the id is not a built-in engine family, the SQL
59
+ * must pass under every built-in lexer with every built-in denylist.
25
60
  */
26
61
  export function validateSelectSql(dialect, sql) {
27
62
  const trimmed = sql.trim();
28
63
  if (!trimmed) {
29
64
  throw validationError("SQL_EMPTY", "Generated SQL is empty after extraction.", "The model reply had no usable ```sql fenced block or the block was blank. Retry with a clearer question or inspect the raw model output with logging.");
30
65
  }
31
- const withoutStrings = stripSqlStringLiterals(trimmed);
32
- if (/;/.test(withoutStrings)) {
33
- const parts = withoutStrings.split(";").map((p) => p.trim()).filter(Boolean);
34
- if (parts.length > 1) {
66
+ const profile = lexerProfileFor(dialect);
67
+ let tokens;
68
+ const keywords = keywordsRejectedUnquoted(dialect);
69
+ if (profile) {
70
+ tokens = checkWithProfile(trimmed, profile, keywords, blockedFunctionsFor(dialect));
71
+ }
72
+ else {
73
+ // Unknown engine: every plausible reading of the SQL must be safe.
74
+ const functions = new Set([...blockedFunctionsFor(dialect), ...allBuiltInFunctions()]);
75
+ tokens = [];
76
+ for (const p of ENGINE_LEXER_PROFILES)
77
+ tokens = checkWithProfile(trimmed, p, keywords, functions);
78
+ }
79
+ const last = tokens[tokens.length - 1];
80
+ dialect.extraValidate?.(isPunct(last, ";") ? trimmed.slice(0, last.start).trim() : trimmed);
81
+ return trimmed;
82
+ }
83
+ function checkWithProfile(sql, profile, keywords, functions) {
84
+ const tokens = lexSql(sql, profile);
85
+ const open = tokens.find((t) => t.unterminated);
86
+ if (open) {
87
+ throw validationError("SQL_UNTERMINATED", `Generated SQL has an unterminated ${describeToken(open)}.`, "A quote, dollar-quote, or block comment never closes, so where the statement ends is ambiguous. Regenerate the query; the validator fails closed rather than guessing.");
88
+ }
89
+ tokens.forEach((t, idx) => {
90
+ if (isPunct(t, ";") && idx !== tokens.length - 1) {
35
91
  throw validationError("SQL_MULTI_STATEMENT", "Multiple SQL statements are not allowed (semicolon separates more than one statement).", "Ask for a single SELECT (WITH … SELECT allowed). Split analytical steps into separate questions or use a CTE instead of multiple statements.");
36
92
  }
93
+ });
94
+ const commentLike = tokens.some((t, idx) => t.kind === "comment" ||
95
+ // `--` / `/*` that this dialect lexes as operators (MySQL `1--1`) are still rejected,
96
+ // matching the historical "no comment markers" policy.
97
+ (t.kind === "punct" &&
98
+ ((t.text === "-" && isAdjacentPunct(t, tokens[idx + 1], "-")) ||
99
+ (t.text === "/" && isAdjacentPunct(t, tokens[idx + 1], "*")))));
100
+ if (commentLike) {
101
+ throw validationError("SQL_COMMENT", "SQL comments (-- or /* … */, and # in MySQL) are not allowed under current guardrails.", "Remove comments from generated SQL; rely on clear column aliases and CTE names instead.");
37
102
  }
38
- if (/--|\/\*/.test(withoutStrings)) {
39
- throw validationError("SQL_COMMENT", "SQL comments (-- or /* … */) are not allowed under current guardrails.", "Remove comments from generated SQL; rely on clear column aliases and CTE names instead.");
103
+ const head = headToken(tokens);
104
+ if (head?.kind !== "word" || (head.lower !== "select" && head.lower !== "with")) {
105
+ const got = head ? head.value.toLowerCase() : "";
106
+ throw validationError("SQL_NOT_SELECT_OR_WITH", `SQL must start with SELECT or WITH (got '${got || "none"}').`, "Regenerate as a read-only SELECT (optionally with WITH). INSERT/UPDATE/DELETE and procedural calls are blocked in dev guardrails.");
40
107
  }
41
- const head = firstMeaningfulToken(withoutStrings);
42
- if (head !== "select" && head !== "with") {
43
