@fadhilp/stateql 0.12.0 → 0.13.1

package/dist/src/sql.js

@@ -26,6 +26,14 @@ export function analyzeSql(sql, driver) {
             if (postgresCommand)
                 return postgresCommand;
         }
+        else if (driver === "sqlite") {
+            const sqliteCommand = analyzeSqliteCommand(trimmed);
+            if (sqliteCommand)
+                return sqliteCommand;
+        }
+        else if (driver === "mysql") {
+            return analyzeMySqlSql(trimmed);
+        }
         return analyzeParsedSql(trimmed, driver);
     }
     catch (error) {
@@ -35,7 +43,7 @@ export function analyzeSql(sql, driver) {
         throw new StateQLError("INVALID_SQL", message);
     }
 }
-function analyzeParsedSql(sql, driver) {
+function parseSqlStatement(sql, driver) {
     const database = driver === "postgres"
         ? "Postgresql"
         : driver === "mysql"
@@ -49,14 +57,6 @@ function analyzeParsedSql(sql, driver) {
     const ast = (Array.isArray(parsed) ? parsed[0] : parsed);
     if (!ast)
         throw new StateQLError("INVALID_SQL", "SQL is empty.");
-    const rawType = String(ast.type);
-    if (!SUPPORTED_STATEMENTS.has(rawType)) {
-        throw new StateQLError("INVALID_SQL", `Unsupported SQL statement type "${rawType}".`);
-    }
-    const statementType = rawType;
-    if (statementType === "select" && selectContainsWrite(ast)) {
-        throw new StateQLError("INVALID_SQL", "Read statements cannot contain writes or SELECT INTO.");
-    }
     const normalized = parserSql === sql
         ? parser
             .sqlify(ast, { database })
@@ -66,6 +66,24 @@ function analyzeParsedSql(sql, driver) {
         // Keep the exact ordering modifiers in cache and idempotency fingerprints.
         // The parser copy is analysis-only; adapters execute the original SQL.
         : sql.replace(/;\s*$/, "");
+    return { ast, normalized };
+}
+function analyzeParsedSql(sql, driver) {
+    return analyzeParsedStatement(parseSqlStatement(sql, driver), driver);
+}
+function analyzeParsedStatement({ ast, normalized }, driver) {
+    const rawType = String(ast.type);
+    if (!SUPPORTED_STATEMENTS.has(rawType)) {
+        throw new StateQLError("INVALID_SQL", `Unsupported SQL statement type "${rawType}".`);
+    }
+    const rawStatementType = rawType;
+    const insert = rawStatementType === "insert"
+        ? analyzeInsert(ast, driver)
+        : undefined;
+    const statementType = insert?.statementType ?? rawStatementType;
+    if (statementType === "select" && containsUnexpectedWrite(ast)) {
+        throw new StateQLError("INVALID_SQL", "Read statements cannot contain writes or SELECT INTO.");
+    }
     const details = ast;
     const read = statementType === "select";
     const mutation = statementType === "update" ||
@@ -83,7 +101,8 @@ function analyzeParsedSql(sql, driver) {
         normalized,
         statementType,
         read,
-        unboundedMutation: statementType === "truncate" || (mutation && !details.where),
+        unboundedMutation: insert?.unboundedMutation ??
