@askdb/core 1.0.0-beta.46 → 1.0.0-beta.48

package/README.md

@@ -4,7 +4,7 @@ NL→SQL pipeline for AskDB. Provides `ask()` orchestration, schema/IR types, mo
 
 > **Status:** pre-release beta (`1.0.0-beta.x`); public APIs may still change before 1.0. `0.3.0` moved the Postgres dialect and `@askdb/core/postgres` to `@askdb/postgres`. Runtime AI provider construction lives in `@askdb/ai`; core remains BYO-model and does not read `process.env`. See [`docs/adrs/0002-integration-package-layout.md`](https://github.com/Ygilany/AskDB/blob/main/docs/adrs/0002-integration-package-layout.md), [`docs/adrs/0005-askdb-config-and-env-bootstrap.md`](https://github.com/Ygilany/AskDB/blob/main/docs/adrs/0005-askdb-config-and-env-bootstrap.md), and [`docs/adrs/0006-ai-provider-integration-strategy.md`](https://github.com/Ygilany/AskDB/blob/main/docs/adrs/0006-ai-provider-integration-strategy.md).
 
-> **Security model:** `ask()` returns SQL and never executes it. Its SQL checks (single `SELECT`/`WITH` statement (with a SQL Server caveat), no comments, no write/DDL keywords, no locking reads, no known side-effecting functions, and the tenant and sensitive-column checks) are heuristic defense in depth that catch common model mistakes. The read-only and sensitive-column checks use a dialect-aware lexer; the tenant check uses a simpler scanner of its own ([#342](https://github.com/Ygilany/AskDB/issues/342)). They are not a SQL parser and not a security boundary. Run generated SQL under a read-only, least-privilege database role and enforce tenant isolation in the database. See [Safety boundaries](https://askdb.tools/concepts/safety-boundaries/).
+> **Security model:** `ask()` returns SQL and never executes it. Its SQL checks (single `SELECT`/`WITH` statement (with a SQL Server caveat), no comments, no write/DDL keywords, no locking reads, no known side-effecting functions, no Unicode-escaped `U&"…"` names on Postgres, and the tenant and sensitive-column checks) are heuristic defense in depth that catch common model mistakes. The read-only and sensitive-column checks use a dialect-aware lexer; the tenant check uses a simpler scanner of its own ([#342](https://github.com/Ygilany/AskDB/issues/342)). They are not a SQL parser and not a security boundary. Run generated SQL under a read-only, least-privilege database role and enforce tenant isolation in the database. See [Safety boundaries](https://askdb.tools/concepts/safety-boundaries/).
 
 ## Install
 

package/dist/ask.d.ts

@@ -72,8 +72,17 @@ export type AskDialectGenerateResult = {
  *     policy, `ask()` runs the tenant guardrail on the returned `sql` (and
  *     `unboundNamedSql`), with its `:tenant_<root>_ids` placeholders still in place,
  *     then substitutes them, regardless of dialect; `strict` policies throw
- *     `TenantGuardrailError`. A `tenantGuardrail` your generator returns adds
- *     findings to that check (`form: "generator"`), never replaces it.
+ *     `TenantGuardrailError`. Under a tenant policy, with any scope but `global`, every
+ *     statement you return must start with `SELECT` or `WITH`, however an engine may
+ *     split it (at a `;`, or on SQL Server at a verb such as `EXEC`): the check can't
+ *     read what a `DO` block, `CALL`, `EXPLAIN` or `SHOW` touches, so it reports
+ *     `NOT_SELECT_OR_WITH` (#698). Nor can it see what a function reads when it runs a
+ *     query or reads a table named in a string, runs SQL over another connection, or sets
+ *     what row-level security reads (`query_to_xml`, `table_to_xml`, `dblink`, `OPENQUERY`,
+ *     `set_config`), so it reports `UNCHECKABLE_FUNCTION` wherever your SQL names one, a
+ *     column named like one included (#702). A
+ *     `tenantGuardrail` your generator returns adds findings to that check
+ *     (`form: "generator"`), never replaces it.
  *   - The sensitive-identifier check runs on your SQL too, unless
  *     `sensitiveGuardrailMode` is `"off"`.
  */
@@ -164,7 +173,7 @@ export type AskPipelineOptions = {
      */
     tenantScope?: TenantScope;
     /**
-     * SQL output mode for tenant placeholders. Default `"sql-params"`
+     * SQL output mode for tenant placeholders in `sql`. Default `"sql-params"`
      * ({@link DEFAULT_TENANT_SQL_MODE}) replaces them with the dialect's driver
      * markers (`$N` for Postgres/CockroachDB, `?` for MySQL/MariaDB/SQLite, `@pN` for
      * SQL Server): run `sql` with `tenantParams`, or `unboundSql` with `params`, never
@@ -174,7 +183,8 @@ export type AskPipelineOptions = {
      * (`TENANT_SQL_MODE_REQUIRED`) before the model call, as it does on every dialect for
      * a value that is neither `"sql-params"` nor `"sql-only"`.
      * `"sql-only"` inlines the IDs as escaped literals, for a caller that can't bind
-     * parameters (a tool that takes one SQL string); it throws `TenantScopeError`
+     * parameters (a tool that takes one SQL string); `unboundSql` still binds them, in
+     * every mode. It throws `TenantScopeError`
      * (`UNESCAPABLE_TENANT_ID`) for a tenant ID that isn't printable ASCII or that
      * contains a backslash.
      */
@@ -224,14 +234,14 @@ export type AskPipelineResult = {
      */
     sql: string;
     /**
-     * Driver markers for every value (business and, in `"sql-params"` mode, tenant).
+     * Driver markers for every value, business and tenant, whatever `tenantSqlMode` is.
      * Execute with `params` — never with `tenantParams`.
      */
     unboundSql?: string;
     /**
      * Values for `unboundSql`, in driver-marker order (array slots on
-     * Postgres/CockroachDB listBinding). In `"sql-params"` mode this already
-     * includes the tenant values — for `?` dialects interleaved in source order,
+     * Postgres/CockroachDB listBinding). With a tenant scope this already
+     * includes the tenant values, in either `tenantSqlMode` — for `?` dialects interleaved in source order,
      * otherwise after the business values. Do not concatenate `tenantParams`.
      */
     params?: QueryParamSlot[];

package/dist/ask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../src/ask.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAKtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAY/B,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE1B,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,CAAC;AAE1D,0EAA0E;AAC1E,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,yGAAyG;IACzG,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,8BAA8B,EAAE,sBAAsB,CAAC;IAC7E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,QAAQ,GAAG;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,0GAA0G;AAC1G,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAC5E,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,OAAO,6BAA6B,EAAE,iBAAiB,CAAC;CAC7E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC;AAE1E,qGAAqG;AACrG,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,wFAAwF;IACxF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,KAAK,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACrC,uDAAuD;IACvD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAC5E;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,+FAA+F;IAC/F,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF,wBAAsB,GAAG,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwPjF"}
+{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../src/ask.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,IAAI,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAKtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAE1B,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAAE,CAAC;AAE1D,0EAA0E;AAC1E,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,yGAAyG;IACzG,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,8BAA8B,EAAE,sBAAsB,CAAC;IAC7E,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,kGAAkG;AAClG,MAAM,MAAM,QAAQ,GAAG;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,0GAA0G;AAC1G,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAC5E,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,OAAO,6BAA6B,EAAE,iBAAiB,CAAC;CAC7E,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,gBAAgB,GAAG,WAAW,GAAG,UAAU,CAAC;AAE1E,qGAAqG;AACrG,MAAM,MAAM,eAAe,GAAG;IAC5B,YAAY,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,OAAO,EAAE,eAAe,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,yCAAyC,CAAC,EAAE,OAAO,CAAC;IACpD,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,wFAAwF;IACxF,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;;;;;OAgBG;IACH,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IACpD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,sBAAsB,GAAG,KAAK,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACrC,uDAAuD;IACvD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IAC9C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,2BAA2B,EAAE,qBAAqB,CAAC;IAC5E;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,+FAA+F;IAC/F,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF,wBAAsB,GAAG,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoNjF"}