- throw validationError("SQL_NOT_SELECT_OR_WITH", `SQL must start with SELECT or WITH (got '${head || "none"}').`, "Regenerate as a read-only SELECT (optionally with WITH). INSERT/UPDATE/DELETE and procedural calls are blocked in dev guardrails.");
44
- }
45
- const lower = withoutStrings.toLowerCase();
46
- const forbidden = [...BASE_FORBIDDEN, ...(dialect.extraForbiddenKeywords ?? [])];
47
- for (const word of forbidden) {
48
- const re = new RegExp(`\\b${word}\\b`, "i");
49
- if (re.test(lower)) {
50
- throw validationError("SQL_FORBIDDEN_KEYWORD", `Forbidden keyword in generated SQL: ${word.toUpperCase()}.`, `Matched whole-word guardrail keyword "${word}". This build allows read-only SELECT shape only; DDL/DML and similar verbs are rejected.`);
108
+ for (const t of tokens) {
109
+ if (t.kind === "word" && keywords.has(t.lower)) {
110
+ throw validationError("SQL_FORBIDDEN_KEYWORD", `Forbidden keyword in generated SQL: ${t.lower.toUpperCase()}.`, `Matched whole-word guardrail keyword "${t.lower}". This build allows read-only SELECT shape only; DDL/DML, SELECT … INTO, and similar verbs are rejected.`);
51
111
  }
52
112
  }
53
- const normalized = trimmed.replace(/;\s*$/, "").trim();
54
- dialect.extraValidate?.(normalized);
55
- return normalized;
113
+ tokens.forEach((t, idx) => {
114
+ const nameLike = t.kind === "word" || t.kind === "quoted_identifier" || (t.kind === "string" && t.quote === '"');
115
+ if (!nameLike)
116
+ return;
117
+ const name = t.kind === "string" ? t.text.slice(1, -1).toLowerCase() : t.lower;
118
+ if (functions.has(name) && isPunct(tokens[idx + 1], "(")) {
119
+ throw validationError("SQL_FORBIDDEN_FUNCTION", `Forbidden function in generated SQL: ${name}().`, `"${name}" has side effects (writes, file or network access, sleeping, session changes) and is blocked for this dialect. Remove the call.`);
120
+ }
121
+ });
122
+ return tokens;
123
+ }
124
+ /**
125
+ * The words `validateSelectSql` rejects unquoted for a dialect, lowercase: the shared denylist
126
+ * and the spec's `extraForbiddenKeywords`, plus every built-in spec's for an id that is no
127
+ * built-in engine family. The NL→SQL prompt quotes names in this set.
128
+ */
129
+ export function keywordsRejectedUnquoted(dialect) {
130
+ const keywords = forbiddenKeywordsFor(dialect);
131
+ if (!lexerProfileFor(dialect))
132
+ for (const word of allBuiltInKeywords())
133
+ keywords.add(word.toLowerCase());
134
+ return keywords;
135
+ }
136
+ function forbiddenKeywordsFor(dialect) {
137
+ return new Set([...BASE_FORBIDDEN, ...(dialect.extraForbiddenKeywords ?? [])].map((w) => w.toLowerCase()));
138
+ }
139
+ function blockedFunctionsFor(dialect) {
140
+ return new Set((dialect.blockedFunctions ?? []).map((w) => w.toLowerCase()));
141
+ }
142
+ function allBuiltInKeywords() {
143
+ return Object.values(BUILT_IN_DIALECTS).flatMap((d) => [...(d.extraForbiddenKeywords ?? [])]);
144
+ }
145
+ function allBuiltInFunctions() {
146
+ return Object.values(BUILT_IN_DIALECTS).flatMap((d) => [...(d.blockedFunctions ?? [])]);
147
+ }
148
+ function isPunct(t, text) {
149
+ return t?.kind === "punct" && t.text === text;
150
+ }
151
+ function isAdjacentPunct(t, next, text) {
152
+ return isPunct(next, text) && next.start === t.end;
153
+ }
154
+ /** First significant token, skipping leading `(` so `(SELECT …) UNION (SELECT …)` passes. */
155
+ function headToken(tokens) {
156
+ return tokens.find((t) => !isPunct(t, "("));
157
+ }
158
+ function describeToken(t) {
159
+ if (t.kind === "comment")
160
+ return "block comment";
161
+ if (t.kind === "quoted_identifier")
162
+ return "quoted identifier";
163
+ if (t.quote?.startsWith("$"))
164
+ return "dollar-quoted string";
165
+ return "string literal";
56
166
  }
57
167
  /** Build a structured summary for hosts/CLI `--explain`; input must already be validated. */
58
168
  export function buildSelectGuardrailExplanation(validatedSql) {
59
- const trimmed = validatedSql.trim();
60
