@comprehend/telemetry-node 0.1.0

package/dist/sql-analyzer.js

@@ -0,0 +1,287 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeSQL = analyzeSQL;
+exports.analyzeSQLTokens = analyzeSQLTokens;
+const KEYWORDS = new Set([
+    'SELECT', 'FROM', 'WHERE', 'INSERT', 'REPLACE', 'INTO', 'VALUES', 'DELETE', 'UPDATE',
+    'MERGE', 'SET', 'JOIN', 'LEFT', 'RIGHT', 'FULL', 'OUTER', 'INNER', 'ON', 'AS', 'AND', 'OR',
+    'NOT', 'IS', 'NULL', 'IN', 'WITH', 'RECURSIVE', 'UNION', 'ALL',
+    'GROUP', 'BY', 'HAVING', 'ORDER', 'LIMIT', 'OFFSET', 'LATERAL', 'USING'
+]);
+/** Performs a rough tokenization of the SQL, extracts the tables involved and the operations on them, and
+ * produces two versions of the query:
+ * - A normalized version for hashing purposes that does not account for whitespace, comments, and collapses
+ *   IN clauses that might cause a cardinality explosion.
+ * - A presentable version that only does the IN clause collapsing */
+function analyzeSQL(sql) {
+    let semanticTokens = new Array();
+    let presentableTokens = new Array();
+    let seekingInParen = false;
+    let analyzingIn = false;
+    let skippingIn = false;
+    for (let token of tokenizeSQL(sql)) {
+        switch (token.type) {
+            case "whitespace":
+            case "comment":
+            case "id-quote":
+                // Skip
+                break;
+            case "keyword":
+                // Normalize to uppercase.
+                semanticTokens.push({ type: "keyword", value: token.value.toUpperCase() });
+                break;
+            case "identifier":
+                // Normalize to lowercase.
+                semanticTokens.push({ type: "identifier", value: token.value.toLowerCase() });
+                break;
+            default:
+                semanticTokens.push(token);
+                break;
+        }
+        if (seekingInParen) {
+            // We saw IN, and now look for an opening (. Skip whitespace/comments, bail if anything else.
+            presentableTokens.push(token);
+            switch (token.type) {
+                case "comment":
+                case "whitespace":
+                    break;
+                case "punct":
+                    seekingInParen = false;
+                    analyzingIn = token.value === "(";
+                    break;
+                default:
+                    seekingInParen = false;
+                    break;
+            }
+        }
+        else if (analyzingIn) {
+            // We saw the opening paren of an IN. Pass over whitespace and comments. If we see a
+            // keyword we know it's not something to collapse, it's a sub-query. Otherwise, we
+            // enter skipping mode.
+            switch (token.type) {
+                case "comment":
+                case "whitespace":
+                    presentableTokens.push(token);
+                    break;
+                case "keyword":
+                case "punct": // maybe immediate ), certainly not a value
+                    presentableTokens.push(token);
+                    analyzingIn = false;
+                    break;
+                default:
+                    analyzingIn = false;
+                    skippingIn = true;
+                    presentableTokens.push({ type: "unknown", value: "..." });
+            }
+        }
+        else if (skippingIn) {
+            // Omit tokens until a closing ).