package/dist/ask.js

@@ -5,8 +5,7 @@ import { unqualifiedNamespaceFor } from "./sql/prompt.js";
 import { promptIdentifierQuoter } from "./sql/prompt-identifiers.js";
 import { BUILT_IN_DIALECTS, getDialectSpec, isBuiltInDialectId, } from "./sql/dialect-spec.js";
 import { generateSelectSqlForAsk } from "./sql/generate.js";
-import { decide, sensitiveGuardrailResult, tenantFindings, tenantGuardrailResult, throwIfDenied, } from "./sql/guardrail-decide.js";
-import { evaluateGuardrails, guardrailPlan, logGuardrailVerdict } from "./sql/guardrails.js";
+import { enforceGuardrails } from "./sql/guardrails.js";
 import { bindTenantIntoUnboundSql } from "./sql/rebind.js";
 import { assertTenantSqlMode, DEFAULT_TENANT_SQL_MODE, resolveTenantSql, } from "./sql/tenant-placeholders.js";
 import { expandTenantScope, } from "./sql/tenant-scope-expand.js";
@@ -75,17 +74,11 @@ export async function ask(options) {
     // The guardrails run on the model's forms before AskDB renders them (ADR 0010): its
     // bound `sql` and its `sql-unbound` block, with the `:tenant_<root>_ids` placeholders
     // still in place. Rendering below only swaps placeholders for literals or driver
-    // markers, so one check covers every tenantSqlMode, dialect and output form. A custom
-    // AskDialect (no DialectSpec) gets no read-only check: it may target non-SELECT SQL.
+    // markers, so one check covers every tenantSqlMode, dialect and output form. A deny
+    // throws here, after logging pipeline.failed.
     const tenant = tenantPolicy && tenantScope ? { policy: tenantPolicy, scope: tenantScope } : undefined;
-    const { checks, modes } = guardrailPlan("ask", {
-        dialect: dialectSpec,
-        schema: options.schema,
-        tenantPolicy: tenant?.policy,
-        sensitiveGuardrailMode: options.sensitiveGuardrailMode,
-    });
-    const runSensitive = checks.includes("sensitive");
-    const findings = evaluateGuardrails({
+    const enforced = enforceGuardrails({
+        path: "ask",
         forms: {
             sql: generated.sql,
             ...(generated.unboundNamedSql !== undefined ? { template: generated.unboundNamedSql } : {}),
@@ -93,35 +86,19 @@ export async function ask(options) {
         dialect: dialectSpec,
         schema: options.schema,
         ...(tenant ? { tenant } : {}),
-    }, checks);
-    if (tenant)
-        findings.push(...generatorFindings(generated.tenantGuardrail));
-    const verdict = decide(findings, modes, "return");
-    logGuardrailVerdict(logger, verdict, { tenantPolicy, sensitiveChecked: runSensitive });
-    try {
-        throwIfDenied(verdict, modes, "return");
-    }
-    catch (e) {
-        // A denied run ends in pipeline.failed, as generateSelectSql() logs it (and as a
-        // read-only failure was logged when that check ran inside generation).
-        logger?.error({ event: AskDbLogEvent.PipelineFailed, phase: "generate", errMessage: e.message }, "nl-to-sql generate failed");
-        throw e;
-    }
+        sensitiveGuardrailMode: options.sensitiveGuardrailMode,
+        generatorTenantGuardrail: generated.tenantGuardrail,
+        logger,
+    });
     // result.sql is always the model's bound SQL (possibly with tenant literals/
     // markers applied below). Never overwrite it with a re-bound version.
-    const result = { sql: generated.sql, verdict };
+    const result = { sql: generated.sql, verdict: enforced.verdict };
     if (generated.explain !== undefined)
         result.explain = generated.explain;
-    if (tenant) {
-        result.tenantGuardrail = tenantGuardrailResult(findings);
-    }
-    else if (generated.tenantGuardrail !== undefined) {
-        // Without a tenant policy there is no mode to decide with: pass through what a
-        // custom dialect reported.
-        result.tenantGuardrail = generated.tenantGuardrail;
-    }
-    if (runSensitive)
-        result.sensitiveGuardrail = sensitiveGuardrailResult(findings);
+    if (enforced.tenantGuardrail !== undefined)
+        result.tenantGuardrail = enforced.tenantGuardrail;
+    if (enforced.sensitiveGuardrail !== undefined)
+        result.sensitiveGuardrail = enforced.sensitiveGuardrail;
     if (generated.usage !== undefined)
         result.usage = generated.usage;
     // Reuse artifacts: bind the template's business values with the mechanical renderer,
@@ -188,7 +165,8 @@ export async function ask(options) {
         const tenantMode = options.tenantSqlMode ?? DEFAULT_TENANT_SQL_MODE;
         // `sql` carries business values as inlined literals, so its only markers are
         // tenant markers, numbered from the first slot: `sql` runs with `tenantParams`
-        // alone. `unboundSql` runs with the combined `params` (handled below).
+        // alone. `unboundSql` runs with the combined `params` (handled below). The mode
+        // governs `sql` only: `unboundSql` always binds the tenant IDs, as the rebind does.
         const resolved = resolveTenantSql(result.sql, tenant.policy, tenant.scope, tenantMode, 1, dialectSpec);
         result.sql = resolved.sql;
         if (resolved.bindings.length > 0)
@@ -197,55 +175,30 @@ export async function ask(options) {
             result.tenantParams = resolved.params;
         }
         if (result.preparedQuery && result.unboundSql !== undefined && result.params && result.parameters) {
-            if (tenantMode === "sql-only") {
-                result.unboundSql = resolveTenantSql(result.unboundSql, tenant.policy, tenant.scope, "sql-only", 1, dialectSpec).sql;
+            const rendered = bindTenantIntoUnboundSql({ unboundSql: result.unboundSql, params: result.params, bindings: result.parameters }, {
+                namedSql: result.preparedQuery.namedSql,
+                tenantPolicy: tenant.policy,
+                tenantScope: tenant.scope,
+                dialectSpec,
+            });
+            if (rendered) {
+                result.unboundSql = rendered.unboundSql;
+                result.params = rendered.params;
+                result.parameters = rendered.bindings;
             }
             else {
-                const rendered = bindTenantIntoUnboundSql({ unboundSql: result.unboundSql, params: result.params, bindings: result.parameters }, {
-                    namedSql: result.preparedQuery.namedSql,
-                    tenantPolicy: tenant.policy,
-                    tenantScope: tenant.scope,
-                    dialectSpec,
-                });
-                if (rendered) {
-                    result.unboundSql = rendered.unboundSql;
-                    result.params = rendered.params;
-                    result.parameters = rendered.bindings;
-                }
-                else {
-                    dropParameterizeExtras(result);
-                    logger?.debug?.({
-                        event: AskDbLogEvent.PipelineParameterized,
-                        parameterCount: 0,
-                        listParameterCount: 0,
-                        reason: "tenant_param_alignment",
-                    }, "parameterize extras dropped");
-                }
+                dropParameterizeExtras(result);
+                logger?.debug?.({
+                    event: AskDbLogEvent.PipelineParameterized,
+                    parameterCount: 0,
+                    listParameterCount: 0,
+                    reason: "tenant_param_alignment",
+                }, "parameterize extras dropped");
             }
         }
     }
     return result;
 }
-/**
- * A custom generator's `tenantGuardrail`, as tenant findings: its warnings, and one
- * `UNPROVABLE_SCOPE` finding for a failure it reported without any, so it is never
- * dropped. They add to `ask()`'s own check; they never replace it.
- */
-function generatorFindings(reported) {
-    if (!reported)
-        return [];
-    const findings = tenantFindings(reported.warnings ?? [], "generator");
-    if (reported.passed === false && findings.length === 0) {
-        findings.push({
-            check: "tenant",
-            form: "generator",
-            rule: "UNPROVABLE_SCOPE",
-            tableId: "",
-            message: "The custom SQL generator reported a failed tenant guardrail without details.",
-        });
-    }
-    return findings;
-}
 function dropParameterizeExtras(result) {
     delete result.unboundSql;
     delete result.params;

