@deepagents/text2sql 5.0.0 → 6.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CLICKHOUSE-DEPLOYMENT.md +181 -0
- package/README.md +32 -4
- package/dist/bin/sql.js +34 -51
- package/dist/index.js +58 -289
- package/dist/index.js.map +4 -4
- package/dist/lib/adapters/adapter.d.ts +9 -2
- package/dist/lib/adapters/adapter.d.ts.map +1 -1
- package/dist/lib/adapters/bigquery/bigquery.d.ts.map +1 -1
- package/dist/lib/adapters/bigquery/bigquery.sql-policy.d.ts +9 -0
- package/dist/lib/adapters/bigquery/bigquery.sql-policy.d.ts.map +1 -0
- package/dist/lib/adapters/bigquery/index.d.ts +1 -0
- package/dist/lib/adapters/bigquery/index.d.ts.map +1 -1
- package/dist/lib/adapters/bigquery/index.js +305 -259
- package/dist/lib/adapters/bigquery/index.js.map +4 -4
- package/dist/lib/adapters/clickhouse/clickhouse.d.ts +22 -0
- package/dist/lib/adapters/clickhouse/clickhouse.d.ts.map +1 -0
- package/dist/lib/adapters/clickhouse/clickhouse.sql-policy.d.ts +8 -0
- package/dist/lib/adapters/clickhouse/clickhouse.sql-policy.d.ts.map +1 -0
- package/dist/lib/adapters/clickhouse/constraint.clickhouse.grounding.d.ts +8 -0
- package/dist/lib/adapters/clickhouse/constraint.clickhouse.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/clickhouse/index.d.ts +33 -0
- package/dist/lib/adapters/clickhouse/index.d.ts.map +1 -0
- package/dist/lib/adapters/clickhouse/index.js +1546 -0
- package/dist/lib/adapters/clickhouse/index.js.map +7 -0
- package/dist/lib/adapters/clickhouse/indexes.clickhouse.grounding.d.ts +8 -0
- package/dist/lib/adapters/clickhouse/indexes.clickhouse.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/clickhouse/info.clickhouse.grounding.d.ts +8 -0
- package/dist/lib/adapters/clickhouse/info.clickhouse.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/clickhouse/row-count.clickhouse.grounding.d.ts +8 -0
- package/dist/lib/adapters/clickhouse/row-count.clickhouse.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/clickhouse/table.clickhouse.grounding.d.ts +11 -0
- package/dist/lib/adapters/clickhouse/table.clickhouse.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/clickhouse/view.clickhouse.grounding.d.ts +9 -0
- package/dist/lib/adapters/clickhouse/view.clickhouse.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/groundings/abstract.grounding.d.ts +11 -16
- package/dist/lib/adapters/groundings/abstract.grounding.d.ts.map +1 -1
- package/dist/lib/adapters/groundings/context.d.ts +3 -0
- package/dist/lib/adapters/groundings/context.d.ts.map +1 -1
- package/dist/lib/adapters/groundings/index.js +17 -0
- package/dist/lib/adapters/groundings/index.js.map +2 -2
- package/dist/lib/adapters/groundings/table.grounding.d.ts +1 -0
- package/dist/lib/adapters/groundings/table.grounding.d.ts.map +1 -1
- package/dist/lib/adapters/groundings/view.grounding.d.ts +1 -0
- package/dist/lib/adapters/groundings/view.grounding.d.ts.map +1 -1
- package/dist/lib/adapters/mysql/index.d.ts +1 -0
- package/dist/lib/adapters/mysql/index.d.ts.map +1 -1
- package/dist/lib/adapters/mysql/index.js +319 -259
- package/dist/lib/adapters/mysql/index.js.map +4 -4
- package/dist/lib/adapters/mysql/mysql.d.ts.map +1 -1
- package/dist/lib/adapters/mysql/mysql.sql-policy.d.ts +11 -0
- package/dist/lib/adapters/mysql/mysql.sql-policy.d.ts.map +1 -0
- package/dist/lib/adapters/parser-sql-policy.d.ts +23 -0
- package/dist/lib/adapters/parser-sql-policy.d.ts.map +1 -0
- package/dist/lib/adapters/postgres/index.d.ts +1 -0
- package/dist/lib/adapters/postgres/index.d.ts.map +1 -1
- package/dist/lib/adapters/postgres/index.js +325 -259
- package/dist/lib/adapters/postgres/index.js.map +4 -4
- package/dist/lib/adapters/postgres/postgres.d.ts.map +1 -1
- package/dist/lib/adapters/postgres/postgres.sql-policy.d.ts +10 -0
- package/dist/lib/adapters/postgres/postgres.sql-policy.d.ts.map +1 -0
- package/dist/lib/adapters/posthog/definitions.posthog.grounding.d.ts +19 -0
- package/dist/lib/adapters/posthog/definitions.posthog.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/posthog/index.d.ts +22 -0
- package/dist/lib/adapters/posthog/index.d.ts.map +1 -0
- package/dist/lib/adapters/posthog/index.js +1303 -0
- package/dist/lib/adapters/posthog/index.js.map +7 -0
- package/dist/lib/adapters/posthog/info.posthog.grounding.d.ts +7 -0
- package/dist/lib/adapters/posthog/info.posthog.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/posthog/posthog.d.ts +23 -0
- package/dist/lib/adapters/posthog/posthog.d.ts.map +1 -0
- package/dist/lib/adapters/posthog/posthog.sql-policy.d.ts +8 -0
- package/dist/lib/adapters/posthog/posthog.sql-policy.d.ts.map +1 -0
- package/dist/lib/adapters/posthog/schema.posthog.grounding.d.ts +16 -0