+            if (token.type === "punct" && token.value === ")") {
+                presentableTokens.push(token);
+                skippingIn = false;
+            }
+        }
+        else {
+            presentableTokens.push(token);
+            seekingInParen = token.type === "keyword" && token.value.toUpperCase() === "IN";
+        }
+    }
+    return {
+        ...analyzeSQLTokens(semanticTokens),
+        presentableQuery: presentableTokens.map(t => t.value).join("")
+    };
+}
+function* tokenizeSQL(sql) {
+    const regex = /(--[^\n]*|\/\*[\s\S]*?\*\/)|('[^']*')|("(?:[^"]*)")|(`[^`]*`)|(\[[^\]]+\])|(\b[a-zA-Z_][\w$]*\b)|([(),;])|(<=|>=|<>|!=|=|<|>)|(\s+)|(\S)/g;
+    let match;
+    while ((match = regex.exec(sql))) {
+        const [full, comment, // 1
+        singleQuoted, // 2: string literal
+        doubleQuoted, // 3: "identifier"
+        backtickQuoted, // 4: `identifier`
+        bracketQuoted, // 5: [identifier]
+        word, // 6
+        punct, // 7
+        operator, // 8
+        ws, // 9
+        unknown // 10
+        ] = match;
+        if (comment) {
+            yield { type: 'comment', value: comment };
+        }
+        else if (singleQuoted) {
+            yield { type: 'string', value: singleQuoted };
+        }
+        else if (doubleQuoted) {
+            yield { type: 'id-quote', value: '"' };
+            yield { type: 'identifier', value: doubleQuoted.slice(1, -1) };
+            yield { type: 'id-quote', value: '"' };
+        }
+        else if (backtickQuoted) {
+            yield { type: 'id-quote', value: '`' };
+            yield { type: 'identifier', value: backtickQuoted.slice(1, -1) };
+            yield { type: 'id-quote', value: '`' };
+        }
+        else if (bracketQuoted) {
+            yield { type: 'id-quote', value: '[' };
+            yield { type: 'identifier', value: bracketQuoted.slice(1, -1) };
+            yield { type: 'id-quote', value: ']' };
+        }
+        else if (word) {
+            yield { type: KEYWORDS.has(word.toUpperCase()) ? 'keyword' : "identifier", value: word };
+        }
+        else if (punct) {
+            yield { type: 'punct', value: punct };
+        }
+        else if (operator) {
+            yield { type: 'operator', value: operator };
+        }
+        else if (ws) {
+            yield { type: 'whitespace', value: ws };
+        }
+        else if (unknown) {
+            yield { type: 'unknown', value: unknown };
+        }
+    }
+}
+function analyzeSQLTokens(tokens) {
+    const aliasNames = new Set();
+    const tableOps = {};
+    const normalizedTokens = [];
+    let currentOp = null;
+    let lastTokenType = null;
+    function appendToken(val, type) {
+        if (normalizedTokens.length && type !== 'punct' && lastTokenType !== 'punct') {
+            normalizedTokens.push(' ');
+        }
+        normalizedTokens.push(val);
+        lastTokenType = type;
+    }
+    for (let i = 0; i < tokens.length;) {
+        const token = tokens[i];
+        // Record operation context
+        if (token.type === 'keyword' && ['SELECT', 'INSERT', 'UPDATE', 'DELETE'].includes(token.value)) {
+            currentOp = { ops: [token.value.toUpperCase()], at: i };
+        }
+        else if (token.type === "keyword" && token.value === 'USING') {
+            currentOp = { ops: ["SELECT"], at: i };
+        }
+        else if (token.type === "keyword" && token.value === 'REPLACE') {
+            currentOp = { ops: ["INSERT", "UPDATE"], at: i };
+        }
+        else if (token.type === "keyword" && token.value === 'MERGE') {
+            let sawInsert = false;
+            let sawUpdate = false;
+            let sawDelete = false;
+            for (let j = i + 1; j < tokens.length; j++) {
+                if (tokens[j].type === "keyword") {
+                    if (tokens[j].value === "INSERT")
+                        sawInsert = true;
+                    if (tokens[j].value === "UPDATE")
+                        sawUpdate = true;
+                    if (tokens[j].value === "DELETE")
+                        sawDelete = true;
+                }
+            }
+            currentOp = { ops: [], at: i };
+            if (sawInsert)
+                currentOp.ops.push("INSERT");
+            if (sawUpdate)
+                currentOp.ops.push("UPDATE");
+            if (sawDelete)
+                currentOp.ops.push("DELETE");
+        }
+        // Detect CTE-style alias: <identifier> AS (
+        if (token.type === 'identifier' &&
+            tokens[i + 1]?.type === 'keyword' &&
+            tokens[i + 1].value === 'AS' &&
+            tokens[i + 2]?.value === '(') {
+            const alias = token.value.toLowerCase();
+            aliasNames.add(alias);
+            appendToken(token.value, token.type);
+            appendToken('AS', 'keyword');
+            appendToken('(', 'punct');
+            i += 3;
+            continue;
+        }
+        // Detect AS <alias> (table aliases, subquery aliases, etc.)