package/dist/ask.js.map

@@ -1 +1 @@
-{"version":3,"file":"ask.js","sourceRoot":"","sources":["../src/ask.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EACL,iBAAiB,EAGjB,cAAc,EACd,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,MAAM,EACN,wBAAwB,EACxB,cAAc,EACd,qBAAqB,EACrB,aAAa,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iBAAiB,GAGlB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAK9E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,GAKrB,MAAM,eAAe,CAAC;AAmRvB,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA2B;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAChD,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;IAE3E,iFAAiF;IACjF,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,YAAY,EAAE,CAAC;QACjB,2BAA2B,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAClD,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,EAAE,IAAI,CACV;YACE,KAAK,EAAE,aAAa,CAAC,oBAAoB;YACzC,SAAS,EAAE,OAAO,CAAC,WAAY,CAAC,MAAM,CAAC,IAAI;YAC3C,WAAW,EAAE,YAAY,CAAC,WAAW;SACtC,EACD,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,4EAA4E;IAC5E,qFAAqF;IACrF,MAAM,WAAW,GACf,YAAY,IAAI,OAAO,CAAC,WAAW;QACjC,CAAC,CAAC,MAAM,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,wBAAwB,CAAC;QAC9F,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC1B,0FAA0F;IAC1F,wFAAwF;IACxF,sFAAsF;IACtF,4EAA4E;IAC5E,IAAI,YAAY,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI;QAAE,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACvG,IAAI,YAAY,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,gBAAgB,CACxB,6FAA6F;YAC3F,gGAAgG;YAChG,qGAAqG;YACrG,uEAAuE,EACzE,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAClD,MAAM,aAAa,GAAG,OAAO,CAAC,yCAAyC,IAAI,KAAK,CAAC;IACjF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,eAAe;IACpE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC;QACzC,OAAO;QACP,MAAM;QACN,aAAa;QACb,oBAAoB,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,oBAAoB,CAAC;QAChG,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CACtC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,KAAK,EACb;QACE,MAAM;QACN,OAAO,EAAE,gBAAgB;QACzB,yCAAyC,EAAE,aAAa,IAAI,SAAS;QACrE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY;QACxC,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe;QAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW;QACX,YAAY;QACZ,WAAW;QACX,wEAAwE;QACxE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KACrD,CACF,CAAC;IACF,oFAAoF;IACpF,sFAAsF;IACtF,iFAAiF;IACjF,sFAAsF;IACtF,qFAAqF;IACrF,MAAM,MAAM,GAAG,YAAY,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE;QAC7C,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,MAAM,EAAE,MAAM;QAC5B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;KACvD,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CACjC;QACE,KAAK,EAAE;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,CAAC,SAAS,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,EACD,MAAM,CACP,CAAC;IACF,IAAI,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,iFAAiF;QACjF,uEAAuE;QACvE,MAAM,EAAE,KAAK,CACX,EAAE,KAAK,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAG,CAAW,CAAC,OAAO,EAAE,EAC5F,2BAA2B,CAC5B,CAAC;QACF,MAAM,CAAC,CAAC;IACV,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,MAAM,GAAsB,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;IAClE,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;IACxE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,eAAe,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;SAAM,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACnD,+EAA+E;QAC/E,2BAA2B;QAC3B,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC;IACrD,CAAC;IACD,IAAI,YAAY;QAAE,MAAM,CAAC,kBAAkB,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACjF,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAElE,qFAAqF;IACrF,wFAAwF;IACxF,uDAAuD;IACvD,IACE,YAAY;QACZ,WAAW;QACX,SAAS,CAAC,eAAe;QACzB,SAAS,CAAC,iBAAiB;QAC3B,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EACjD,CAAC;QACD,MAAM,QAAQ,GAAkB;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,WAAW,CAAC,EAAsB;YAC3C,YAAY,EAAE,WAAW,KAAK,iBAAiB,CAAC,WAAW,CAAC,EAAsB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACxG,QAAQ,EAAE,SAAS,CAAC,eAAe;YACnC,UAAU,EAAE;gBACV,GAAG,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpD,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;oBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,MAAM,EAAE,UAAmB;iBAC5B,CAAC,CAAC;gBACH,GAAG,WAAW,CAAC,SAAS,CAAC,eAAe,EAAE,WAAW,CAAC;aACvD;SACF,CAAC;QACF,MAAM,MAAM,GAAgE,EAAE,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;YACvD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,EAAE,KAAK,EAAE,CACb;oBACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;oBAC1C,cAAc,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,MAAM,EAAE,sBAAsB;iBAC/B,EACD,6BAA6B,CAC9B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,aAAa,GAAG,QAAQ,CAAC;gBAChC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACnC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;gBACrC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,IAAI,CACV;oBACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;oBAC1C,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;oBACrC,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,MAAM;iBAClF,EACD,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,KAAK,EAAE,CACb;gBACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;gBAC1C,cAAc,EAAE,CAAC;gBACjB,kBAAkB,EAAE,CAAC;gBACrB,MAAM,EAAE,aAAa;aACtB,EACD,6BAA6B,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACpE,6EAA6E;QAC7E,+EAA+E;QAC/E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QAC1B,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,cAAc,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC5E,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClG,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;gBAC9B,MAAM,CAAC,UAAU,GAAG,gBAAgB,CAClC,MAAM,CAAC,UAAU,EACjB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,KAAK,EACZ,UAAU,EACV,CAAC,EACD,WAAW,CACZ,CAAC,GAAG,CAAC;YACR,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,wBAAwB,CACvC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,EACrF;oBACE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ;oBACvC,YAAY,EAAE,MAAM,CAAC,MAAM;oBAC3B,WAAW,EAAE,MAAM,CAAC,KAAK;oBACzB,WAAW;iBACZ,CACF,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;oBACxC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;oBAChC,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACN,sBAAsB,CAAC,MAAM,CAAC,CAAC;oBAC/B,MAAM,EAAE,KAAK,EAAE,CACb;wBACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;wBAC1C,cAAc,EAAE,CAAC;wBACjB,kBAAkB,EAAE,CAAC;wBACrB,MAAM,EAAE,wBAAwB;qBACjC,EACD,6BAA6B,CAC9B,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAA2C;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IACtE,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,8EAA8E;SACxF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAyB;IACvD,OAAO,MAAM,CAAC,UAAU,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC;IACrB,OAAO,MAAM,CAAC,UAAU,CAAC;IACzB,OAAO,MAAM,CAAC,aAAa,CAAC;AAC9B,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAoB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI;QACJ,WAAW,EAAE,IAAI,IAAI,EAAE;QACvB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,KAA+B;IACnD,OAAO,OAAQ,KAAoB,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAwB;IAClD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,uGAAuG;AACvG,SAAS,kBAAkB,CAAC,KAAsB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,KAAK,6EAA6E,EACzG,KAAK,CACN,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,IAAiB;IACtC,OAAO;QACL,mFAAmF;QACnF,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC7C,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,KAAK,UAAU,gBAAgB,CAAC,IAM/B;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,IAAI,CACV,EAAE,KAAK,EAAE,aAAa,CAAC,wBAAwB,EAAE,MAAM,EAAE,eAAe,EAAE,EAC1E,8DAA8D,CAC/D,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,wBAAwB,IAAI,kCAAkC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,iBAAiB,CAAC;IACxE,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,CACV;YACE,KAAK,EAAE,aAAa,CAAC,wBAAwB;YAC7C,MAAM,EAAE,iBAAiB;YACzB,WAAW,EAAE,KAAK;YAClB,SAAS;SACV,EACD,mEAAmE,CACpE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,CAAC;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,CACV;YACE,KAAK,EAAE,aAAa,CAAC,wBAAwB;YAC7C,MAAM,EAAE,YAAY;YACpB,CAAC;YACD,SAAS;YACT,WAAW,EAAE,KAAK,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;SAC/D,EACD,+CAA+C,CAChD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,kCAAkC,EAAE,aAAa;QACjD,oBAAoB;QACpB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,CACV;QACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;QAC1C,CAAC;QACD,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,WAAW,EAAE,KAAK,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;KAC/D,EACD,gCAAgC,CACjC,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,MAA2B;IAC7C,OAAO,UAAU,IAAI,MAAM,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"ask.js","sourceRoot":"","sources":["../src/ask.