- package/dist/lib/adapters/posthog/schema.posthog.grounding.d.ts.map +1 -0
- package/dist/lib/adapters/posthog/transport.d.ts +16 -0
- package/dist/lib/adapters/posthog/transport.d.ts.map +1 -0
- package/dist/lib/adapters/posthog/types.d.ts +95 -0
- package/dist/lib/adapters/posthog/types.d.ts.map +1 -0
- package/dist/lib/adapters/spreadsheet/index.js +303 -259
- package/dist/lib/adapters/spreadsheet/index.js.map +4 -4
- package/dist/lib/adapters/spreadsheet/parser.d.ts.map +1 -1
- package/dist/lib/adapters/sql-policy.d.ts +19 -0
- package/dist/lib/adapters/sql-policy.d.ts.map +1 -0
- package/dist/lib/adapters/sqlite/index.d.ts +1 -0
- package/dist/lib/adapters/sqlite/index.d.ts.map +1 -1
- package/dist/lib/adapters/sqlite/index.js +305 -259
- package/dist/lib/adapters/sqlite/index.js.map +4 -4
- package/dist/lib/adapters/sqlite/sqlite.d.ts.map +1 -1
- package/dist/lib/adapters/sqlite/sqlite.sql-policy.d.ts +8 -0
- package/dist/lib/adapters/sqlite/sqlite.sql-policy.d.ts.map +1 -0
- package/dist/lib/adapters/sqlserver/index.d.ts +1 -0
- package/dist/lib/adapters/sqlserver/index.d.ts.map +1 -1
- package/dist/lib/adapters/sqlserver/index.js +312 -259
- package/dist/lib/adapters/sqlserver/index.js.map +4 -4
- package/dist/lib/adapters/sqlserver/sqlserver.d.ts.map +1 -1
- package/dist/lib/adapters/sqlserver/sqlserver.sql-policy.d.ts +11 -0
- package/dist/lib/adapters/sqlserver/sqlserver.sql-policy.d.ts.map +1 -0
- package/dist/lib/agents/exceptions.d.ts +1 -1
- package/dist/lib/agents/sql.agent.d.ts.map +1 -1
- package/dist/lib/sql-scope-error.d.ts +3 -0
- package/dist/lib/sql-scope-error.d.ts.map +1 -0
- package/dist/lib/synthesis/index.js +32 -38
- package/dist/lib/synthesis/index.js.map +4 -4
- package/package.json +35 -23
- package/dist/lib/adapters/runtime-scope.d.ts +0 -16
- package/dist/lib/adapters/runtime-scope.d.ts.map +0 -1
|
@@ -2,10 +2,10 @@
|
|
|
2
2
|
import { format as formatSql } from "sql-formatter";
|
|
3
3
|
|
|
4
4
|
// packages/text2sql/src/lib/agents/exceptions.ts
|
|
5
|
-
var sqlValidationMarker = Symbol("SQLValidationError");
|
|
6
|
-
var unanswerableSqlMarker = Symbol("UnanswerableSQLError");
|
|
7
|
-
var sqlScopeMarker = Symbol("SQLScopeError");
|
|
8
|
-
var sqlReadOnlyMarker = Symbol("SQLReadOnlyError");
|
|
5
|
+
var sqlValidationMarker = /* @__PURE__ */ Symbol("SQLValidationError");
|
|
6
|
+
var unanswerableSqlMarker = /* @__PURE__ */ Symbol("UnanswerableSQLError");
|
|
7
|
+
var sqlScopeMarker = /* @__PURE__ */ Symbol("SQLScopeError");
|
|
8
|
+
var sqlReadOnlyMarker = /* @__PURE__ */ Symbol("SQLReadOnlyError");
|
|
9
9
|
var SQLValidationError = class _SQLValidationError extends Error {
|
|
10
10
|
[sqlValidationMarker];
|
|
11
11
|
constructor(message) {
|
|
@@ -165,164 +165,21 @@ function createGroundingContext(options = {}) {
|
|
|
165
165
|
views: [],
|
|
166
166
|
relationships: [],
|
|
167
167
|
info: void 0,
|
|
168
|
+
fragments: [],
|
|
168
169
|
cache: /* @__PURE__ */ new Map(),
|
|
169
170
|
onProgress: timestampProgress(options.onProgress)
|
|
170
171
|
};
|
|
171
172
|
}
|
|
172
173
|
|
|
173
|
-
// packages/text2sql/src/lib/adapters/runtime-scope.ts
|
|
174
|
-
import nodeSqlParser from "node-sql-parser";
|
|
175
|
-
var { Parser } = nodeSqlParser;
|
|
176
|
-
var parser = new Parser();
|
|
177
|
-
function parseStatementTypes(sql, dialect) {
|
|
178
|
-
const ast = parser.astify(sql, { database: dialect });
|
|
179
|
-
const statements = Array.isArray(ast) ? ast : [ast];
|
|
180
|
-
return statements.flatMap(
|
|
181
|
-
(statement) => isAstLike(statement) && typeof statement.type === "string" ? [statement.type] : []
|
|
182
|
-
);
|
|
183
|
-
}
|
|
184
|
-
function extractBaseEntityReferences(sql, dialect) {
|
|
185
|
-
const ast = parser.astify(sql, { database: dialect });
|
|
186
|
-
const state = {
|
|
187
|
-
cteNames: /* @__PURE__ */ new Set(),
|
|
188
|
-
references: /* @__PURE__ */ new Map()
|
|
189
|
-
};
|
|
190
|
-
visitNode(ast, state);
|
|
191
|
-
return Array.from(state.references.values());
|
|
192
|
-
}
|
|
193
|
-
function buildOutOfScopePayload(sql, referencedEntities, allowedEntities) {
|
|
194
|
-
return {
|
|
195
|
-
error: `Query references entities outside grounded scope: ${referencedEntities.join(", ")}`,
|
|
196
|
-
error_type: "OUT_OF_SCOPE",
|
|
197
|
-
suggestion: "Restrict the query to grounded tables/views or expand grounding to include the referenced entities.",
|
|
198
|
-
sql_attempted: sql,
|
|
199
|
-
referenced_entities: referencedEntities,
|
|
200
|
-
allowed_entities: allowedEntities
|
|
201
|
-
};
|
|
202
|
-
}
|
|
203
|
-
function buildScopeParseErrorPayload(sql, dialect, error) {
|
|
204
|
-