+        if (token.type === 'keyword' &&
+            token.value.toUpperCase() === 'AS' &&
+            tokens[i + 1]?.type === 'identifier') {
+            const alias = tokens[i + 1].value.toLowerCase();
+            aliasNames.add(alias);
+            appendToken(token.value, token.type);
+            appendToken(tokens[i + 1].value, tokens[i + 1].type);
+            i += 2;
+            continue;
+        }
+        // Record table name if in FROM, JOIN, INTO, UPDATE
+        if (token.type === 'keyword' &&
+            ['FROM', 'JOIN', 'INTO', 'UPDATE', 'USING'].includes(token.value) &&
+            tokens[i + 1]?.type === 'identifier' &&
+            !(['FROM', 'JOIN', 'USING'].includes(token.value) && tokens[i + 2]?.value === "(") // functions
+        ) {
+            const table = tokens[i + 1].value.toLowerCase();
+            if (currentOp && !aliasNames.has(table) && hasBalancedParens(tokens, currentOp.at, i)) {
+                tableOps[table] || (tableOps[table] = new Set());
+                for (let op of currentOp.ops) {
+                    tableOps[table].add(op);
+                }
+            }
+        }
+        // Normalize IN (...) clauses
+        if (token.type === 'keyword' && token.value === 'IN') {
+            if (tokens[i + 1]?.value === '(' &&
+                tokens[i + 2] // make sure something exists inside
+            ) {
+                appendToken('IN', 'keyword');
+                appendToken('(', 'punct');
+                const firstInside = tokens[i + 2];
+                if (firstInside.type === 'keyword') {
+                    // Subquery → parse normally
+                    i += 2;
+                    continue;
+                }
+                else {
+                    // Literal list → collapse
+                    appendToken('...', 'identifier');
+                    // Skip until matching ')'
+                    let depth = 1;
+                    let j = i + 3;
+                    while (j < tokens.length && depth > 0) {
+                        if (tokens[j].value === '(')
+                            depth++;
+                        else if (tokens[j].value === ')')
+                            depth--;
+                        j++;
+                    }
+                    appendToken(')', 'punct');
+                    i = j;
+                    continue;
+                }
+            }
+        }
+        appendToken(token.value, token.type);
+        i++;
+    }
+    return {
+        tableOperations: Object.fromEntries(Object.entries(tableOps).map(([k, v]) => [k, Array.from(v)])),
+        normalizedQuery: normalizedTokens.join('')
+    };
+}
+function hasBalancedParens(tokens, start, end) {
+    let balance = 0;
+    for (let i = start; i < end; i++) {
+        const token = tokens[i];
+        if (token.type === 'punct') {
+            if (token.value === '(')
+                balance++;
+            else if (token.value === ')')
+                balance--;
+        }
+        // Early exit: unbalanced in wrong direction
+        if (balance < 0)
+            return false;
+    }
+    return balance === 0;
+}

package/dist/sql-analyzer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/sql-analyzer.test.js

@@ -0,0 +1,363 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const sql_analyzer_1 = require("./sql-analyzer");
+describe('SQL Analyzer - basic SQL operations', () => {
+    it('detects a simple SELECT from one table', () => {
+        const sql = `SELECT * FROM users`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ users: ['SELECT'] });
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects an INSERT INTO ... VALUES', () => {
+        const sql = `INSERT INTO logs (message, level) VALUES ('hi', 'info')`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ logs: ['INSERT'] });
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects an INSERT INTO ... SELECT', () => {
+        const sql = `INSERT INTO archive SELECT * FROM logs`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            archive: ['INSERT'],
+            logs: ['SELECT']
+        });
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects a simple UPDATE', () => {
+        const sql = `UPDATE users SET last_login = NOW() WHERE id = 1`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ users: ['UPDATE'] });
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects a simple DELETE', () => {
+        const sql = `DELETE FROM sessions WHERE expired = true`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ sessions: ['DELETE'] });
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects tables in DELETE ... USING clause', () => {
+        const sql = `
+            DELETE FROM sessions
+            USING users
+            WHERE sessions.user_id = users.id
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            sessions: ['DELETE'],
+            users: ['SELECT'],
+        });
+        expect(result.normalizedQuery).toMatch(/delete\s+from\s+sessions/i);
+        expect(result.normalizedQuery).toMatch(/using\s+users/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects tables with aliases in FROM clause', () => {
+        const sql = `
+            SELECT u.id, u.name
+            FROM users u
+            WHERE u.active = true
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['SELECT'],
+        });
+        expect(result.normalizedQuery).toMatch(/from\s+users/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('handles multiple operations on the same table', () => {