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAGrE,OAAO,EACL,iBAAiB,EAGjB,cAAc,EACd,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GAGjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iBAAiB,GAGlB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAK9E,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,GAKrB,MAAM,eAAe,CAAC;AA6RvB,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAA2B;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAChD,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;IAE3E,iFAAiF;IACjF,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,YAAY,EAAE,CAAC;QACjB,2BAA2B,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAClD,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,EAAE,IAAI,CACV;YACE,KAAK,EAAE,aAAa,CAAC,oBAAoB;YACzC,SAAS,EAAE,OAAO,CAAC,WAAY,CAAC,MAAM,CAAC,IAAI;YAC3C,WAAW,EAAE,YAAY,CAAC,WAAW;SACtC,EACD,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,4EAA4E;IAC5E,qFAAqF;IACrF,MAAM,WAAW,GACf,YAAY,IAAI,OAAO,CAAC,WAAW;QACjC,CAAC,CAAC,MAAM,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,wBAAwB,CAAC;QAC9F,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC1B,0FAA0F;IAC1F,wFAAwF;IACxF,sFAAsF;IACtF,4EAA4E;IAC5E,IAAI,YAAY,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI;QAAE,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACvG,IAAI,YAAY,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,gBAAgB,CACxB,6FAA6F;YAC3F,gGAAgG;YAChG,qGAAqG;YACrG,uEAAuE,EACzE,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAClD,MAAM,aAAa,GAAG,OAAO,CAAC,yCAAyC,IAAI,KAAK,CAAC;IACjF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,eAAe;IACpE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC;QACzC,OAAO;QACP,MAAM;QACN,aAAa;QACb,oBAAoB,EAAE,uBAAuB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,oBAAoB,CAAC;QAChG,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CACtC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,KAAK,EACb;QACE,MAAM;QACN,OAAO,EAAE,gBAAgB;QACzB,yCAAyC,EAAE,aAAa,IAAI,SAAS;QACrE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,YAAY;QACxC,eAAe,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe;QAC9C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW;QACX,YAAY;QACZ,WAAW;QACX,wEAAwE;QACxE,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;KACrD,CACF,CAAC;IACF,oFAAoF;IACpF,sFAAsF;IACtF,iFAAiF;IACjF,oFAAoF;IACpF,8CAA8C;IAC9C,MAAM,MAAM,GAAG,YAAY,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,IAAI,EAAE,KAAK;QACX,KAAK,EAAE;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,CAAC,SAAS,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F;QACD,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,wBAAwB,EAAE,SAAS,CAAC,eAAe;QACnD,MAAM;KACP,CAAC,CAAC;IAEH,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,MAAM,GAAsB,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACpF,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;IACxE,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS;QAAE,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;IAC9F,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS;QAAE,MAAM,CAAC,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;IACvG,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAElE,qFAAqF;IACrF,wFAAwF;IACxF,uDAAuD;IACvD,IACE,YAAY;QACZ,WAAW;QACX,SAAS,CAAC,eAAe;QACzB,SAAS,CAAC,iBAAiB;QAC3B,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EACjD,CAAC;QACD,MAAM,QAAQ,GAAkB;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,WAAW,CAAC,EAAsB;YAC3C,YAAY,EAAE,WAAW,KAAK,iBAAiB,CAAC,WAAW,CAAC,EAAsB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACxG,QAAQ,EAAE,SAAS,CAAC,eAAe;YACnC,UAAU,EAAE;gBACV,GAAG,SAAS,CAAC,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpD,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;oBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,MAAM,EAAE,UAAmB;iBAC5B,CAAC,CAAC;gBACH,GAAG,WAAW,CAAC,SAAS,CAAC,eAAe,EAAE,WAAW,CAAC;aACvD;SACF,CAAC;QACF,MAAM,MAAM,GAAgE,EAAE,CAAC;QAC/E,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,iBAAiB,CAAC,UAAU,EAAE,CAAC;YACvD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,EAAE,KAAK,EAAE,CACb;oBACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;oBAC1C,cAAc,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,MAAM,EAAE,sBAAsB;iBAC/B,EACD,6BAA6B,CAC9B,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,aAAa,GAAG,QAAQ,CAAC;gBAChC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACnC,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;gBACrC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,IAAI,CACV;oBACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;oBAC1C,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;oBACrC,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,MAAM;iBAClF,EACD,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,KAAK,EAAE,CACb;gBACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;gBAC1C,cAAc,EAAE,CAAC;gBACjB,kBAAkB,EAAE,CAAC;gBACrB,MAAM,EAAE,aAAa;aACtB,EACD,6BAA6B,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACpE,6EAA6E;QAC7E,+EAA+E;QAC/E,gFAAgF;QAChF,oFAAoF;QACpF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QAC1B,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,cAAc,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC5E,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;QACxC,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClG,MAAM,QAAQ,GAAG,wBAAwB,CACvC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,EACrF;gBACE,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ;gBACvC,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,WAAW,EAAE,MAAM,CAAC,KAAK;gBACzB,WAAW;aACZ,CACF,CAAC;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;gBACxC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAChC,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,sBAAsB,CAAC,MAAM,CAAC,CAAC;gBAC/B,MAAM,EAAE,KAAK,EAAE,CACb;oBACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;oBAC1C,cAAc,EAAE,CAAC;oBACjB,kBAAkB,EAAE,CAAC;oBACrB,MAAM,EAAE,wBAAwB;iBACjC,EACD,6BAA6B,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAyB;IACvD,OAAO,MAAM,CAAC,UAAU,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC;IACrB,OAAO,MAAM,CAAC,UAAU,CAAC;IACzB,OAAO,MAAM,CAAC,aAAa,CAAC;AAC9B,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAoB;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI;QACJ,WAAW,EAAE,IAAI,IAAI,EAAE;QACvB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CAAC,KAA+B;IACnD,OAAO,OAAQ,KAAoB,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAwB;IAClD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,uGAAuG;AACvG,SAAS,kBAAkB,CAAC,KAAsB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAsB;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,KAAK,6EAA6E,EACzG,KAAK,CACN,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,IAAiB;IACtC,OAAO;QACL,mFAAmF;QACnF,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAC7C,uBAAuB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAC9C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,KAAK,UAAU,gBAAgB,CAAC,IAM/B;IACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,EAAE,IAAI,CACV,EAAE,KAAK,EAAE,aAAa,CAAC,wBAAwB,EAAE,MAAM,EAAE,eAAe,EAAE,EAC1E,8DAA8D,CAC/D,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,wBAAwB,IAAI,kCAAkC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,iBAAiB,CAAC;IACxE,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACvB,MAAM,EAAE,IAAI,CACV;YACE,KAAK,EAAE,aAAa,CAAC,wBAAwB;YAC7C,MAAM,EAAE,iBAAiB;YACzB,WAAW,EAAE,KAAK;YAClB,SAAS;SACV,EACD,mEAAmE,CACpE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,CAAC;QACD,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,EAAE,IAAI,CACV;YACE,KAAK,EAAE,aAAa,CAAC,wBAAwB;YAC7C,MAAM,EAAE,YAAY;YACpB,CAAC;YACD,SAAS;YACT,WAAW,EAAE,KAAK,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;SAC/D,EACD,+CAA+C,CAChD,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC;QACnC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,kCAAkC,EAAE,aAAa;QACjD,oBAAoB;QACpB,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,CACV;QACE,KAAK,EAAE,aAAa,CAAC,qBAAqB;QAC1C,CAAC;QACD,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,WAAW,EAAE,KAAK,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;KAC/D,EACD,gCAAgC,CACjC,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,MAA2B;IAC7C,OAAO,UAAU,IAAI,MAAM,CAAC;AAC9B,CAAC"}