const parserError = error instanceof Error ? error.message : String(error ?? "Unknown error");
|
|
205
|
-
return {
|
|
206
|
-
error: `SQL scope analysis failed before validation/execution: ${parserError}`,
|
|
207
|
-
error_type: "SQL_SCOPE_PARSE_ERROR",
|
|
208
|
-
suggestion: "Rewrite the query into simpler SQL that can be analyzed safely, or extend parser coverage for this dialect feature.",
|
|
209
|
-
sql_attempted: sql,
|
|
210
|
-
parser_dialect: dialect,
|
|
211
|
-
parser_error: parserError
|
|
212
|
-
};
|
|
213
|
-
}
|
|
214
|
-
function visitNode(node, state) {
|
|
215
|
-
if (Array.isArray(node)) {
|
|
216
|
-
for (const item of node) {
|
|
217
|
-
visitNode(item, state);
|
|
218
|
-
}
|
|
219
|
-
return;
|
|
220
|
-
}
|
|
221
|
-
if (!isAstLike(node)) {
|
|
222
|
-
return;
|
|
223
|
-
}
|
|
224
|
-
if (isStatementNode(node)) {
|
|
225
|
-
visitStatement(node, state);
|
|
226
|
-
return;
|
|
227
|
-
}
|
|
228
|
-
if (isTableReferenceNode(node)) {
|
|
229
|
-
addReference(node, state);
|
|
230
|
-
}
|
|
231
|
-
for (const value of Object.values(node)) {
|
|
232
|
-
visitNode(value, state);
|
|
233
|
-
}
|
|
234
|
-
}
|
|
235
|
-
function visitStatement(node, parentState) {
|
|
236
|
-
const localState = {
|
|
237
|
-
cteNames: new Set(parentState.cteNames),
|
|
238
|
-
references: parentState.references
|
|
239
|
-
};
|
|
240
|
-
const withItems = Array.isArray(node.with) ? node.with : [];
|
|
241
|
-
for (const item of withItems) {
|
|
242
|
-
if (!isAstLike(item)) {
|
|
243
|
-
continue;
|
|
244
|
-
}
|
|
245
|
-
const cteName = readCteName(item);
|
|
246
|
-
if (cteName) {
|
|
247
|
-
localState.cteNames.add(caseFold(cteName));
|
|
248
|
-
}
|
|
249
|
-
}
|
|
250
|
-
for (const item of withItems) {
|
|
251
|
-
if (!isAstLike(item)) {
|
|
252
|
-
continue;
|
|
253
|
-
}
|
|
254
|
-
visitNode(item.stmt, localState);
|
|
255
|
-
}
|
|
256
|
-
for (const [key, value] of Object.entries(node)) {
|
|
257
|
-
if (key === "with") {
|
|
258
|
-
continue;
|
|
259
|
-
}
|
|
260
|
-
visitNode(value, localState);
|
|
261
|
-
}
|
|
262
|
-
}
|
|
263
|
-
function addReference(node, state) {
|
|
264
|
-
const table2 = typeof node.table === "string" ? node.table : null;
|
|
265
|
-
if (!table2) {
|
|
266
|
-
return;
|
|
267
|
-
}
|
|
268
|
-
if (state.cteNames.has(caseFold(table2))) {
|
|
269
|
-
return;
|
|
270
|
-
}
|
|
271
|
-
const db = typeof node.db === "string" ? node.db : null;
|
|
272
|
-
const key = db ? `${db}.${table2}` : table2;
|
|
273
|
-
if (!state.references.has(key)) {
|
|
274
|
-
state.references.set(key, { db, table: table2 });
|
|
275
|
-
}
|
|
276
|
-
}
|
|
277
|
-
function readCteName(node) {
|
|
278
|
-
const name = node.name;
|
|
279
|
-
if (typeof name === "string") {
|
|
280
|
-
return name;
|
|
281
|
-
}
|
|
282
|
-
if (!isAstLike(name)) {
|
|
283
|
-
return void 0;
|
|
284
|
-
}
|
|
285
|
-
const value = name.value;
|
|
286
|
-
return typeof value === "string" ? value : void 0;
|
|
287
|
-
}
|
|
288
|
-
function isStatementNode(node) {
|
|
289
|
-
const type = node.type;
|
|
290
|
-
return typeof type === "string" && ["delete", "insert", "replace", "select", "update"].includes(type);
|
|
291
|
-
}
|
|
292
|
-
function isTableReferenceNode(node) {
|
|
293
|
-
if (node.type === "column_ref") {
|
|
294
|
-
return false;
|
|
295
|
-
}
|
|
296
|
-
if (typeof node.table !== "string") {
|
|
297
|
-
return false;
|
|
298
|
-
}
|
|
299
|
-
return "addition" in node || "as" in node || "db" in node || "join" in node || "operator" in node || "surround" in node || "table_hint" in node || "temporal_table" in node;
|
|
300
|
-
}
|
|
301
|
-
function isAstLike(value) {
|
|
302
|
-
return typeof value === "object" && value !== null;
|
|
303
|
-
}
|
|
304
|
-
function caseFold(value) {
|
|
305
|
-
return value.toLowerCase();
|
|
306
|
-
}
|
|
307
|
-
|
|
308
174
|
// packages/text2sql/src/lib/adapters/adapter.ts
|
|
309
|
-
var PARSER_DIALECTS_BY_FORMATTER_LANGUAGE = {
|
|
310
|
-
sqlite: ["sqlite", "mysql"],
|
|
311
|
-
postgresql: ["postgresql"],
|
|
312
|
-
bigquery: ["bigquery"],
|
|
313
|
-
transactsql: ["transactsql"],
|
|
314
|
-
mysql: ["mysql"]
|
|
315
|
-
};
|
|
316
|
-
function parserDialectsFor(formatterLanguage) {
|
|
317
|
-
const candidates = PARSER_DIALECTS_BY_FORMATTER_LANGUAGE[formatterLanguage];
|
|
318
|
-
if (!candidates) {
|
|
319
|
-
throw new TypeError(
|
|
320
|
-
`No scope dialect mapping for formatter language "${formatterLanguage}". Add it to PARSER_DIALECTS_BY_FORMATTER_LANGUAGE in adapter.ts.`
|
|
321
|
-
);
|
|
322
|
-
}
|
|
323
|
-
return candidates;
|
|
324
|
-
}
|
|
325
175
|
var Adapter = class {
|
|
176
|
+
#policyAnalyzer;
|
|
177
|
+
/**
|
|
178
|
+
* Injects the strategy that guards validate() and execute().