- const head = firstMeaningfulToken(stripSqlStringLiterals(trimmed));
61
- const statementKind = head === "with" ? "with" : "select";
169
+ const head = headToken(lexSql(validatedSql.trim(), GENERIC_LEXER));
170
+ const statementKind = head?.lower === "with" ? "with" : "select";
62
171
  return {
63
172
  statementKind,
64
173
  checksVerified: [
65
174
  "non_empty_sql",
175
+ "no_unterminated_literals_or_comments",
66
176
  "single_statement",
67
177
  "no_line_or_block_comments",
68
178
  "leading_select_or_with",
69
179
  "no_blocked_write_or_ddl_keywords",
180
+ "no_blocked_side_effect_functions",
70
181
  ],
71
- remediationNote: "Heuristic Phase-2 checks only—not a full SQL parser or production policy engine. Always review before trusted execution.",
182
+ remediationNote: "Heuristic, lexer-based defense-in-depth checks only—not a SQL parser and not a security boundary. Execute generated SQL under a read-only database role, and review it before trusted execution.",
72
183
  };
73
184
  }
74
- function firstMeaningfulToken(withoutStrings) {
75
- const token = /([a-zA-Z_][\w$]*|"[^"]*")/.exec(withoutStrings.trim());
76
- if (!token)
77
- return "";
78
- let t = token[1];
79
- if (t.startsWith('"') && t.endsWith('"')) {
80
- t = t.slice(1, -1);
81
- }
82
- return t.toLowerCase();
83
- }
84
185
  //# sourceMappingURL=validate.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/sql/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA8B,MAAM,cAAc,CAAC;AAE9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAEnD,MAAM,cAAc,GAAsB;IACxC,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,MAAM;CACP,CAAC;AAEF,SAAS,eAAe,CAAC,IAA2B,EAAE,OAAe,EAAE,IAAY;IACjF,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAoB,EAAE,GAAW;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,eAAe,CACnB,WAAW,EACX,0CAA0C,EAC1C,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,eAAe,CACnB,qBAAqB,EACrB,wFAAwF,EACxF,8IAA8I,CAC/I,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,MAAM,eAAe,CACnB,aAAa,EACb,wEAAwE,EACxE,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,eAAe,CACnB,wBAAwB,EACxB,4CAA4C,IAAI,IAAI,MAAM,KAAK,EAC/D,mIAAmI,CACpI,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,eAAe,CACnB,uBAAuB,EACvB,uCAAuC,IAAI,CAAC,WAAW,EAAE,GAAG,EAC5D,yCAAyC,IAAI,2FAA2F,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC;AACpB,CAAC;AASD,6FAA6F;AAC7F,MAAM,UAAU,+BAA+B,CAAC,YAAoB;IAClE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,oBAAoB,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAsB,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7E,OAAO;QACL,aAAa;QACb,cAAc,EAAE;YACd,eAAe;YACf,kBAAkB;YAClB,2BAA2B;YAC3B,wBAAwB;YACxB,kCAAkC;SACnC;QACD,eAAe,EACb,0HAA0H;KAC7H,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,cAAsB;IAClD,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAClB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC"}
1
+ {"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/sql/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA8B,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,MAAM,EACN,eAAe,GAGhB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,cAAc,GAAsB;IACxC,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC;AAEF,SAAS,eAAe,CAAC,IAA2B,EAAE,OAAe,EAAE,IAAY;IACjF,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAoB,EAAE,GAAW;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,eAAe,CACnB,WAAW,EACX,0CAA0C,EAC1C,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAkB,CAAC;IACvB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,qBAAqB;YAAE,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAW,EACX,OAAwB,EACxB,QAA6B,EAC7B,SAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,eAAe,CACnB,kBAAkB,EAClB,qCAAqC,aAAa,CAAC,IAAI,CAAC,GAAG,EAC3D,wKAAwK,CACzK,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACxB,IAAI,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