+            (statementType === "truncate" || (mutation && !details.where)),
         destructive,
         ordered: read && Boolean(details.orderby),
         wrapForLimit: read,
@@ -91,11 +110,76 @@ function analyzeParsedSql(sql, driver) {
         requiresAutocommit: false,
     };
 }
+function analyzeInsert(ast, driver) {
+    const details = ast;
+    const conflict = record(details.conflict);
+    const duplicate = record(details.on_duplicate_update);
+    const allowedWrites = new Set([ast]);
+    let upsert = false;
+    let updatesOnConflict = false;
+    if (conflict) {
+        if (driver !== "postgres")
+            invalidUpsertSyntax(driver);
+        const action = record(conflict.action);
+        const expression = record(action?.expr);
+        if (conflict.type !== "conflict" ||
+            conflict.keyword !== "on" ||
+            action?.keyword !== "do" ||
+            !expression) {
+            invalidUpsertSyntax(driver);
+        }
+        upsert = true;
+        if (expression.type === "update") {
+            if (!Array.isArray(expression.set) || expression.set.length === 0) {
+                invalidUpsertSyntax(driver);
+            }
+            allowedWrites.add(expression);
+            updatesOnConflict = true;
+        }
+        else if (expression.type !== "origin" ||
+            String(expression.value).toLowerCase() !== "nothing") {
+            invalidUpsertSyntax(driver);
+        }
+    }
+    if (duplicate) {
+        if (driver !== "mysql" ||
+            duplicate.keyword !== "on duplicate key update" ||
+            !Array.isArray(duplicate.set) ||
+            duplicate.set.length === 0) {
+            invalidUpsertSyntax(driver);
+        }
+        upsert = true;
+        updatesOnConflict = true;
+    }
+    if (containsUnexpectedWrite(ast, allowedWrites)) {
+        throw new StateQLError("INVALID_SQL", "INSERT statements cannot contain additional write statements or SELECT INTO.");
+    }
+    const source = record(details.values);
+    const assignmentSource = driver === "mysql" && !source &&
+        Array.isArray(details.set) && details.set.length > 0;
+    if (upsert && !assignmentSource &&
+        (!source || !["select", "values"].includes(String(source.type)))) {
+        invalidUpsertSyntax(driver);
+    }
+    return {
+        statementType: upsert ? "upsert" : "insert",
+        unboundedMutation: updatesOnConflict && source?.type === "select",
+    };
+}
+function invalidUpsertSyntax(driver) {
+    throw new StateQLError("INVALID_SQL", `Unsupported or invalid ${driver} upsert syntax.`);
+}
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
 const EXPLAIN_INNER_STATEMENTS = new Set([
     "select",
     "insert",
     "update",
     "delete",
+    "upsert",
 ]);
 const EXPLAIN_BOOLEAN_OPTIONS = new Set([
     "ANALYZE",
@@ -111,15 +195,26 @@ const EXPLAIN_BOOLEAN_OPTIONS = new Set([
 ]);
 const EXPLAIN_FORMATS = new Set(["TEXT", "XML", "JSON", "YAML"]);
 const EXPLAIN_SERIALIZE = new Set(["NONE", "TEXT", "BINARY"]);
-const BOOLEAN_VALUES = new Set(["TRUE", "FALSE", "ON", "OFF"]);
+const BOOLEAN_VALUES = new Set(["TRUE", "FALSE", "ON", "OFF", "1", "0"]);
+const POSTGRES_SHOW_SETTINGS = new Set([
+    "default_transaction_isolation",
+    "server_version",
+    "server_version_num",
+    "transaction_isolation",
+    "transaction_read_only",
+]);
 function analyzePostgresCommand(sql) {
-    const scanner = new PostgresPrefixScanner(sql);
+    const scanner = new SqlPrefixScanner(sql, "postgres");
     const command = scanner.readWord();
     if (!command)
         return undefined;
     switch (command.value) {
         case "EXPLAIN":
             return analyzePostgresExplain(sql, scanner);
+        case "SHOW":
+            return analyzePostgresShow(sql);
+        case "VALUES":
+            return analyzePostgresValues(sql);
         case "VACUUM":
         case "ANALYZE":
         case "REINDEX":
@@ -129,6 +224,179 @@ function analyzePostgresCommand(sql) {
             return undefined;
     }
 }
+function analyzePostgresShow(sql) {
+    const parsed = parseSqlStatement(sql, "postgres");
+    const details = parsed.ast;
+    const variable = details.var;
+    if (details.type !== "show" ||