|
|
179
|
+
*/
|
|
180
|
+
constructor(policyAnalyzer) {
|
|
181
|
+
this.#policyAnalyzer = policyAnalyzer;
|
|
182
|
+
}
|
|
326
183
|
/**
|
|
327
184
|
* Introspect the database schema and return context fragments.
|
|
328
185
|
*
|
|
@@ -358,14 +215,14 @@ var Adapter = class {
|
|
|
358
215
|
}
|
|
359
216
|
/**
|
|
360
217
|
* Resolve the allowed entity names (tables + views) from grounding config.
|
|
361
|
-
*
|
|
218
|
+
* Asks each grounding to contribute its entities; annotators contribute
|
|
219
|
+
* nothing, so their metadata scans are skipped.
|
|
362
220
|
* Results are NOT cached — call once and store the result.
|
|
363
221
|
*/
|
|
364
222
|
async resolveAllowedEntities() {
|
|
365
223
|
const ctx = createGroundingContext();
|
|
366
224
|
for (const fn of this.grounding) {
|
|
367
|
-
|
|
368
|
-
await grounding.execute(ctx);
|
|
225
|
+
await fn(this).contributeEntities(ctx);
|
|
369
226
|
}
|
|
370
227
|
return [...ctx.tables.map((t) => t.name), ...ctx.views.map((v) => v.name)];
|
|
371
228
|
}
|
|
@@ -410,6 +267,7 @@ var Adapter = class {
|
|
|
410
267
|
this.#relationshipToFragment(rel, sourceTable, targetTable)
|
|
411
268
|
);
|
|
412
269
|
}
|
|
270
|
+
fragments.push(...ctx.fragments ?? []);
|
|
413
271
|
return fragments;
|
|
414
272
|
}
|
|
415
273
|
/**
|
|
@@ -542,120 +400,33 @@ var Adapter = class {
|
|
|
542
400
|
#decodeShellEscapes(sql) {
|
|
543
401
|
return sql.replace(/\\n/g, "\n").replace(/\\t/g, " ").replace(/\\([().*])/g, "$1").replace(/\\(?=$)/gm, "");
|
|
544
402
|
}
|
|
545
|
-
#checkReadOnly(sql) {
|
|
546
|
-
const statementTypes = this.#readParsedStatementTypes(sql);
|
|
547
|
-
if (statementTypes) {
|
|
548
|
-
if (statementTypes.length === 1 && statementTypes[0] === "select") {
|
|
549
|
-
return null;
|
|
550
|
-
}
|
|
551
|
-
return "only SELECT or WITH queries allowed";
|
|
552
|
-
}
|
|
553
|
-
const keyword = this.#firstStatementKeyword(sql);
|
|
554
|
-
if (keyword === "SELECT" || keyword === "WITH") return null;
|
|
555
|
-
return "only SELECT or WITH queries allowed";
|
|
556
|
-
}
|
|
557
|
-
#readParsedStatementTypes(sql) {
|
|
558
|
-
for (const dialect of parserDialectsFor(this.formatterLanguage)) {
|
|
559
|
-
try {
|
|
560
|
-
return parseStatementTypes(sql, dialect);
|
|
561
|
-
} catch {
|
|
562
|
-
}
|
|
563
|
-
}
|
|
564
|
-
return null;
|
|
565
|
-
}
|
|
566
|
-
#firstStatementKeyword(sql) {
|
|
567
|
-
let offset = 0;
|
|
568
|
-
while (offset < sql.length) {
|
|
569
|
-
if (/\s/.test(sql[offset])) {
|
|
570
|
-
offset++;
|
|
571
|
-
continue;
|
|
572
|
-
}
|
|
573
|
-
if (sql.startsWith("--", offset)) {
|
|
574
|
-
offset += 2;
|
|
575
|
-
while (offset < sql.length && sql[offset] !== "\n" && sql[offset] !== "\r") {
|
|
576
|
-
offset++;
|
|
577
|
-
}
|
|
578
|
-
continue;
|
|
579
|
-
}
|
|
580
|
-
if (sql.startsWith("/*", offset)) {
|
|
581
|
-
const commentEnd = sql.indexOf("*/", offset + 2);
|
|
582
|
-
if (commentEnd === -1) return null;
|
|
583
|
-
offset = commentEnd + 2;
|
|
584
|
-
continue;
|
|
585
|
-
}
|
|
586
|
-
const keyword = /^[A-Za-z]+/.exec(sql.slice(offset));
|
|
587
|
-
return keyword ? keyword[0].toUpperCase() : null;
|
|
588
|
-
}
|
|
589
|
-
return null;
|
|
590
|
-
}
|
|
591
403
|
#cachedAllowedEntities = null;
|
|
592
404
|
async #resolveScope() {
|
|
593
405
|
if (this.#cachedAllowedEntities) return this.#cachedAllowedEntities;
|
|
594
406
|
this.#cachedAllowedEntities = await this.resolveAllowedEntities();
|
|
595
407
|
return this.#cachedAllowedEntities;
|
|
596
408
|
}
|
|
597
|
-
async #
|
|
598
|
-
|
|
599
|
-
|
|
600
|
-
let lastError;
|
|
601
|
-
let lastDialect = candidates[0];
|
|
602
|
-
for (const candidate of candidates) {
|
|
603
|
-
try {
|
|
604
|
-
references = extractBaseEntityReferences(sql, candidate);
|
|
605
|
-
break;
|
|
606
|
-
} catch (error) {
|
|
607
|
-
lastDialect = candidate;
|
|
608
|
-
lastError = error;
|
|
609
|
-
}
|
|
610
|
-
}
|
|
611
|
-
