@dinoxx/dinox-cli 1.0.1 → 1.0.3

package/dist/commands/notes/searchSql.js

@@ -0,0 +1,599 @@
+import { DinoxError } from '../../utils/errors.js';
+const SEARCH_FIELDS = new Set([
+    'id',
+    'content_md',
+    'summary',
+    'tags',
+    'zettel_boxes',
+    'created_at',
+    'type',
+]);
+const FORBIDDEN_SQL_KEYWORDS = [
+    'insert',
+    'update',
+    'delete',
+    'drop',
+    'alter',
+    'create',
+    'replace',
+    'truncate',
+    'attach',
+    'detach',
+    'pragma',
+    'vacuum',
+    'begin',
+    'commit',
+    'rollback',
+];
+const SCALAR_FIELD_COLUMNS = {
+    id: 'id',
+    content_md: 'content_md',
+    summary: 'summary',
+    created_at: 'created_at',
+    type: 'type',
+};
+export async function buildNoteSearchSqlFilter(options) {
+    const expression = options.expression?.trim() ?? '';
+    if (!expression) {
+        return null;
+    }
+    try {
+        assertReadOnlySearchExpression(expression);
+        const ast = parseSearchSqlExpression(expression);
+        const zettelBoxIdByName = await buildZettelBoxIdLookup(ast, options.resolveZettelBoxNames);
+        const params = [];
+        const sql = compileNode(ast, options.noteAlias, params, zettelBoxIdByName);
+        return {
+            sql: `(${sql})`,
+            params,
+        };
+    }
+    catch (error) {
+        if (error instanceof DinoxError) {
+            throw error;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        throw new DinoxError(`Invalid --sql expression: ${message}`);
+    }
+}
+function assertReadOnlySearchExpression(expression) {
+    const unquoted = maskQuotedSegments(expression).toLowerCase();
+    if (unquoted.includes(';')) {
+        throw new DinoxError('Invalid --sql expression: only read-only WHERE-style conditions are allowed (semicolon is not permitted)');
+    }
+    if (unquoted.includes('--') || unquoted.includes('/*') || unquoted.includes('*/')) {
+        throw new DinoxError('Invalid --sql expression: SQL comments are not allowed; only read-only WHERE-style conditions are supported');
+    }
+    for (const keyword of FORBIDDEN_SQL_KEYWORDS) {
+        const pattern = new RegExp(`\\b${keyword}\\b`, 'i');
+        if (pattern.test(unquoted)) {
+            throw new DinoxError(`Invalid --sql expression: keyword '${keyword.toUpperCase()}' is not allowed (read-only search only)`);
+        }
+    }
+}
+function maskQuotedSegments(expression) {
+    let result = '';
+    let quote = null;
+    for (let i = 0; i < expression.length; i += 1) {
+        const ch = expression[i];
+        if (!quote) {
+            if (ch === '"' || ch === "'") {
+                quote = ch;
+                result += ' ';
+            }
+            else {
+                result += ch;
+            }
+            continue;
+        }
+        result += ' ';
+        if (ch === '\\') {
+            if (i + 1 < expression.length) {
+                result += ' ';
+                i += 1;
+            }
+            continue;
+        }
+        if (ch !== quote) {
+            continue;
+        }
+        if (expression[i + 1] === quote) {
+            result += ' ';
+            i += 1;
+            continue;
+        }
+        quote = null;
+    }
+    return result;
+}
+function parseSearchSqlExpression(expression) {
+    const tokens = tokenizeSearchSqlExpression(expression);
+    if (tokens.length === 0) {
+        throw new Error('Expression is empty');
+    }
+    let index = 0;
+    const peek = () => tokens[index] ?? null;
+    const consume = (expected) => {
+        const token = peek();
+        if (!token) {
+            throw new Error('Unexpected end of expression');
+        }
+        if (expected && token.type !== expected) {
+            throw new Error(`Expected ${expected} at position ${token.position + 1}`);
+        }
+        index += 1;
+        return token;
+    };
+    const match = (type) => {
+        const token = peek();
+        if (!token || token.type !== type) {