+        details.keyword !== "var" ||
+        variable?.type !== "var" ||
+        typeof variable.name !== "string" ||
+        (Array.isArray(variable.members) && variable.members.length > 0) ||
+        !POSTGRES_SHOW_SETTINGS.has(variable.name.toLowerCase())) {
+        invalidPostgresSyntax("SHOW");
+    }
+    return readDiagnostic(parsed, "show");
+}
+function analyzePostgresValues(sql) {
+    const statement = postgresStatementBody(sql);
+    const wrapped = analyzeParsedSql(`SELECT * FROM (${statement}) AS _stateql_values`, "postgres");
+    return {
+        ...wrapped,
+        normalized: statement,
+        statementType: "values",
+        ordered: false,
+        cacheable: false,
+        limitSql: statement,
+    };
+}
+const MYSQL_SHOW_KEYWORDS = new Set(["columns", "index", "indexes", "tables"]);
+function analyzeMySqlSql(sql) {
+    const scanner = new MySqlPrefixScanner(sql);
+    scanner.validateComments();
+    const command = scanner.readWord();
+    if (command?.value === "ANALYZE" ||
+        command?.value === "OPTIMIZE" ||
+        command?.value === "CHECK") {
+        return analyzeMySqlMaintenance(sql, scanner, command.value);
+    }
+    const parsed = parseSqlStatement(sql, "mysql");
+    const details = parsed.ast;
+    if (details.type === "explain") {
+        const inner = details.expr;
+        if (!inner || String(inner.type) !== "select" || containsUnexpectedWrite(inner)) {
+            throw new StateQLError("INVALID_SQL", "MySQL EXPLAIN accepts read-only SELECT statements only.");
+        }
+        return readDiagnostic(parsed, "explain");
+    }
+    if (details.type === "show") {
+        const keyword = typeof details.keyword === "string"
+            ? details.keyword.toLowerCase()
+            : "";
+        const allowedKeys = keyword === "tables"
+            ? new Set(["type", "keyword"])
+            : new Set(["type", "keyword", "from"]);
+        const hasUnexpectedShape = Object.entries(details).some(([key, value]) => value !== undefined && value !== null && !allowedKeys.has(key));
+        const from = details.from;
+        if (!MYSQL_SHOW_KEYWORDS.has(keyword) ||
+            hasUnexpectedShape ||
+            (keyword !== "tables" && (!Array.isArray(from) || from.length !== 1))) {
+            throw new StateQLError("INVALID_SQL", `Unsupported MySQL SHOW form "${keyword || "unknown"}".`);
+        }
+        return readDiagnostic(parsed, "show");
+    }
+    return analyzeParsedStatement(parsed, "mysql");
+}
+function analyzeMySqlMaintenance(sql, scanner, command) {
+    if (scanner.readWord()?.value !== "TABLE")
+        invalidMySqlSyntax(command);
+    if (!scanner.readQualifiedIdentifier())
+        invalidMySqlSyntax(command);
+    if (scanner.consume(";")) {
+        if (scanner.triviaEnd() !== sql.length)
+            invalidMySqlSyntax(command);
+    }
+    else if (scanner.triviaEnd() !== sql.length) {
+        invalidMySqlSyntax(command);
+    }
+    const read = command === "CHECK";
+    return {
+        ast: { type: command.toLowerCase() },
+        normalized: sql.replace(/;\s*$/, ""),
+        statementType: command.toLowerCase(),
+        read,
+        unboundedMutation: false,
+        destructive: !read,
+        ordered: false,
+        wrapForLimit: false,
+        cacheable: false,
+        requiresAutocommit: true,
+    };
+}
+function invalidMySqlSyntax(command) {
+    throw new StateQLError("INVALID_SQL", `Unsupported or invalid MySQL ${command} TABLE syntax.`);
+}
+function analyzeSqliteCommand(sql) {
+    const scanner = new SqlPrefixScanner(sql, "sqlite");
+    const command = scanner.readWord();
+    switch (command?.value) {
+        case "EXPLAIN":
+            return analyzeSqliteExplain(sql, scanner);
+        case "VACUUM":
+        case "ANALYZE":
+        case "REINDEX":
+            return analyzeSqliteMaintenance(sql, scanner, command.value);
+        default:
+            return undefined;
+    }
+}
+function analyzeSqliteExplain(sql, scanner) {
+    if (scanner.readWord()?.value !== "QUERY" || scanner.readWord()?.value !== "PLAN") {
+        throw new StateQLError("INVALID_SQL", "Only SQLite EXPLAIN QUERY PLAN is supported.");
+    }