if (references === null) {
|
|
612
|
-
return buildScopeParseErrorPayload(sql, lastDialect, lastError);
|
|
613
|
-
}
|
|
614
|
-
if (references.length === 0) return null;
|
|
615
|
-
const allowedQualified = new Set(
|
|
616
|
-
allowedEntities.map((e) => e.toLowerCase())
|
|
617
|
-
);
|
|
618
|
-
const allowedUnqualified = /* @__PURE__ */ new Set();
|
|
619
|
-
for (const entity of allowedEntities) {
|
|
620
|
-
const dot = entity.lastIndexOf(".");
|
|
621
|
-
if (dot !== -1) {
|
|
622
|
-
allowedUnqualified.add(entity.slice(dot + 1).toLowerCase());
|
|
623
|
-
} else {
|
|
624
|
-
allowedUnqualified.add(entity.toLowerCase());
|
|
625
|
-
}
|
|
626
|
-
}
|
|
627
|
-
const outOfScope = references.map((ref) => ref.db ? `${ref.db}.${ref.table}` : ref.table).filter((name) => {
|
|
628
|
-
const lower = name.toLowerCase();
|
|
629
|
-
if (name.includes(".")) {
|
|
630
|
-
if (allowedQualified.has(lower)) return false;
|
|
631
|
-
const parts = lower.split(".");
|
|
632
|
-
if (parts.length >= 3) {
|
|
633
|
-
const datasetTable = parts.slice(-2).join(".");
|
|
634
|
-
if (allowedQualified.has(datasetTable)) return false;
|
|
635
|
-
}
|
|
636
|
-
return true;
|
|
637
|
-
}
|
|
638
|
-
return !allowedQualified.has(lower) && !allowedUnqualified.has(lower);
|
|
409
|
+
async #analyzePolicy(sql) {
|
|
410
|
+
return this.#policyAnalyzer.analyze(sql, {
|
|
411
|
+
resolveAllowedEntities: () => this.#resolveScope()
|
|
639
412
|
});
|
|
640
|
-
if (outOfScope.length === 0) return null;
|
|
641
|
-
return buildOutOfScopePayload(sql, outOfScope, allowedEntities);
|
|
642
413
|
}
|
|
643
414
|
async validate(sql) {
|
|
644
415
|
const decoded = this.#decodeShellEscapes(sql);
|
|
645
|
-
const
|
|
646
|
-
if (
|
|
647
|
-
|
|
648
|
-
const scopeError = await this.#checkScope(decoded, allowed);
|
|
649
|
-
if (scopeError) return JSON.stringify(scopeError);
|
|
416
|
+
const violation = await this.#analyzePolicy(decoded);
|
|
417
|
+
if (violation?.kind === "read-only") return violation.message;
|
|
418
|
+
if (violation?.kind === "scope") return JSON.stringify(violation.payload);
|
|
650
419
|
return this.validateImpl(decoded);
|
|
651
420
|
}
|
|
652
421
|
async execute(sql) {
|
|
653
422
|
const decoded = this.#decodeShellEscapes(sql);
|
|
654
|
-
const
|
|
655
|
-
if (
|
|
656
|
-
|
|
657
|
-
|
|
658
|
-
if (
|
|
423
|
+
const violation = await this.#analyzePolicy(decoded);
|
|
424
|
+
if (violation?.kind === "read-only") {
|
|
425
|
+
throw new SQLReadOnlyError(violation.message);
|
|
426
|
+
}
|
|
427
|
+
if (violation?.kind === "scope") {
|
|
428
|
+
throw new SQLScopeError(violation.payload);
|
|
429
|
+
}
|
|
659
430
|
return this.executeImpl(decoded);
|
|
660
431
|
}
|
|
661
432
|
/**
|
|
@@ -736,6 +507,16 @@ var AbstractGrounding = class {
|
|
|
736
507
|
this.name = name;
|
|
737
508
|
this.phase = phase;
|
|
738
509
|
}
|
|
510
|
+
/**
|
|
511
|
+
* Populate ctx with the tables/views this grounding makes available for scope
|
|
512
|
+
* resolution. Annotators decorate entities other groundings produced and add
|
|
513
|
+
* no membership, so the default is a no-op; entity-producing groundings
|
|
514
|
+
* override it. This lets scope resolution skip the annotators' metadata scans.
|
|
515
|
+
*
|
|
516
|
+
* @param _ctx - Shared context for accumulating entity membership
|
|
517
|
+
*/
|
|
518
|
+
async contributeEntities(_ctx) {
|
|
519
|
+
}
|
|
739
520
|
};
|
|
740
521
|
|
|
741
522
|
// packages/text2sql/src/lib/adapters/groundings/column-stats.grounding.ts
|
|
@@ -1059,6 +840,9 @@ var TableGrounding = class extends AbstractGrounding {
|
|
|
1059
840
|
this.#forward = config.forward;
|
|
1060
841
|
this.#backward = config.backward;
|
|
1061
842
|
}
|
|
843
|
+
async contributeEntities(ctx) {
|
|
844
|
+
await this.execute(ctx);
|
|
845
|
+
}
|
|
1062
846
|
/**
|
|
1063
847
|
* Execute the grounding process.
|
|
1064
848
|
* Writes discovered tables and relationships to the context.