package/dist/errors.d.ts

@@ -11,6 +11,17 @@ export type SqlValidationRuleCode = "SQL_EMPTY" | "SQL_MULTI_STATEMENT" | "SQL_C
  | "SQL_FORBIDDEN_FUNCTION"
 /** A string, quoted identifier, dollar-quoted string, or block comment never closes. */
  | "SQL_UNTERMINATED"
+/**
+ * Postgres family: an `E'…'` string continued on a later line (`E'a'`, a newline, `'b'`).
+ * Postgres reads the continuation with backslash escapes and the checks don't, so they could
+ * read code as a string; refused at the boundary (#703).
+ */
+ | "SQL_STRING_CONTINUATION"
+/**
+ * Postgres family: a Unicode-escaped identifier (`U&"set\005fconfig"`). Its escapes can spell
+ * a name the other checks look for, such as a denylisted function, so it is refused (#692).
+ */
+ | "SQL_UNICODE_ESCAPED_IDENTIFIER"
 /**
  * A locking read: `FOR UPDATE`, `FOR SHARE`, `LOCK IN SHARE MODE`, or a T-SQL lock hint such as
  * `UPDLOCK`; on SQL Server, also a name that isn't printable ASCII, unquoted or quoted alone in
@@ -39,7 +50,9 @@ export declare class UnknownDialectError extends AskDbError {
     readonly dialectId: string;
     constructor(message: string, dialectId: string);
 }
-export type TenantScopeRejectionReason = "MISSING_SCOPE" | "UNKNOWN_TENANT_ROOT" | "GLOBAL_WITHOUT_REASON" | "INVALID_SCOPE_SHAPE"
+export type TenantScopeRejectionReason = "MISSING_SCOPE" | "UNKNOWN_TENANT_ROOT"
+/** A `global` scope whose `reason` is missing, not a string, or blank: global access must say why. */
+ | "GLOBAL_WITHOUT_REASON" | "INVALID_SCOPE_SHAPE"
 /**
  * A `subtree` scope could not be expanded: no `resolveTenantDescendants`, or it
  * returned something other than IDs per tenant root (a flat array, a key that
@@ -75,7 +88,7 @@ export declare class TenantScopeError extends AskDbError {
     readonly reason: TenantScopeRejectionReason;
     constructor(message: string, reason: TenantScopeRejectionReason);
 }
-export type QueryParameterRejectionReason = "INVALID_NAME" | "RESERVED_NAME" | "INVALID_VALUE" | "MISSING_VALUE" | "UNRESOLVED_PLACEHOLDER" | "INVALID_LIST_CONTEXT" | "DIALECT_UNSUPPORTED"
+export type QueryParameterRejectionReason = "INVALID_VALUE" | "MISSING_VALUE" | "UNRESOLVED_PLACEHOLDER" | "INVALID_LIST_CONTEXT" | "DIALECT_UNSUPPORTED"
 /** `bindPreparedQuery()` was called without its third argument (`BindGuardrails`), or without `schema` in it. */
  | "MISSING_GUARDRAIL_CONTEXT"
 /** `values` has a `:tenant_*` key. Tenant IDs come from `tenantScope` only. */
@@ -91,7 +104,41 @@ export declare class QueryParameterError extends AskDbError {
     readonly reason: QueryParameterRejectionReason;
     constructor(message: string, reason: QueryParameterRejectionReason);
 }
-export type TenantGuardrailRuleCode = "MISSING_TENANT_PREDICATE" | "MISSING_TYPE_DISCRIMINATOR" | "INCOMPATIBLE_JOIN_SCOPES" | "UNKNOWN_TABLE_REFERENCED" | "CROSS_TENANT_WITHOUT_GLOBAL" | "UNPROVABLE_SCOPE";
+export type TenantGuardrailRuleCode = "MISSING_TENANT_PREDICATE" | "MISSING_TYPE_DISCRIMINATOR" | "UNKNOWN_TABLE_REFERENCED" | "UNPROVABLE_SCOPE"
+/**
+ * A statement doesn't start with `SELECT` or `WITH` (a `DO` block, `CALL`, `EXPLAIN`,
+ * `SHOW`, …), so the tenant check can't read what it touches. A statement ends at each
+ * `;`, and on SQL Server also at a statement verb such as `EXEC` with no `;` before it.
+ * Reported for the whole SQL, with `tableId: ""`, under every dialect, a custom
+ * `AskDialect` included; not under a `global` scope, where the tenant check doesn't run
+ * (#698).
+ */
+ | "NOT_SELECT_OR_WITH"
+/**
+ * The SQL names a function whose reads the tenant check can't see, in any code position (a
+ * column, alias or placeholder named like one counts too): one that runs a query
+ * passed as a string (`query_to_xml`, `crosstab`), reads a table named in a string
+ * (`table_to_xml`), runs SQL over another connection (`dblink`, `OPENQUERY`), or sets a
+ * value row-level security may read (`set_config`). Reported for the whole SQL, with
+ * `tableId: ""`, under every dialect, a custom `AskDialect` included; not under a `global`
+ * scope (#702).
+ */
+ | "UNCHECKABLE_FUNCTION"
+/**
+ * A Postgres Unicode-escaped name (`U&"\006Frders"`) in any position: a table, a column or a
+ * function. Postgres decodes it, and the tenant check matches names as written, so it can't
+ * tell what the name reads. Reported for the whole SQL, with `tableId: ""`, whenever the SQL
+ * is read as Postgres: postgres, cockroachdb, a custom `AskDialect`, or no dialect; not under
+ * a `global` scope (#704, #692).
+ */
+ | "UNICODE_ESCAPED_IDENTIFIER"
+/**
+ * An `E'…'` string continued on a later line, which Postgres reads with backslash escapes and
+ * the tenant check doesn't, so a table or call after it could be hidden. Reported for the
+ * whole SQL, with `tableId: ""`, whenever the SQL may be read as Postgres: postgres,
+ * cockroachdb, a custom `AskDialect`, or no dialect; not under a `global` scope (#703).
+ */
+ | "STRING_CONTINUATION";
 export type TenantGuardrailWarning = {
     rule: TenantGuardrailRuleCode;
     tableId: string;