+        const sql = `
+          INSERT INTO stats (user_id, value)
+          SELECT id, 42 FROM users;
+          UPDATE stats SET value = 99 WHERE value < 50;
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            stats: ['INSERT', 'UPDATE'],
+            users: ['SELECT']
+        });
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects tables in REPLACE INTO statements', () => {
+        const sql = `
+            REPLACE INTO users (id, name) VALUES (1, 'Alice');
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['INSERT', 'UPDATE'],
+        });
+        expect(result.normalizedQuery).toMatch(/replace\s+into\s+users/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects operation type from MERGE WHEN clause', () => {
+        const sql = `
+            MERGE INTO inventory AS t
+            USING incoming AS s
+            ON t.sku = s.sku
+            WHEN MATCHED THEN
+              UPDATE SET t.qty = t.qty + s.qty
+            WHEN NOT MATCHED THEN
+              INSERT (sku, qty) VALUES (s.sku, s.qty);
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            inventory: ['INSERT', 'UPDATE'],
+            incoming: ['SELECT'],
+        });
+        expect(result.normalizedQuery).toMatch(/merge\s+into\s+inventory/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('handles double-quoted identifiers', () => {
+        const sql = `SELECT * FROM "Users" WHERE "Users"."Id" = 42`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ users: ['SELECT'] });
+        expect(result.normalizedQuery).toMatch(/from\s+users/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('handles backtick-quoted identifiers (MySQL style)', () => {
+        const sql = 'SELECT * FROM `auditLogs` WHERE `eventType` = "login"';
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ auditlogs: ['SELECT'] });
+        expect(result.normalizedQuery).toMatch(/from\s+auditlogs/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('handles bracket-quoted identifiers (SQL Server style)', () => {
+        const sql = `SELECT [userId], [userName] FROM [Accounts]`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ accounts: ['SELECT'] });
+        expect(result.normalizedQuery).toMatch(/from\s+accounts/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('normalizes quoted table names and columns to lowercase', () => {
+        const sql = `SELECT "ID", "Email" FROM "Customer"`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ customer: ['SELECT'] });
+        expect(result.normalizedQuery).toMatch(/from\s+customer/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects real tables from subqueries in the FROM clause', () => {
+        const sql = `
+            SELECT sq.name
+            FROM (
+              SELECT name FROM employees WHERE active = true
+            ) sq
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            employees: ['SELECT'],
+        });
+        expect(result.normalizedQuery).toMatch(/from\s+employees/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('does not treat FROM function() as a table', () => {
+        const sql = `
+            SELECT * FROM get_active_users();
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({});
+        expect(result.normalizedQuery).toMatch(/from\s+get_active_users\s*\(\)/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('detects simple inner join', () => {
+        const sql = `
+          SELECT * FROM users
+          JOIN orders ON users.id = orders.user_id
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['SELECT'],
+            orders: ['SELECT'],
+        });
+    });
+    it('detects LEFT JOIN', () => {
+        const sql = `
+          SELECT u.name, o.total
+          FROM users u
+          LEFT JOIN orders o ON u.id = o.user_id
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['SELECT'],
+            orders: ['SELECT'],
+        });
+    });
+    it('detects RIGHT JOIN', () => {
+        const sql = `
+          SELECT * FROM payments
+          RIGHT JOIN invoices ON payments.invoice_id = invoices.id
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            payments: ['SELECT'],
+            invoices: ['SELECT'],
+        });
+    });
+    it('detects FULL OUTER JOIN', () => {
+        const sql = `
+          SELECT * FROM logs l
+          FULL OUTER JOIN metrics m ON l.time = m.time
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            logs: ['SELECT'],
+            metrics: ['SELECT'],
+        });
+    });
+    it('detects JOIN with subquery alias', () => {
+        const sql = `
+          SELECT * FROM users u
+          JOIN (SELECT * FROM events WHERE type = 'login') e ON u.id = e.user_id
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['SELECT'],
+            events: ['SELECT'],
+        });
+    });
+    it('ignores subquery alias after JOIN', () => {
+        const sql = `
+          SELECT * FROM users
+          JOIN (SELECT * FROM sessions) AS s ON users.id = s.user_id
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['SELECT'],
+            sessions: ['SELECT'],
+        });
+    });
+    it('handles JOIN with quoted identifiers', () => {
+        const sql = `
+          SELECT * FROM "userData"
+          JOIN "auditLogs" ON "userData"."id" = "auditLogs"."userId"
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            userdata: ['SELECT'],