|
|
@@ -1605,6 +1389,271 @@ var SqlServerRowCountGrounding = class extends RowCountGrounding {
|
|
|
1605
1389
|
}
|
|
1606
1390
|
};
|
|
1607
1391
|
|
|
1392
|
+
// packages/text2sql/src/lib/adapters/parser-sql-policy.ts
|
|
1393
|
+
import nodeSqlParser from "node-sql-parser";
|
|
1394
|
+
|
|
1395
|
+
// packages/text2sql/src/lib/sql-scope-error.ts
|
|
1396
|
+
function buildScopeParseErrorPayload(sql, parserDialect, error) {
|
|
1397
|
+
const parserError = error instanceof Error ? error.message : String(error ?? "Unknown error");
|
|
1398
|
+
return {
|
|
1399
|
+
error: `SQL scope analysis failed before validation/execution: ${parserError}`,
|
|
1400
|
+
error_type: "SQL_SCOPE_PARSE_ERROR",
|
|
1401
|
+
suggestion: "Rewrite the query into simpler SQL that can be analyzed safely, or extend parser coverage for this dialect feature.",
|
|
1402
|
+
sql_attempted: sql,
|
|
1403
|
+
parser_dialect: parserDialect,
|
|
1404
|
+
parser_error: parserError
|
|
1405
|
+
};
|
|
1406
|
+
}
|
|
1407
|
+
|
|
1408
|
+
// packages/text2sql/src/lib/adapters/parser-sql-policy.ts
|
|
1409
|
+
var READ_ONLY_MESSAGE = "only SELECT or WITH queries allowed";
|
|
1410
|
+
var { Parser } = nodeSqlParser;
|
|
1411
|
+
var parser = new Parser();
|
|
1412
|
+
var ParserSqlPolicyAnalyzer = class {
|
|
1413
|
+
readOnlyPolicy = {};
|
|
1414
|
+
async analyze(sql, context) {
|
|
1415
|
+
if (!this.#isReadOnly(sql)) {
|
|
1416
|
+
return { kind: "read-only", message: READ_ONLY_MESSAGE };
|
|
1417
|
+
}
|
|
1418
|
+
const scopeError = await this.#checkScope(sql, context);
|
|
1419
|
+
return scopeError ? { kind: "scope", payload: scopeError } : null;
|
|
1420
|
+
}
|
|
1421
|
+
#isReadOnly(sql) {
|
|
1422
|
+
const statements = this.#readParsedStatements(sql);
|
|
1423
|
+
if (statements) {
|
|
1424
|
+
return statements.length === 1 && statements[0]?.type === "select" && !containsBlockedOperation(statements[0], this.readOnlyPolicy);
|
|
1425
|
+
}
|
|
1426
|
+
const keyword = firstStatementKeyword(sql);
|
|
1427
|
+
return keyword === "SELECT" || keyword === "WITH";
|
|
1428
|
+
}
|
|
1429
|
+
#readParsedStatements(sql) {
|
|
1430
|
+
for (const dialect of this.dialects) {
|
|
1431
|
+
try {
|
|
1432
|
+
return parseStatements(sql, dialect);
|
|
1433
|
+
} catch {
|
|
1434
|
+
}
|
|
1435
|
+
}
|
|
1436
|
+
return null;
|
|
1437
|
+
}
|
|
1438
|
+
async #checkScope(sql, context) {
|
|
1439
|
+
let references = null;
|
|
1440
|
+
let lastError;
|
|
1441
|
+
let lastDialect = this.dialects[0];
|
|
1442
|
+
for (const dialect of this.dialects) {
|
|
1443
|
+
try {
|
|
1444
|
+
references = extractBaseEntityReferences(sql, dialect);
|
|
1445
|
+
break;
|
|
1446
|
+
} catch (error) {
|
|
1447
|
+
lastDialect = dialect;
|
|
1448
|
+
lastError = error;
|
|
1449
|
+
}
|
|
1450
|
+
}
|
|
1451
|
+
if (references === null) {
|
|
1452
|
+
return buildScopeParseErrorPayload(sql, lastDialect, lastError);
|
|
1453
|
+
}
|
|
1454
|
+
if (references.length === 0) return null;
|
|
1455
|
+
const allowedEntities = await context.resolveAllowedEntities();
|
|
1456
|
+
const allowedQualified = new Set(
|
|
1457
|
+
allowedEntities.map((entity) => entity.toLowerCase())
|
|
1458
|
+
);
|
|
1459
|
+
const allowedUnqualified = /* @__PURE__ */ new Set();
|
|
1460
|
+
for (const entity of allowedEntities) {
|
|
1461
|
+
const dot = entity.lastIndexOf(".");
|
|
1462
|
+
allowedUnqualified.add(
|
|
1463
|
+
(dot === -1 ? entity : entity.slice(dot + 1)).toLowerCase()
|
|
1464
|
+
);
|
|
1465
|
+
}
|
|
1466
|
+
const outOfScope = references.map(
|
|
1467
|
+
(reference) => reference.db ? `${reference.db}.${reference.table}` : reference.table
|
|
1468
|
+
).filter((name) => {
|
|
1469
|
+
const lower = name.toLowerCase();
|
|
1470
|
+
if (!name.includes(".")) {
|
|
1471
|
+
return !allowedQualified.has(lower) && !allowedUnqualified.has(lower);
|
|
1472
|
+
}
|
|
1473
|
+
if (allowedQualified.has(lower)) return false;
|
|
1474
|
+
const parts = lower.split(".");
|
|
1475
|
+
return parts.length < 3 || !allowedQualified.has(parts.slice(-2).join("."));
|
|
1476
|
+
});
|
|
1477
|
+
return outOfScope.length === 0 ? null : buildOutOfScopePayload(sql, outOfScope, [...allowedEntities]);
|
|
1478
|
+
}
|
|
1479
|
+
};
|
|
1480
|
+
function parseStatements(sql, dialect) {
|
|
1481
|
+
const ast = parser.astify(sql, { database: dialect });
|
|
1482
|
+
const statements = Array.isArray(ast) ? ast : [ast];
|
|
1483
|
+
return statements.filter(isAstLike);
|
|
1484
|
+
}
|
|
1485
|
+