,eAAe,CACnB,qBAAqB,EACrB,wFAAwF,EACxF,8IAA8I,CAC/I,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CACT,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,sFAAsF;QACtF,uDAAuD;QACvD,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO;YACjB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,eAAe,CACnB,aAAa,EACb,wFAAwF,EACxF,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,eAAe,CACnB,wBAAwB,EACxB,4CAA4C,GAAG,IAAI,MAAM,KAAK,EAC9D,mIAAmI,CACpI,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,eAAe,CACnB,uBAAuB,EACvB,uCAAuC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAC/D,yCAAyC,CAAC,CAAC,KAAK,2GAA2G,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,QAAQ,GACZ,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QAClG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/E,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,eAAe,CACnB,wBAAwB,EACxB,wCAAwC,IAAI,KAAK,EACjD,IAAI,IAAI,kIAAkI,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAgF;IAEhF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;QAAE,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAoD;IAChF,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoB;IAC/C,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,OAAO,CAAC,CAAuB,EAAE,IAAY;IACpD,OAAO,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,CAAW,EAAE,IAA0B,EAAE,IAAY;IAC5E,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAK,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,MAA2B;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,CAAW;IAChC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC5D,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AASD,6FAA6F;AAC7F,MAAM,UAAU,+BAA+B,CAAC,YAAoB;IAClE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAsB,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpF,OAAO;QACL,aAAa;QACb,cAAc,EAAE;YACd,eAAe;YACf,sCAAsC;YACtC,kBAAkB;YAClB,2BAA2B;YAC3B,wBAAwB;YACxB,kCAAkC;YAClC,kCAAkC;SACnC;QACD,eAAe,EACb,kMAAkM;KACrM,CAAC;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@askdb/core",
3
- "version": "1.0.0-beta.42",
3
+ "version": "1.0.0-beta.44",
4
4
  "description": "AskDB core: dialect-agnostic NL→SQL pipeline. Provides ask() orchestration, schema/IR types, modes, logging, and retrieval input. Bring your own dialect (e.g. @askdb/postgres).",
5
5
  "keywords": [
6
6
  "askdb",
@@ -11,7 +11,7 @@
11
11
  "ai-sdk",
12
12
  "schema-v2"
13
13
  ],
14
- "homepage": "https://github.com/Ygilany/AskDB#readme",
14
+ "homepage": "https://askdb.tools/reference/core-api/",
15
15
  "bugs": {
16
16
  "url": "https://github.com/Ygilany/AskDB/issues"
17
17
  },
@@ -23,6 +23,7 @@
23
23
  "license": "Apache-2.0",
24
24
  "author": "Yahya Gilany",
25
25
  "type": "module",
26
+ "sideEffects": false,
26
27
  "main": "./dist/index.js",
27
28
  "types": "./dist/index.d.ts",
28
29
  "exports": {
@@ -39,17 +40,20 @@
39
40
  "NOTICE"
40
41
  ],
41
42
  "engines": {
42
- "node": ">=22.12"
43
+ "node": ">=22.23.4"
43
44
  },
44
45
  "dependencies": {
45
- "ai": "^7.0.51",
46
46
  "gray-matter": "^4.0.3",
47
- "pino": "^10.3.1",
48
- "zod": "^4.4.3"
47
+ "pino": "^10.4.0",
48
+ "zod": "^4.6.7"
49
+ },
50
+ "peerDependencies": {
51
+ "ai": "^6.0.0 || ^7.0.51"
49
52
  },
50
53
  "devDependencies": {
54
+ "ai": "^7.0.51",
51
55
  "typescript": "^6.0.3",
52
- "vitest": "^4.1.10"
56
+ "vitest": "^5.0.5"
53
57
  },
54
58
  "scripts": {
55
59
  "build": "tsc -p tsconfig.build.json",
@@ -1,6 +0,0 @@
1
- export type TabularResult = {
2
- columns: string[];
3
- rows: unknown[][];
4
- };
5
- export declare function executeReadOnlySelect(connectionString: string, sql: string): Promise<TabularResult>;
6
- //# sourceMappingURL=postgres.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/exec/postgres.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;CACnB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAuBzG"}