+            return false;
+        }
+        index += 1;
+        return true;
+    };
+    const parseValue = () => {
+        const token = peek();
+        if (!token) {
+            throw new Error('Unexpected end of expression while reading a value');
+        }
+        if (token.type !== 'WORD' && token.type !== 'STRING') {
+            throw new Error(`Expected value at position ${token.position + 1}`);
+        }
+        consume(token.type);
+        const value = token.value.trim();
+        if (!value) {
+            throw new Error(`Empty value at position ${token.position + 1}`);
+        }
+        return value;
+    };
+    const parseValueList = () => {
+        const open = consume('LPAREN');
+        const values = [];
+        while (true) {
+            values.push(parseValue());
+            if (match('COMMA')) {
+                continue;
+            }
+            if (match('RPAREN')) {
+                break;
+            }
+            const next = peek();
+            const nextPos = next ? next.position + 1 : open.position + 1;
+            throw new Error(`Expected ',' or ')' at position ${nextPos}`);
+        }
+        if (values.length === 0) {
+            throw new Error(`IN list cannot be empty at position ${open.position + 1}`);
+        }
+        return values;
+    };
+    const parseCondition = () => {
+        const fieldToken = peek();
+        if (!fieldToken) {
+            throw new Error('Unexpected end of expression');
+        }
+        if (fieldToken.type !== 'WORD') {
+            throw new Error(`Expected field name at position ${fieldToken.position + 1}`);
+        }
+        consume('WORD');
+        const field = normalizeSearchField(fieldToken.value);
+        if (!field) {
+            throw new Error(`Unsupported field '${fieldToken.value}' at position ${fieldToken.position + 1}`);
+        }
+        if (match('NOT')) {
+            if (match('IN')) {
+                return {
+                    kind: 'in',
+                    field,
+                    not: true,
+                    values: parseValueList(),
+                };
+            }
+            if (match('LIKE')) {
+                return {
+                    kind: 'comparison',
+                    field,
+                    operator: 'NOT LIKE',
+                    value: parseValue(),
+                };
+            }
+            const token = peek();
+            const pos = token ? token.position + 1 : fieldToken.position + 1;
+            throw new Error(`Expected IN or LIKE after NOT at position ${pos}`);
+        }
+        if (match('IN')) {
+            return {
+                kind: 'in',
+                field,
+                not: false,
+                values: parseValueList(),
+            };
+        }
+        if (match('LIKE')) {
+            return {
+                kind: 'comparison',
+                field,
+                operator: 'LIKE',
+                value: parseValue(),
+            };
+        }
+        const operatorToken = peek();
+        if (!operatorToken || operatorToken.type !== 'OP') {
+            const pos = operatorToken ? operatorToken.position + 1 : fieldToken.position + 1;
+            throw new Error(`Expected comparison operator at position ${pos}`);
+        }
+        consume('OP');
+        return {
+            kind: 'comparison',
+            field,
+            operator: normalizeComparisonOperator(operatorToken.value, operatorToken.position),
+            value: parseValue(),
+        };
+    };
+    const parsePrimary = () => {
+        const token = peek();
+        if (!token) {
+            throw new Error('Unexpected end of expression');
+        }
+        if (token.type === 'LPAREN') {
+            consume('LPAREN');
+            const node = parseOr();
+            const close = peek();
+            if (!close || close.type !== 'RPAREN') {
+                throw new Error(`Missing ')' for '(' at position ${token.position + 1}`);