function containsBlockedOperation(node, policy) {
|
|
1486
|
+
if (Array.isArray(node)) {
|
|
1487
|
+
return node.some((item) => containsBlockedOperation(item, policy));
|
|
1488
|
+
}
|
|
1489
|
+
if (!isAstLike(node)) return false;
|
|
1490
|
+
if (policy.blockSelectInto && node.type === "select" && isAstLike(node.into) && node.into.type === "into") {
|
|
1491
|
+
return true;
|
|
1492
|
+
}
|
|
1493
|
+
if (policy.blockLockingReads && node.locking_read != null) return true;
|
|
1494
|
+
if (policy.blockAssignments && node.type === "assign") return true;
|
|
1495
|
+
if (policy.blockServerQualifiedRelations && isTableReferenceNode(node) && typeof node.server === "string") {
|
|
1496
|
+
return true;
|
|
1497
|
+
}
|
|
1498
|
+
if (policy.blockTableHints && node.table_hint != null) return true;
|
|
1499
|
+
if (node.type === "function") {
|
|
1500
|
+
const functionIdentifier = readFunctionIdentifier(node);
|
|
1501
|
+
if (functionIdentifier && policy.blockQualifiedFunctions && functionIdentifier.parts.length > 1) {
|
|
1502
|
+
return true;
|
|
1503
|
+
}
|
|
1504
|
+
if (functionIdentifier && policy.blockedFunctions?.some(
|
|
1505
|
+
(blocked) => blocked.toLowerCase() === functionIdentifier.parts.at(-1)
|
|
1506
|
+
)) {
|
|
1507
|
+
return true;
|
|
1508
|
+
}
|
|
1509
|
+
if (functionIdentifier && policy.blockedFunctionPrefixes?.some(
|
|
1510
|
+
(prefix) => functionIdentifier.parts.at(-1)?.startsWith(prefix.toLowerCase())
|
|
1511
|
+
)) {
|
|
1512
|
+
return true;
|
|
1513
|
+
}
|
|
1514
|
+
}
|
|
1515
|
+
return Object.values(node).some(
|
|
1516
|
+
(value) => containsBlockedOperation(value, policy)
|
|
1517
|
+
);
|
|
1518
|
+
}
|
|
1519
|
+
function readFunctionIdentifier(node) {
|
|
1520
|
+
if (!isAstLike(node.name)) return null;
|
|
1521
|
+
const parts = [];
|
|
1522
|
+
if (isAstLike(node.name.schema) && typeof node.name.schema.value === "string") {
|
|
1523
|
+
appendIdentifierParts(parts, node.name.schema.value);
|
|
1524
|
+
}
|
|
1525
|
+
const names = Array.isArray(node.name.name) ? node.name.name : [];
|
|
1526
|
+
for (const name of names) {
|
|
1527
|
+
if (isAstLike(name) && typeof name.value === "string") {
|
|
1528
|
+
appendIdentifierParts(parts, name.value);
|
|
1529
|
+
}
|
|
1530
|
+
}
|
|
1531
|
+
return parts.length > 0 ? { parts } : null;
|
|
1532
|
+
}
|
|
1533
|
+
function appendIdentifierParts(parts, value) {
|
|
1534
|
+
parts.push(
|
|
1535
|
+
...value.toLowerCase().split(".").filter((part) => part.length > 0)
|
|
1536
|
+
);
|
|
1537
|
+
}
|
|
1538
|
+
function extractBaseEntityReferences(sql, dialect) {
|
|
1539
|
+
const ast = parser.astify(sql, { database: dialect });
|
|
1540
|
+
const state = {
|
|
1541
|
+
cteNames: /* @__PURE__ */ new Set(),
|
|
1542
|
+
references: /* @__PURE__ */ new Map()
|
|
1543
|
+
};
|
|
1544
|
+
visitNode(ast, state);
|
|
1545
|
+
return Array.from(state.references.values());
|
|
1546
|
+
}
|
|
1547
|
+
function firstStatementKeyword(sql) {
|
|
1548
|
+
let offset = 0;
|
|
1549
|
+
while (offset < sql.length) {
|
|
1550
|
+
if (/\s/.test(sql[offset])) {
|
|
1551
|
+
offset++;
|
|
1552
|
+
continue;
|
|
1553
|
+
}
|
|
1554
|
+
if (sql.startsWith("--", offset)) {
|
|
1555
|
+
offset += 2;
|
|
1556
|
+
while (offset < sql.length && sql[offset] !== "\n" && sql[offset] !== "\r") {
|
|
1557
|
+
offset++;
|
|
1558
|
+
}
|
|
1559
|
+
continue;
|
|
1560
|
+
}
|
|
1561
|
+
if (sql.startsWith("/*", offset)) {
|
|
1562
|
+
const commentEnd = sql.indexOf("*/", offset + 2);
|
|
1563
|
+
if (commentEnd === -1) return null;
|
|
1564
|
+
offset = commentEnd + 2;
|
|
1565
|
+
continue;
|
|
1566
|
+
}
|
|
1567
|
+
const keyword = /^[A-Za-z]+/.exec(sql.slice(offset));
|
|
1568
|
+
return keyword ? keyword[0].toUpperCase() : null;
|
|
1569
|
+
}
|
|
1570
|
+
return null;
|
|
1571
|
+
}
|
|
1572
|
+
function buildOutOfScopePayload(sql, referencedEntities, allowedEntities) {
|
|
1573
|
+
return {
|
|
1574
|
+
error: `Query references entities outside grounded scope: ${referencedEntities.join(", ")}`,
|
|
1575
|
+
error_type: "OUT_OF_SCOPE",
|
|
1576
|
+
suggestion: "Restrict the query to grounded tables/views or expand grounding to include the referenced entities.",
|
|
1577
|
+
sql_attempted: sql,
|
|
1578
|
+
referenced_entities: referencedEntities,
|
|
1579
|
+
allowed_entities: allowedEntities
|
|
1580
|
+
};
|
|
1581
|
+
}
|
|
1582
|
+
function visitNode(node, state) {
|
|
1583
|
+
if (Array.isArray(node)) {
|
|
1584
|
+
for (const item of node) visitNode(item, state);
|
|
1585
|
+
return;
|
|
1586