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,UAAW,SAAQ,KAAK;aAGjB,KAAK,CAAC,EAAE,OAAO;gBAD/B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,OAAO,YAAA;CAKlC;AAED,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED,kEAAkE;AAClE,MAAM,MAAM,qBAAqB,GAC7B,WAAW,GACX,qBAAqB,GACrB,aAAa,GACb,wBAAwB,GACxB,uBAAuB;AACzB,iGAAiG;GAC/F,wBAAwB;AAC1B,wFAAwF;GACtF,kBAAkB;AACpB;;;;GAIG;GACD,kBAAkB,CAAC;AAEvB,qBAAa,kBAAmB,SAAQ,UAAU;aAU9B,IAAI,EAAE,qBAAqB;IAC3C,8DAA8D;aAC9C,IAAI,CAAC,EAAE,MAAM;IAX/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,qBAAqB;IAC3C,8DAA8D;IAC9C,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,kBAAmB,SAAQ,UAAU;gBACpC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED,8EAA8E;AAC9E,qBAAa,mBAAoB,SAAQ,UAAU;aAG/B,SAAS,EAAE,MAAM;gBADjC,OAAO,EAAE,MAAM,EACC,SAAS,EAAE,MAAM;CAKpC;AAED,MAAM,MAAM,0BAA0B,GAClC,eAAe,GACf,qBAAqB,GACrB,uBAAuB,GACvB,qBAAqB;AACvB;;;;;;GAMG;GACD,wBAAwB;AAC1B,mFAAmF;GACjF,+BAA+B;AACjC,6EAA6E;GAC3E,8BAA8B;AAChC;;;;;;;;GAQG;GACD,uBAAuB;AACzB;;;;;;;GAOG;GACD,0BAA0B,CAAC;AAE/B,qBAAa,gBAAiB,SAAQ,UAAU;aAG5B,MAAM,EAAE,0BAA0B;gBADlD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,0BAA0B;CAKrD;AAED,MAAM,MAAM,6BAA6B,GACrC,cAAc,GACd,eAAe,GACf,eAAe,GACf,eAAe,GACf,wBAAwB,GACxB,sBAAsB,GACtB,qBAAqB;AACvB,iHAAiH;GAC/G,2BAA2B;AAC7B,+EAA+E;GAC7E,uBAAuB;AACzB,yFAAyF;GACvF,wBAAwB;AAC1B;;;GAGG;GACD,uBAAuB,CAAC;AAE5B,qBAAa,mBAAoB,SAAQ,UAAU;aAG/B,MAAM,EAAE,6BAA6B;gBADrD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,6BAA6B;CAKxD;AAED,MAAM,MAAM,uBAAuB,GAC/B,0BAA0B,GAC1B,4BAA4B,GAC5B,0BAA0B,GAC1B,0BAA0B,GAC1B,6BAA6B,GAC7B,kBAAkB,CAAC;AAEvB,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,UAAU;aAMhC,QAAQ,EAAE,sBAAsB,EAAE;IALpD,sFAAsF;IACtF,OAAO,CAAC,EAAE,gBAAgB,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACC,QAAQ,EAAE,sBAAsB,EAAE;CAKrD;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB;AAC5B;;;;GAIG;AACD,WAAW;AACb;;;GAGG;GACD,aAAa;AACf,wFAAwF;GACtF,OAAO,CAAC;AAEZ,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB;AAC7B,yFAAyF;AACvF,iBAAiB;AACnB,+FAA+F;GAC7F,mBAAmB;AACrB,gFAAgF;GAC9E,qBAAqB;AACvB,+GAA+G;GAC7G,oBAAoB,CAAC;AAEzB,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,0BAA0B,GAClC,4BAA4B,GAC5B,6BAA6B,GAC7B,wBAAwB,CAAC;AAE7B,qBAAa,uBAAwB,SAAQ,UAAU;aAMnC,IAAI,EAAE,0BAA0B;aAChC,UAAU,EAAE,kBAAkB,EAAE;aAChC,eAAe,CAAC,EAAE,oBAAoB;IAPxD,sFAAsF;IACtF,OAAO,CAAC,EAAE,gBAAgB,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,0BAA0B,EAChC,UAAU,EAAE,kBAAkB,EAAE,EAChC,eAAe,CAAC,EAAE,oBAAoB,YAAA;CAKzD;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,SAAQ,UAAU;;CAO7D;AAMD,wDAAwD;AACxD,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,UAAU,CAAC;AAE/C,0GAA0G;AAC1G,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzD,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,GACxB;IACE,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IACE,KAAK,EAAE,QAAQ,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,aAAa,GAAG,WAAW,CAAC;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,+GAA+G;IAC/G,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,oBAAoB,CAAC;CACxC,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,UAAW,SAAQ,KAAK;aAGjB,KAAK,CAAC,EAAE,OAAO;gBAD/B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,OAAO,YAAA;CAKlC;AAED,qBAAa,gBAAiB,SAAQ,UAAU;gBAClC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED,kEAAkE;AAClE,MAAM,MAAM,qBAAqB,GAC7B,WAAW,GACX,qBAAqB,GACrB,aAAa,GACb,wBAAwB,GACxB,uBAAuB;AACzB,iGAAiG;GAC/F,wBAAwB;AAC1B,wFAAwF;GACtF,kBAAkB;AACpB;;;;GAIG;GACD,yBAAyB;AAC3B;;;GAGG;GACD,gCAAgC;AAClC;;;;GAIG;GACD,kBAAkB,CAAC;AAEvB,qBAAa,kBAAmB,SAAQ,UAAU;aAU9B,IAAI,EAAE,qBAAqB;IAC3C,8DAA8D;aAC9C,IAAI,CAAC,EAAE,MAAM;IAX/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,qBAAqB;IAC3C,8DAA8D;IAC9C,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,kBAAmB,SAAQ,UAAU;gBACpC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED,8EAA8E;AAC9E,qBAAa,mBAAoB,SAAQ,UAAU;aAG/B,SAAS,EAAE,MAAM;gBADjC,OAAO,EAAE,MAAM,EACC,SAAS,EAAE,MAAM;CAKpC;AAED,MAAM,MAAM,0BAA0B,GAClC,eAAe,GACf,qBAAqB;AACvB,sGAAsG;GACpG,uBAAuB,GACvB,qBAAqB;AACvB;;;;;;GAMG;GACD,wBAAwB;AAC1B,mFAAmF;GACjF,+BAA+B;AACjC,6EAA6E;GAC3E,8BAA8B;AAChC;;;;;;;;GAQG;GACD,uBAAuB;AACzB;;;;;;;GAOG;GACD,0BAA0B,CAAC;AAE/B,qBAAa,gBAAiB,SAAQ,UAAU;aAG5B,MAAM,EAAE,0BAA0B;gBADlD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,0BAA0B;CAKrD;AAED,MAAM,MAAM,6BAA6B,GACrC,eAAe,GACf,eAAe,GACf,wBAAwB,GACxB,sBAAsB,GACtB,qBAAqB;AACvB,iHAAiH;GAC/G,2BAA2B;AAC7B,+EAA+E;GAC7E,uBAAuB;AACzB,yFAAyF;GACvF,wBAAwB;AAC1B;;;GAGG;GACD,uBAAuB,CAAC;AAE5B,qBAAa,mBAAoB,SAAQ,UAAU;aAG/B,MAAM,EAAE,6BAA6B;gBADrD,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,6BAA6B;CAKxD;AAED,MAAM,MAAM,uBAAuB,GAC/B,0BAA0B,GAC1B,4BAA4B,GAC5B,0BAA0B,GAC1B,kBAAkB;AACpB;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;;;;GAQG;GACD,sBAAsB;AACxB;;;;;;GAMG;GACD,4BAA4B;AAC9B;;;;;GAKG;GACD,qBAAqB,CAAC;AAE1B,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,UAAU;aAMhC,QAAQ,EAAE,sBAAsB,EAAE;IALpD,sFAAsF;IACtF,OAAO,CAAC,EAAE,gBAAgB,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACC,QAAQ,EAAE,sBAAsB,EAAE;CAKrD;AAED,iEAAiE;AACjE,MAAM,MAAM,kBAAkB;AAC5B;;;;GAIG;AACD,WAAW;AACb;;;GAGG;GACD,aAAa;AACf,wFAAwF;GACtF,OAAO,CAAC;AAEZ,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB;AAC7B,yFAAyF;AACvF,iBAAiB;AACnB,+FAA+F;GAC7F,mBAAmB;AACrB,gFAAgF;GAC9E,qBAAqB;AACvB,+GAA+G;GAC7G,oBAAoB,CAAC;AAEzB,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,6GAA6G;AAC7G,MAAM,MAAM,0BAA0B,GAClC,4BAA4B,GAC5B,6BAA6B,GAC7B,wBAAwB,CAAC;AAE7B,qBAAa,uBAAwB,SAAQ,UAAU;aAMnC,IAAI,EAAE,0BAA0B;aAChC,UAAU,EAAE,kBAAkB,EAAE;aAChC,eAAe,CAAC,EAAE,oBAAoB;IAPxD,sFAAsF;IACtF,OAAO,CAAC,EAAE,gBAAgB,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,0BAA0B,EAChC,UAAU,EAAE,kBAAkB,EAAE,EAChC,eAAe,CAAC,EAAE,oBAAoB,YAAA;CAKzD;AAED;;;;GAIG;AACH,qBAAa,8BAA+B,SAAQ,UAAU;;CAO7D;AAMD,wDAAwD;AACxD,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,UAAU,CAAC;AAE/C,0GAA0G;AAC1G,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzD,sGAAsG;AACtG,MAAM,MAAM,gBAAgB,GACxB;IACE,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IACE,KAAK,EAAE,QAAQ,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,aAAa,GAAG,WAAW,CAAC;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,KAAK,EAAE,WAAW,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,+GAA+G;IAC/G,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,oBAAoB,CAAC;CACxC,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B,CAAC"}