+    const innerSql = sql.slice(scanner.triviaEnd());
+    if (!innerSql) {
+        throw new StateQLError("INVALID_SQL", "Invalid SQLite EXPLAIN QUERY PLAN syntax.");
+    }
+    const inner = analyzeParsedSql(innerSql, "sqlite");
+    if (inner.statementType !== "select") {
+        throw new StateQLError("INVALID_SQL", "SQLite EXPLAIN QUERY PLAN accepts read-only SELECT statements only.");
+    }
+    return readDiagnostic({ ast: inner.ast, normalized: sql.replace(/;\s*$/, "") }, "explain");
+}
+function analyzeSqliteMaintenance(sql, scanner, command) {
+    if (command !== "VACUUM" && scanner.peek() !== ";" && scanner.peek() !== undefined) {
+        if (!readSqliteIdentifier(sql, scanner))
+            invalidSqliteSyntax(command);
+    }
+    if (scanner.consume(";")) {
+        if (scanner.triviaEnd() !== sql.length)
+            invalidSqliteSyntax(command);
+    }
+    else if (scanner.triviaEnd() !== sql.length) {
+        invalidSqliteSyntax(command);
+    }
+    return {
+        ast: { type: command.toLowerCase() },
+        normalized: sql.replace(/;\s*$/, ""),
+        statementType: command.toLowerCase(),
+        read: false,
+        unboundedMutation: false,
+        destructive: true,
+        ordered: false,
+        wrapForLimit: false,
+        cacheable: false,
+        requiresAutocommit: true,
+    };
+}
+function readSqliteIdentifier(sql, scanner) {
+    scanner.triviaEnd();
+    if (sql[scanner.position] === '"') {
+        const end = postgresQuotedIdentifierEnd(sql, scanner.position);
+        if (end === undefined)
+            return false;
+        scanner.position = end;
+        return true;
+    }
+    return Boolean(scanner.readWord(false));
+}
+function invalidSqliteSyntax(command) {
+    throw new StateQLError("INVALID_SQL", `Unsupported or invalid SQLite ${command} syntax.`);
+}
+function readDiagnostic({ ast, normalized }, statementType) {
+    return {
+        ast,
+        normalized,
+        statementType,
+        read: true,
+        unboundedMutation: false,
+        destructive: false,
+        ordered: false,
+        wrapForLimit: false,
+        cacheable: false,
+        requiresAutocommit: false,
+    };
+}
 function analyzePostgresExplain(sql, scanner) {
     let analyze = false;
     const seen = new Set();
@@ -217,12 +485,15 @@ const VACUUM_OPTIONS = new Map([
     ["PARALLEL", "number"],
     ["SKIP_DATABASE_STATS", "boolean"],
     ["ONLY_DATABASE_STATS", "boolean"],
+    ["BUFFER_USAGE_LIMIT", "size"],
 ]);
 const ANALYZE_OPTIONS = new Map([
     ["VERBOSE", "boolean"],
     ["SKIP_LOCKED", "boolean"],
+    ["BUFFER_USAGE_LIMIT", "size"],
 ]);
 const REINDEX_OPTIONS = new Map([
+    ["CONCURRENTLY", "boolean"],
     ["VERBOSE", "boolean"],
     ["TABLESPACE", "identifier"],
 ]);
@@ -235,14 +506,14 @@ function analyzePostgresMaintenance(sql, command) {
     switch (command) {
         case "VACUUM":
             parser.options(VACUUM_OPTIONS, ["FULL", "FREEZE", "VERBOSE", "ANALYZE"]);
-            parser.optionalTargets();
+            parser.optionalTargets(true);
             break;
         case "ANALYZE":
             parser.options(ANALYZE_OPTIONS, ["VERBOSE"]);
-            parser.optionalTargets();
+            parser.optionalTargets(true);
             break;
         case "REINDEX": {
-            parser.options(REINDEX_OPTIONS);
+            const options = parser.options(REINDEX_OPTIONS);
             const target = parser.expectOneOf([
                 "INDEX",
                 "TABLE",
@@ -250,12 +521,17 @@ function analyzePostgresMaintenance(sql, command) {
                 "DATABASE",
                 "SYSTEM",
             ]);
-            if (target !== "SYSTEM")
-                parser.consumeWord("CONCURRENTLY");
+            const postTargetConcurrent = parser.consumeWord("CONCURRENTLY");
+            if (postTargetConcurrent && options.has("CONCURRENTLY")) {
+                invalidPostgresSyntax(command);
+            }
             if (target === "INDEX" || target === "TABLE") {
                 parser.qualifiedIdentifier();
             }
-            else {
+            else if (target === "SCHEMA") {
+                parser.identifier();
+            }
+            else if (!parser.done()) {