|
+
}
|
|
1587
|
+
if (!isAstLike(node)) return;
|
|
1588
|
+
if (isStatementNode(node)) {
|
|
1589
|
+
visitStatement(node, state);
|
|
1590
|
+
return;
|
|
1591
|
+
}
|
|
1592
|
+
if (isTableReferenceNode(node)) addReference(node, state);
|
|
1593
|
+
for (const value of Object.values(node)) visitNode(value, state);
|
|
1594
|
+
}
|
|
1595
|
+
function visitStatement(node, parentState) {
|
|
1596
|
+
const localState = {
|
|
1597
|
+
cteNames: new Set(parentState.cteNames),
|
|
1598
|
+
references: parentState.references
|
|
1599
|
+
};
|
|
1600
|
+
const withItems = Array.isArray(node.with) ? node.with : [];
|
|
1601
|
+
for (const item of withItems) {
|
|
1602
|
+
if (!isAstLike(item)) continue;
|
|
1603
|
+
const cteName = readCteName(item);
|
|
1604
|
+
if (cteName) localState.cteNames.add(caseFold(cteName));
|
|
1605
|
+
}
|
|
1606
|
+
for (const item of withItems) {
|
|
1607
|
+
if (isAstLike(item)) visitNode(item.stmt, localState);
|
|
1608
|
+
}
|
|
1609
|
+
for (const [key, value] of Object.entries(node)) {
|
|
1610
|
+
if (key !== "with") visitNode(value, localState);
|
|
1611
|
+
}
|
|
1612
|
+
}
|
|
1613
|
+
function addReference(node, state) {
|
|
1614
|
+
const table2 = typeof node.table === "string" ? node.table : null;
|
|
1615
|
+
if (!table2 || state.cteNames.has(caseFold(table2))) return;
|
|
1616
|
+
const db = typeof node.db === "string" ? node.db : null;
|
|
1617
|
+
const key = db ? `${db}.${table2}` : table2;
|
|
1618
|
+
if (!state.references.has(key)) state.references.set(key, { db, table: table2 });
|
|
1619
|
+
}
|
|
1620
|
+
function readCteName(node) {
|
|
1621
|
+
const name = node.name;
|
|
1622
|
+
if (typeof name === "string") return name;
|
|
1623
|
+
if (!isAstLike(name)) return void 0;
|
|
1624
|
+
return typeof name.value === "string" ? name.value : void 0;
|
|
1625
|
+
}
|
|
1626
|
+
function isStatementNode(node) {
|
|
1627
|
+
return typeof node.type === "string" && ["delete", "insert", "replace", "select", "update"].includes(node.type);
|
|
1628
|
+
}
|
|
1629
|
+
function isTableReferenceNode(node) {
|
|
1630
|
+
if (node.type === "column_ref" || typeof node.table !== "string")
|
|
1631
|
+
return false;
|
|
1632
|
+
return "addition" in node || "as" in node || "db" in node || "join" in node || "operator" in node || "surround" in node || "table_hint" in node || "temporal_table" in node;
|
|
1633
|
+
}
|
|
1634
|
+
function isAstLike(value) {
|
|
1635
|
+
return typeof value === "object" && value !== null;
|
|
1636
|
+
}
|
|
1637
|
+
function caseFold(value) {
|
|
1638
|
+
return value.toLowerCase();
|
|
1639
|
+
}
|
|
1640
|
+
|
|
1641
|
+
// packages/text2sql/src/lib/adapters/sqlserver/sqlserver.sql-policy.ts
|
|
1642
|
+
var SqlServerSqlPolicyAnalyzer = class extends ParserSqlPolicyAnalyzer {
|
|
1643
|
+
dialects = ["transactsql"];
|
|
1644
|
+
readOnlyPolicy = {
|
|
1645
|
+
blockSelectInto: true,
|
|
1646
|
+
blockServerQualifiedRelations: true,
|
|
1647
|
+
blockTableHints: true,
|
|
1648
|
+
blockedFunctions: [
|
|
1649
|
+
"FN_GET_AUDIT_FILE",
|
|
1650
|
+
"OPENDATASOURCE",
|
|
1651
|
+
"OPENQUERY",
|
|
1652
|
+
"OPENROWSET"
|
|
1653
|
+
]
|
|
1654
|
+
};
|
|
1655
|
+
};
|
|
1656
|
+
|
|
1608
1657
|
// packages/text2sql/src/lib/adapters/sqlserver/sqlserver.ts
|
|
1609
1658
|
var SQL_SERVER_ERROR_MAP = {
|
|
1610
1659
|
"208": {
|
|
@@ -1666,7 +1715,7 @@ var SqlServer = class extends Adapter {
|
|
|
1666
1715
|
systemSchemas = ["INFORMATION_SCHEMA", "sys"];
|
|
1667
1716
|
formatterLanguage = "transactsql";
|
|
1668
1717
|
constructor(options) {
|
|
1669
|
-
super();
|
|
1718
|
+
super(new SqlServerSqlPolicyAnalyzer());
|
|
1670
1719
|
if (!options || typeof options.execute !== "function") {
|
|
1671
1720
|
throw new Error("SqlServer adapter requires an execute function.");
|
|
1672
1721
|
}
|
|
@@ -2226,6 +2275,9 @@ var ViewGrounding = class extends AbstractGrounding {
|
|
|
2226
2275
|
this.#columns = config.columns;
|
|
2227
2276
|
this.includeDefinition = config.includeDefinition ?? true;
|
|
2228
2277
|
}
|
|
2278
|
+
async contributeEntities(ctx) {
|
|
2279
|
+
await this.execute(ctx);
|
|
2280
|
+
}
|
|
2229
2281
|
/**
|
|
2230
2282
|
* Execute the grounding process.
|
|
2231
2283
|
* Writes discovered views to the context.
|
|
@@ -2370,6 +2422,7 @@ var sqlserver_default = {
|
|
|
2370
2422
|
};
|
|
2371
2423
|
export {
|
|
2372
2424
|
SqlServer,
|
|
2425
|
+
SqlServerSqlPolicyAnalyzer,
|
|
2373
2426
|
columnStats,
|
|
2374
2427
|
columnValues,
|
|
2375
2428
|
constraints,
|