+            }
+            consume('RPAREN');
+            return node;
+        }
+        return parseCondition();
+    };
+    const parseUnary = () => {
+        if (match('NOT')) {
+            return { kind: 'not', child: parseUnary() };
+        }
+        return parsePrimary();
+    };
+    const parseAnd = () => {
+        let node = parseUnary();
+        while (match('AND')) {
+            node = { kind: 'and', left: node, right: parseUnary() };
+        }
+        return node;
+    };
+    const parseOr = () => {
+        let node = parseAnd();
+        while (match('OR')) {
+            node = { kind: 'or', left: node, right: parseAnd() };
+        }
+        return node;
+    };
+    const ast = parseOr();
+    const extra = peek();
+    if (extra) {
+        throw new Error(`Unexpected token '${extra.value}' at position ${extra.position + 1}`);
+    }
+    return ast;
+}
+function tokenizeSearchSqlExpression(expression) {
+    const tokens = [];
+    let i = 0;
+    while (i < expression.length) {
+        const ch = expression[i];
+        if (/\s/.test(ch)) {
+            i += 1;
+            continue;
+        }
+        if (ch === '(') {
+            tokens.push({ type: 'LPAREN', value: ch, position: i });
+            i += 1;
+            continue;
+        }
+        if (ch === ')') {
+            tokens.push({ type: 'RPAREN', value: ch, position: i });
+            i += 1;
+            continue;
+        }
+        if (ch === ',') {
+            tokens.push({ type: 'COMMA', value: ch, position: i });
+            i += 1;
+            continue;
+        }
+        if (ch === '\'' || ch === '"') {
+            const quoted = readQuotedValue(expression, i);
+            tokens.push({ type: 'STRING', value: quoted.value, position: i });
+            i = quoted.next;
+            continue;
+        }
+        const op = readOperator(expression, i);
+        if (op) {
+            tokens.push({ type: 'OP', value: op.value, position: i });
+            i = op.next;
+            continue;
+        }
+        let j = i;
+        while (j < expression.length) {
+            const next = expression[j];
+            if (/\s/.test(next) || next === '(' || next === ')' || next === ',' || /[<>=!]/.test(next)) {
+                break;
+            }
+            j += 1;
+        }
+        const raw = expression.slice(i, j);
+        if (!raw) {
+            throw new Error(`Unsupported token '${ch}' at position ${i + 1}`);
+        }
+        const upper = raw.toUpperCase();
+        if (upper === 'AND' || upper === 'OR' || upper === 'NOT' || upper === 'IN' || upper === 'LIKE') {
+            tokens.push({ type: upper, value: raw, position: i });
+        }
+        else {
+            tokens.push({ type: 'WORD', value: raw, position: i });
+        }
+        i = j;
+    }
+    return tokens;
+}
+function readOperator(expression, start) {
+    const twoChars = expression.slice(start, start + 2);
+    if (twoChars === '<=' || twoChars === '>=' || twoChars === '<>' || twoChars === '!=') {
+        return {
+            value: twoChars,
+            next: start + 2,
+        };
+    }
+    const oneChar = expression[start];
+    if (oneChar === '=' || oneChar === '<' || oneChar === '>') {
+        return {
+            value: oneChar,
+            next: start + 1,
+        };
+    }
+    return null;
+}
+function readQuotedValue(expression, start) {
+    const quote = expression[start];
+    let i = start + 1;
+    let value = '';
+    while (i < expression.length) {
+        const ch = expression[i];
+        if (ch === '\\') {
+            if (i + 1 >= expression.length) {
+                throw new Error(`Invalid escape at position ${i + 1}`);
+            }
+            value += expression[i + 1];
+            i += 2;
+            continue;
+        }
+        if (ch === quote) {
+            if (expression[i + 1] === quote) {
+                value += quote;