+            auditlogs: ['SELECT'],
+        });
+    });
+    it('detects tables involved in LATERAL JOINs', () => {
+        const sql = `
+            SELECT u.id, r.*
+            FROM users u
+            LEFT JOIN LATERAL (
+              SELECT * FROM reports WHERE reports.user_id = u.id ORDER BY created_at DESC LIMIT 1
+            ) r ON true
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['SELECT'],
+            reports: ['SELECT'],
+        });
+        expect(result.normalizedQuery).toMatch(/join\s+lateral/i);
+        expect(result.normalizedQuery).toMatch(/from\s+reports/i);
+    });
+    it('collapses IN clauses with values to avoid cardinality explosion', () => {
+        const sql = `SELECT name FROM users WHERE id IN (1, 2, 3)`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ users: ['SELECT'] });
+        expect(result.normalizedQuery).toContain('IN(...)');
+        expect(result.presentableQuery).toEqual(`SELECT name FROM users WHERE id IN (...)`);
+    });
+    it('preserves and analyzes subquery in IN clause', () => {
+        const sql = `SELECT * FROM users WHERE id IN (SELECT user_id FROM events)`;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({ users: ['SELECT'], events: ['SELECT'] });
+        expect(result.normalizedQuery).toMatch(/IN\s*\(.*SELECT.*\)/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+    it('ignores CTEs in table detection', () => {
+        const sql = `
+          WITH recent_orders AS (
+            SELECT * FROM orders
+          )
+          SELECT * FROM recent_orders JOIN users ON users.id = recent_orders.user_id
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).not.toHaveProperty('recent_orders');
+        expect(result.tableOperations).toEqual({ orders: ['SELECT'], users: ['SELECT'] });
+    });
+    it('handles multiple CTEs and ignores them as tables', () => {
+        const sql = `
+            WITH active_users AS (
+              SELECT * FROM users WHERE active = true
+            ),
+            recent_logins AS (
+              SELECT * FROM logins WHERE login_time > NOW() - INTERVAL '7 days'
+            )
+            SELECT au.id, rl.login_time
+            FROM active_users au
+            JOIN recent_logins rl ON au.id = rl.user_id
+            JOIN sessions s ON s.user_id = au.id
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['SELECT'],
+            logins: ['SELECT'],
+            sessions: ['SELECT'],
+        });
+        expect(result.tableOperations).not.toHaveProperty('active_users');
+        expect(result.tableOperations).not.toHaveProperty('recent_logins');
+        // Also check normalization keeps the CTEs in the output
+        expect(result.normalizedQuery).toMatch(/with\s+active_users/i);
+        expect(result.normalizedQuery).toMatch(/recent_logins/i);
+    });
+    it('handles multiple quoted CTEs and real quoted table names', () => {
+        const sql = `
+            WITH "ActiveUsers" AS (
+              SELECT * FROM "Users" WHERE "Active" = true
+            ),
+            [RecentLogins] AS (
+              SELECT * FROM [Logins] WHERE [LoginTime] > NOW() - INTERVAL '7 days'
+            )
+            SELECT au."Id", rl."LoginTime"
+            FROM "ActiveUsers" au
+            JOIN [RecentLogins] rl ON au."Id" = rl."UserId"
+            JOIN \`Sessions\` s ON s.\`UserId\` = au."Id"
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            users: ['SELECT'],
+            logins: ['SELECT'],
+            sessions: ['SELECT'],
+        });
+        expect(result.tableOperations).not.toHaveProperty('activeusers');
+        expect(result.tableOperations).not.toHaveProperty('recentlogins');
+        expect(result.normalizedQuery).toMatch(/with\s+activeusers/i);
+        expect(result.normalizedQuery).toMatch(/recentlogins/i);
+        expect(result.normalizedQuery).toMatch(/from\s+activeusers/i);
+        expect(result.normalizedQuery).toMatch(/join\s+sessions/i);
+    });
+    it('handles recursive CTEs and ignores the CTE alias as a table', () => {
+        const sql = `
+            WITH RECURSIVE descendants AS (
+              SELECT id, parent_id FROM categories WHERE parent_id IS NULL
+              UNION ALL
+              SELECT c.id, c.parent_id
+              FROM categories c
+              JOIN descendants d ON c.parent_id = d.id
+            )
+            SELECT * FROM descendants;
+          `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            categories: ['SELECT'],
+        });
+        expect(result.tableOperations).not.toHaveProperty('descendants');
+        // Normalization check (ensure RECURSIVE appears)
+        expect(result.normalizedQuery).toMatch(/with\s+recursive\s+descendants/i);
+        expect(result.normalizedQuery).toMatch(/join\s+descendants/i);
+    });
+    it('ignores function argument in EXTRACT() when detecting tables', () => {
+        const sql = `
+          SELECT id, extract('epoch' FROM created) AS time, actor, changes
+          FROM transactions
+          WHERE transactions.id = $1
+        `;
+        const result = (0, sql_analyzer_1.analyzeSQL)(sql);
+        expect(result.tableOperations).toEqual({
+            transactions: ['SELECT']
+        });
+        // Bonus assertion: normalized query includes EXTRACT(...) intact
+        expect(result.normalizedQuery).toMatch(/extract\s*\(.*from.*created.*\)/i);
+        expect(result.presentableQuery).toEqual(sql);
+    });
+});