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAoBD,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAU9B;IAEA;IAXlB;;;;OAIG;IACH,OAAO,CAAoB;IAE3B,YACE,OAAe,EACC,IAA2B;IAC3C,8DAA8D;IAC9C,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAuB;QAE3B,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAG/B;IAFlB,YACE,OAAe,EACC,SAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAuCD,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAG5B;IAFlB,YACE,OAAe,EACC,MAAkC;QAElD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAA4B;QAGlD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAsBD,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAG/B;IAFlB,YACE,OAAe,EACC,MAAqC;QAErD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAA+B;QAGrD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAgBD,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAMhC;IALlB,sFAAsF;IACtF,OAAO,CAAoB;IAE3B,YACE,OAAe,EACC,QAAkC;QAElD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,aAAQ,GAAR,QAAQ,CAA0B;QAGlD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAyDD,MAAM,OAAO,uBAAwB,SAAQ,UAAU;IAMnC;IACA;IACA;IAPlB,sFAAsF;IACtF,OAAO,CAAoB;IAE3B,YACE,OAAe,EACC,IAAgC,EAChC,UAAgC,EAChC,eAAsC;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA4B;QAChC,eAAU,GAAV,UAAU,CAAsB;QAChC,oBAAe,GAAf,eAAe,CAAuB;QAGtD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,8BAA+B,SAAQ,UAAU;IAC5D;QACE,KAAK,CACH,6HAA6H,CAC9H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB;IAFlB,YACE,OAAe,EACC,KAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,UAAK,GAAL,KAAK,CAAU;QAG/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AA+BD,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAU9B;IAEA;IAXlB;;;;OAIG;IACH,OAAO,CAAoB;IAE3B,YACE,OAAe,EACC,IAA2B;IAC3C,8DAA8D;IAC9C,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAuB;QAE3B,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,UAAU;IAChD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAG/B;IAFlB,YACE,OAAe,EACC,SAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,cAAS,GAAT,SAAS,CAAQ;QAGjC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAwCD,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAG5B;IAFlB,YACE,OAAe,EACC,MAAkC;QAElD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAA4B;QAGlD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAoBD,MAAM,OAAO,mBAAoB,SAAQ,UAAU;IAG/B;IAFlB,YACE,OAAe,EACC,MAAqC;QAErD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAA+B;QAGrD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAgDD,MAAM,OAAO,oBAAqB,SAAQ,UAAU;IAMhC;IALlB,sFAAsF;IACtF,OAAO,CAAoB;IAE3B,YACE,OAAe,EACC,QAAkC;QAElD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,aAAQ,GAAR,QAAQ,CAA0B;QAGlD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAyDD,MAAM,OAAO,uBAAwB,SAAQ,UAAU;IAMnC;IACA;IACA;IAPlB,sFAAsF;IACtF,OAAO,CAAoB;IAE3B,YACE,OAAe,EACC,IAAgC,EAChC,UAAgC,EAChC,eAAsC;QAEtD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA4B;QAChC,eAAU,GAAV,UAAU,CAAsB;QAChC,oBAAe,GAAf,eAAe,CAAuB;QAGtD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,8BAA+B,SAAQ,UAAU;IAC5D;QACE,KAAK,CACH,6HAA6H,CAC9H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF"}

package/dist/logging/create-askdb-logger.d.ts

@@ -12,7 +12,10 @@ export type CreateAskDbLoggerOptions = {
      * Default true when logging is enabled and no sinks are disabled explicitly.
      */
     stderr?: boolean;
-    /** Append JSON logs to this file path (parent directories are created). */
+    /**
+     * Append JSON logs to this file path (parent directories are created). Every logger with the
+     * same path shares one open file, which stays open until the process exits.
+     */
     logFile?: string;
     /** Duplicate logs to stdout (e.g. piping aggregated output). */
     logStdout?: boolean;

package/dist/logging/create-askdb-logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-askdb-logger.d.ts","sourceRoot":"","sources":["../../src/logging/create-askdb-logger.ts"],"names":[],"mappings":"AAEA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC;AAEjD,MAAM,MAAM,wBAAwB,GAAG;IACrC,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAmBF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CA8BhF"}
+{"version":3,"file":"create-askdb-logger.d.ts","sourceRoot":"","sources":["../../src/logging/create-askdb-logger.ts"],"names":[],"mappings":"AAEA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,6CAA6C;AAC7C,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC;AAEjD,MAAM,MAAM,wBAAwB,GAAG;IACrC,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAwCF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CA6BhF"}

package/dist/logging/create-askdb-logger.js

@@ -1,5 +1,5 @@
 import { mkdirSync } from "node:fs";
-import { dirname } from "node:path";
+import { dirname, resolve } from "node:path";
 import pino from "pino";
 function wrapPinoAsAskDbLogger(pinoLogger) {
     return {
@@ -17,6 +17,25 @@ function wrapPinoAsAskDbLogger(pinoLogger) {
         },
     };
 }
+/**
+ * One open destination per log file, for the life of the process. Hosts build a logger per request
+ * (its correlation ID is the request ID), so opening the file per logger would hold one descriptor
+ * per request (#693). Because the file stays open, rotate it with `copytruncate`, or restart the
+ * process after a rotate.
+ */
+const logFileDestinations = new Map();
+function logFileDestination(logFile) {
+    // Key by the absolute path, but open the path as given: `resolve()` drops a trailing separator,
+    // which would turn `logs/` into a file named `logs` instead of failing to open a directory.
+    const key = resolve(logFile);
+    let destination = logFileDestinations.get(key);
+    if (destination === undefined) {
+        mkdirSync(dirname(logFile), { recursive: true });
+        destination = pino.destination({ dest: logFile, sync: true });
+        logFileDestinations.set(key, destination);
+    }
+    return destination;
+}
 /**
  * Builds an {@link AskDbLogger} backed by Pino (multi-destination per ADR 0001).
  * Uses a single `destination` when only one sink is configured (simpler flushing); otherwise `pino.multistream`.
@@ -35,8 +54,7 @@ export function createAskDbLogger(options) {
         destinations.push(pino.destination(1));
     }
     if (options.logFile) {
-        mkdirSync(dirname(options.logFile), { recursive: true });
-        destinations.push(pino.destination({ dest: options.logFile, sync: true }));
+        destinations.push(logFileDestination(options.logFile));
     }
     if (destinations.length === 0) {
         return wrapPinoAsAskDbLogger(pino({ level: "silent" }));