+                i += 2;
+                continue;
+            }
+            return {
+                value,
+                next: i + 1,
+            };
+        }
+        value += ch;
+        i += 1;
+    }
+    throw new Error(`Unclosed quote at position ${start + 1}`);
+}
+function normalizeSearchField(value) {
+    const normalized = value.trim().toLowerCase();
+    if (SEARCH_FIELDS.has(normalized)) {
+        return normalized;
+    }
+    return null;
+}
+function normalizeComparisonOperator(raw, position) {
+    if (raw === '=') {
+        return '=';
+    }
+    if (raw === '!=' || raw === '<>') {
+        return '!=';
+    }
+    if (raw === '>') {
+        return '>';
+    }
+    if (raw === '>=') {
+        return '>=';
+    }
+    if (raw === '<') {
+        return '<';
+    }
+    if (raw === '<=') {
+        return '<=';
+    }
+    throw new Error(`Unsupported operator '${raw}' at position ${position + 1}`);
+}
+function normalizeLookupKey(value) {
+    return value.trim().toLowerCase();
+}
+async function buildZettelBoxIdLookup(ast, resolveZettelBoxNames) {
+    const rawValues = collectZettelBoxValues(ast)
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+    if (rawValues.length === 0) {
+        return new Map();
+    }
+    const uniqueNames = [];
+    const seen = new Set();
+    for (const raw of rawValues) {
+        const key = normalizeLookupKey(raw);
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        uniqueNames.push(raw);
+    }
+    const ids = await resolveZettelBoxNames(uniqueNames);
+    if (ids.length !== uniqueNames.length) {
+        throw new DinoxError('Failed to resolve zettel box names in --sql expression');
+    }
+    const lookup = new Map();
+    for (let i = 0; i < uniqueNames.length; i += 1) {
+        lookup.set(normalizeLookupKey(uniqueNames[i]), ids[i]);
+    }
+    return lookup;
+}
+function collectZettelBoxValues(node) {
+    if (node.kind === 'comparison') {
+        if (node.field === 'zettel_boxes') {
+            return [node.value];
+        }
+        return [];
+    }
+    if (node.kind === 'in') {
+        if (node.field === 'zettel_boxes') {
+            return node.values;
+        }
+        return [];
+    }
+    if (node.kind === 'not') {
+        return collectZettelBoxValues(node.child);
+    }
+    return [...collectZettelBoxValues(node.left), ...collectZettelBoxValues(node.right)];
+}
+function compileNode(node, noteAlias, params, zettelBoxIdByName) {
+    if (node.kind === 'comparison') {
+        return compileComparison(node, noteAlias, params, zettelBoxIdByName);
+    }
+    if (node.kind === 'in') {
+        return compileInCondition(node, noteAlias, params, zettelBoxIdByName);
+    }
+    if (node.kind === 'not') {
+        return `NOT (${compileNode(node.child, noteAlias, params, zettelBoxIdByName)})`;
+    }
+    if (node.kind === 'and') {
+        return `(${compileNode(node.left, noteAlias, params, zettelBoxIdByName)}) AND (${compileNode(node.right, noteAlias, params, zettelBoxIdByName)})`;
+    }
+    return `(${compileNode(node.left, noteAlias, params, zettelBoxIdByName)}) OR (${compileNode(node.right, noteAlias, params, zettelBoxIdByName)})`;
+}
+function compileComparison(node, noteAlias, params, zettelBoxIdByName) {
+    if (node.field === 'tags') {
+        if (node.operator !== '=' && node.operator !== '!=') {
+            throw new Error(`Operator '${node.operator}' is not supported for field 'tags'`);
+        }
+        const value = normalizeLookupKey(node.value);
+        if (!value) {
+            throw new Error('tags condition value cannot be empty');
+        }
+        params.push(value);
+        const existsSql = `
+      EXISTS (
+        SELECT 1
+        FROM json_each(
+          CASE
+            WHEN json_valid(COALESCE(${noteAlias}.tags, '')) THEN ${noteAlias}.tags
+            ELSE '[]'
+          END
+        ) tag_item
+        WHERE LOWER(TRIM(CAST(tag_item.value AS TEXT))) = ?
+      )
+    `;
+        return node.operator === '!=' ? `NOT (${existsSql})` : existsSql;
+    }
+    if (node.field === 'zettel_boxes') {
+        if (node.operator !== '=' && node.operator !== '!=') {
+            throw new Error(`Operator '${node.operator}' is not supported for field 'zettel_boxes'`);
+        }
+        const resolvedId = zettelBoxIdByName.get(normalizeLookupKey(node.value));
+        if (!resolvedId) {
+            throw new DinoxError(`Unknown zettel box name in --sql expression: ${node.value}`);
+        }
+        params.push(resolvedId);
+        const existsSql = `
+      EXISTS (
+        SELECT 1
+        FROM json_each(
+          CASE
+            WHEN json_valid(COALESCE(${noteAlias}.zettel_boxes, '')) THEN ${noteAlias}.zettel_boxes
+            ELSE '[]'
+          END
+        ) box_item
+        WHERE TRIM(CAST(box_item.value AS TEXT)) = ?
+      )
+    `;
+        return node.operator === '!=' ? `NOT (${existsSql})` : existsSql;
+    }
+    const column = `${noteAlias}.${SCALAR_FIELD_COLUMNS[node.field]}`;
+    params.push(node.value);
+    if (node.operator === 'LIKE' || node.operator === 'NOT LIKE') {
+        return `(${column} IS NOT NULL AND ${column} ${node.operator} ?)`;
+    }
+    return `(${column} ${node.operator} ?)`;
+}
+function compileInCondition(node, noteAlias, params, zettelBoxIdByName) {
+    if (node.values.length === 0) {
+        throw new Error('IN list cannot be empty');
+    }
+    if (node.field === 'tags') {
+        const normalized = uniqueNonEmptyValues(node.values.map((value) => normalizeLookupKey(value)));
+        if (normalized.length === 0) {
+            throw new Error('tags IN list cannot be empty');
+        }
+        const placeholders = normalized.map(() => '?').join(', ');
+        params.push(...normalized);
+        const existsSql = `
+      EXISTS (
+        SELECT 1
+        FROM json_each(
+          CASE
+            WHEN json_valid(COALESCE(${noteAlias}.tags, '')) THEN ${noteAlias}.tags
+            ELSE '[]'
+          END
+        ) tag_item
+        WHERE LOWER(TRIM(CAST(tag_item.value AS TEXT))) IN (${placeholders})
+      )
+    `;
+        return node.not ? `NOT (${existsSql})` : existsSql;
+    }
+    if (node.field === 'zettel_boxes') {
+        const ids = uniqueNonEmptyValues(node.values
+            .map((value) => zettelBoxIdByName.get(normalizeLookupKey(value)) ?? '')
+            .filter((value) => value.length > 0));
+        if (ids.length === 0) {
+            throw new Error('zettel_boxes IN list cannot be empty');
+        }
+        const placeholders = ids.map(() => '?').join(', ');
+        params.push(...ids);
+        const existsSql = `
+      EXISTS (
+        SELECT 1
+        FROM json_each(
+          CASE
+            WHEN json_valid(COALESCE(${noteAlias}.zettel_boxes, '')) THEN ${noteAlias}.zettel_boxes
+            ELSE '[]'
+          END
+        ) box_item
+        WHERE TRIM(CAST(box_item.value AS TEXT)) IN (${placeholders})
+      )
+    `;
+        return node.not ? `NOT (${existsSql})` : existsSql;
+    }
+    const values = uniqueNonEmptyValues(node.values.map((value) => value.trim()));
+    if (values.length === 0) {
+        throw new Error('IN list cannot be empty');
+    }
+    const column = `${noteAlias}.${SCALAR_FIELD_COLUMNS[node.field]}`;
+    const placeholders = values.map(() => '?').join(', ');
+    params.push(...values);
+    if (node.not) {
+        return `(${column} NOT IN (${placeholders}))`;
+    }
+    return `(${column} IN (${placeholders}))`;
+}
+function uniqueNonEmptyValues(values) {
+    const result = [];
+    const seen = new Set();
+    for (const value of values) {
+        if (!value || seen.has(value)) {
+            continue;
+        }
+        seen.add(value);
+        result.push(value);
+    }
+    return result;
+}

package/dist/commands/prompt/index.js

@@ -4,7 +4,8 @@ import { DinoxError } from '../../utils/errors.js';