package/dist/logging/create-askdb-logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-askdb-logger.js","sourceRoot":"","sources":["../../src/logging/create-askdb-logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAuBxB,SAAS,qBAAqB,CAAC,UAAsB;IACnD,OAAO;QACL,IAAI,CAAC,OAAgC,EAAE,OAAe;YACpD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,OAAgC,EAAE,OAAe;YACrD,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,OAAgC,EAAE,OAAe;YACpD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,OAAgC,EAAE,OAAe;YACrD,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,KAAK,GAAkB,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC;IACvD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAA6B,EAAE,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GACR,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAE;QAClB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACzF,OAAO,qBAAqB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"create-askdb-logger.js","sourceRoot":"","sources":["../../src/logging/create-askdb-logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,IAAI,MAAM,MAAM,CAAC;AA0BxB,SAAS,qBAAqB,CAAC,UAAsB;IACnD,OAAO;QACL,IAAI,CAAC,OAAgC,EAAE,OAAe;YACpD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,OAAgC,EAAE,OAAe;YACrD,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,OAAgC,EAAE,OAAe;YACpD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,CAAC,OAAgC,EAAE,OAAe;YACrD,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkC,CAAC;AAEtE,SAAS,kBAAkB,CAAC,OAAe;IACzC,gGAAgG;IAChG,4FAA4F;IAC5F,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,KAAK,GAAkB,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC;IACvD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAA6B,EAAE,CAAC;IAClD,IAAI,QAAQ,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GACR,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAE;QAClB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACzF,OAAO,qBAAqB,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC"}

package/dist/logging/log-contract.d.ts

@@ -1,5 +1,5 @@
 /**
- * Minimal structured-log contract intended for headless surfaces (CLI now; reused by servers later).
+ * Minimal structured-log contract for headless surfaces such as the CLI.
  *
  * This is deliberately small:
  * - Tests should fail on removal/rename of required fields/events (drift).

package/dist/logging/log-contract.js

@@ -1,6 +1,6 @@
 import { AskDbLogEvent } from "./log-events.js";
 /**
- * Minimal structured-log contract intended for headless surfaces (CLI now; reused by servers later).
+ * Minimal structured-log contract for headless surfaces such as the CLI.
  *
  * This is deliberately small:
  * - Tests should fail on removal/rename of required fields/events (drift).

package/dist/logging/log-events.d.ts

@@ -1,6 +1,6 @@
 /**
  * Stable `event` field values for structured logs (JSON lines).
- * See Phase 2 spec: observability / correlation ID contract.
+ * `log-contract.ts` lists the fields and events every log keeps.
  */
 export declare const AskDbLogEvent: {
     readonly RunStart: "askdb.run.start";

package/dist/logging/log-events.js

@@ -1,6 +1,6 @@
 /**
  * Stable `event` field values for structured logs (JSON lines).
- * See Phase 2 spec: observability / correlation ID contract.
+ * `log-contract.ts` lists the fields and events every log keeps.
  */
 export const AskDbLogEvent = {
     RunStart: "askdb.run.start",

package/dist/modes/types.d.ts

@@ -1,4 +1,4 @@
-/** Operating modes selectable in Phase 2 v1 (see `docs/contracts/modes-v1.md`). */
+/** The selectable operating modes (contract: `docs/contracts/modes-v1.md`). */
 export declare const ASKDB_MODES_V1: readonly ["schema_only", "bounded_results"];
 export type AskDbModeV1 = (typeof ASKDB_MODES_V1)[number];
 /** Default mode when unset — strictest trust boundary. */

package/dist/modes/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/modes/types.ts"],"names":[],"mappings":"AAEA,mFAAmF;AACnF,eAAO,MAAM,cAAc,6CAA8C,CAAC;AAC1E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAI1D,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,WAA2B,CAAC;AAE7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAWrE;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/modes/types.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,eAAO,MAAM,cAAc,6CAA8C,CAAC;AAC1E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAI1D,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,WAA2B,CAAC;AAE7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAWrE;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}

package/dist/modes/types.js

@@ -1,5 +1,5 @@
 import { AskDbError } from "../errors.js";
-/** Operating modes selectable in Phase 2 v1 (see `docs/contracts/modes-v1.md`). */
+/** The selectable operating modes (contract: `docs/contracts/modes-v1.md`). */
 export const ASKDB_MODES_V1 = ["schema_only", "bounded_results"];
 const MODE_SET = new Set(ASKDB_MODES_V1);
 /** Default mode when unset — strictest trust boundary. */

package/dist/modes/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/modes/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,mFAAmF;AACnF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAU,CAAC;AAG1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAEjD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAgB,aAAa,CAAC;AAE7D,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAClB,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sBAAsB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,CAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/modes/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,iBAAiB,CAAU,CAAC;AAG1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,cAAc,CAAC,CAAC;AAEjD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAgB,aAAa,CAAC;AAE7D,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAClB,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sBAAsB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,CAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC"}

package/dist/retrieval/synthesize-ddl.d.ts

@@ -3,15 +3,15 @@ import type { RetrievedResult } from "./types.js";
 /**
  * Build a focused DDL block for NL→SQL prompts from retrieved chunks.
  *
- * Layout (decided in implementation, per Phase 8 spec's "open choice"):
+ * Layout:
  *   1. Each table referenced by any retrieved chunk gets a TABLE block with
  *      its full column definitions (so the model has complete column lists).
- *   2. Column-chunk descriptions become inline `-- aliases / values / desc`
- *      annotations on the matching column line.
- *   3. CQL chunks land as a `-- common query language --` block under the
+ *      Each column line carries the schema's own `-- aliases / values / desc`
+ *      annotation; a retrieved column chunk only picks its table.
+ *   2. CQL chunks land as a `-- common query language --` block under the
  *      table.
- *   4. Concept and question chunks attach as system-context paragraphs at
- *      the bottom (before the question).
+ *   3. Relationship, concept, example-question and tenant-policy chunks follow
+ *      the tables, each kind as its own `-- … --` block, in that order.
  *
  * Sensitive identifiers retain their `(sensitive)` tagging exactly as
  * `formatSchemaV2ForNlToSql` does. With `omitSensitiveIdentifiersFromPrompt`,

package/dist/retrieval/synthesize-ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"synthesize-ddl.d.ts","sourceRoot":"","sources":["../../src/retrieval/synthesize-ddl.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,iFAAiF;IACjF,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC5C,GAAG;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,0HAA0H;IAC1H,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAiJA"}
+{"version":3,"file":"synthesize-ddl.d.ts","sourceRoot":"","sources":["../../src/retrieval/synthesize-ddl.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,iFAAiF;IACjF,kCAAkC,CAAC,EAAE,OAAO,CAAC;IAC7C,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC5C,GAAG;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,0HAA0H;IAC1H,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CA6IA"}