 import { printYaml } from '../../utils/output.js';
 import { connectPowerSync, waitForIdleDataFlow } from '../../powersync/runtime.js';
 import { syncNoteTokenIndex } from '../../powersync/tokenIndex.js';
-import { listPrompts } from './repo.js';
+import { resolveAuthIdentity } from '../../auth/userInfo.js';
+import { addPrompt, listPrompts } from './repo.js';
 function parseSyncTimeoutMs(value) {
     if (typeof value !== 'string') {
         return undefined;
@@ -45,6 +46,58 @@ export function registerPromptCommands(program) {
         .option('--offline', 'skip connect/sync and only use local cache')
         .option('--sync-timeout <ms>', 'override sync/connect timeout (milliseconds)')
         .action(runPromptListCommand);
+    prompt
+        .command('add')
+        .description('Create a new prompt in c_cmd')
+        .option('--name <string>', 'prompt name')
+        .option('--cmd <string>', 'prompt command/prompt text')
+        .option('--json', 'output machine-readable YAML')
+        .option('--offline', 'skip connect/sync and only use local cache')
+        .option('--sync-timeout <ms>', 'override sync/connect timeout (milliseconds)')
+        .action(async (options, command) => {
+        const globals = command.optsWithGlobals?.() ?? {};
+        const offline = Boolean(options.offline ?? globals.offline);
+        const jsonOutput = Boolean(options.json ?? globals.json);
+        const name = typeof options.name === 'string' ? options.name.trim() : '';
+        const cmd = typeof options.cmd === 'string' ? options.cmd.trim() : '';
+        if (!name) {
+            throw new DinoxError('Prompt name is required. Use `dino prompt add --name <name> --cmd <cmd>`.');
+        }
+        if (!cmd) {
+            throw new DinoxError('Prompt cmd is required. Use `dino prompt add --name <name> --cmd <cmd>`.');
+        }
+        const rawConfig = await loadConfig();
+        const config = resolveConfig(rawConfig);
+        const timeoutMs = parseSyncTimeoutMs(options.syncTimeout ?? globals.syncTimeout) ?? config.sync.timeoutMs;
+        const identity = await resolveAuthIdentity(rawConfig, config);
+        const { db, stale } = await connectPowerSync({ config, offline, timeoutMs });
+        try {
+            await syncBeforePromptCommand(db, offline, timeoutMs);
+            const result = await addPrompt(db, {
+                name,
+                cmd,
+                userId: identity.userId,
+            });
+            if (!offline && !config.powersync.uploadBaseUrl) {
+                console.log('warning: upload disabled (powersync.uploadBaseUrl is unset); changes are local-only for now');
+            }
+            if (!offline) {
+                await waitForIdleDataFlow(db, Math.min(timeoutMs, 5_000));
+            }
+            const payload = { ok: true, stale: offline ? true : stale, ...result };
+            if (jsonOutput) {
+                printYaml(payload);
+                return;
+            }
+            console.log(result.id);
+            if (stale && !offline) {
+                console.log('warning: sync timed out; results may be stale');
+            }
+        }
+        finally {
+            await db.close().catch(() => undefined);
+        }
+    });
     prompt.action((_options, command) => {
         command.outputHelp();
     });

package/dist/commands/prompt/repo.d.ts

@@ -3,4 +3,16 @@ export type PromptListItem = {
     name: string;
     cmd: string;
 };
+export type AddPromptInput = {
+    name: string;
+    cmd: string;
+    userId: string;
+};
+export type AddPromptResult = {
+    id: string;
+    name: string;
+    cmd: string;
+    restored: boolean;
+};
 export declare function listPrompts(db: AbstractPowerSyncDatabase): Promise<PromptListItem[]>;
+export declare function addPrompt(db: AbstractPowerSyncDatabase, input: AddPromptInput): Promise<AddPromptResult>;