                 parser.identifier();
             }
             break;
@@ -284,7 +560,7 @@ function analyzePostgresMaintenance(sql, command) {
     };
 }
 function tokenizePostgresMaintenance(sql) {
-    const scanner = new PostgresPrefixScanner(sql);
+    const scanner = new SqlPrefixScanner(sql, "postgres");
     const tokens = [];
     while (scanner.triviaEnd() < sql.length) {
         const character = sql[scanner.position];
@@ -308,6 +584,15 @@ function tokenizePostgresMaintenance(sql) {
             scanner.position = end;
             continue;
         }
+        if (character === "'") {
+            const end = postgresQuotedStringScanEnd(sql, scanner.position);
+            if (end <= scanner.position + 1 || sql[end - 1] !== "'") {
+                invalidPostgresSyntax("maintenance");
+            }
+            tokens.push({ kind: "string", value: sql.slice(scanner.position, end) });
+            scanner.position = end;
+            continue;
+        }
         if (/[0-9]/u.test(character)) {
             const start = scanner.position;
             scanner.position += 1;
@@ -316,7 +601,7 @@ function tokenizePostgresMaintenance(sql) {
             tokens.push({ kind: "number", value: sql.slice(start, scanner.position) });
             continue;
         }
-        if (["(", ")", ",", "."].includes(character)) {
+        if (["(", ")", ",", ".", "*"].includes(character)) {
             tokens.push({ kind: "punctuation", value: character });
             scanner.position += 1;
             continue;
@@ -396,11 +681,15 @@ class UtilityParser {
             this.index += 1;
         }
     }
-    optionalTargets() {
+    optionalTargets(allowOnlyAndStar = false) {
         if (this.done())
             return;
         while (true) {
+            if (allowOnlyAndStar)
+                this.consumeWord("ONLY");
             this.qualifiedIdentifier();
+            if (allowOnlyAndStar)
+                this.consumePunctuation("*");
             if (this.consumePunctuation("(")) {
                 this.identifier();
                 while (this.consumePunctuation(","))
@@ -429,7 +718,8 @@ class UtilityParser {
         if (!token)
             invalidPostgresSyntax(this.command);
         if (kind === "boolean") {
-            if (token.kind !== "word" || !BOOLEAN_VALUES.has(token.value)) {
+            if ((token.kind !== "word" && token.kind !== "number") ||
+                !BOOLEAN_VALUES.has(token.value)) {
                 invalidPostgresSyntax(this.command);
             }
         }
@@ -442,6 +732,10 @@ class UtilityParser {
                 invalidPostgresSyntax(this.command);
             }
         }
+        else if (kind === "size") {
+            if (!validMaintenanceSize(token))
+                invalidPostgresSyntax(this.command);
+        }
         else if (token.kind !== "word" || !kind.has(token.value)) {
             invalidPostgresSyntax(this.command);
         }
@@ -455,12 +749,151 @@ class UtilityParser {
         return true;
     }
 }
-class PostgresPrefixScanner {
+function validMaintenanceSize(token) {
+    let amountText;
+    let unit;
+    if (token.kind === "number") {
+        amountText = token.value;
+        unit = "KB";
+    }
+    else if (token.kind === "string") {
+        const match = token.value.match(/^'([0-9]+)(?:\s*(B|KB|MB|GB|TB))?'$/iu);
+        if (!match)
+            return false;
+        amountText = match[1];
+        unit = (match[2]?.toUpperCase() ?? "KB");
+    }
+    else {
+        return false;
+    }
+    const factors = {
+        B: 1n,
+        KB: 1024n,
+        MB: 1024n ** 2n,
+        GB: 1024n ** 3n,
+        TB: 1024n ** 4n,
+    };
+    const bytes = BigInt(amountText) * factors[unit];
+    return bytes === 0n ||
+        (bytes >= 128n * factors.KB && bytes <= 16n * factors.GB);
+}
+class MySqlPrefixScanner {
     sql;
     position = 0;
     constructor(sql) {
         this.sql = sql;
     }
+    validateComments() {
+        if (!this.sql.includes("/*!"))
+            return;
+        // sql_mode is unknown: cover string escapes, ANSI_QUOTES, and
+        // NO_BACKSLASH_ESCAPES. Reject mode-dependent executable comments.
+        for (const [singleEscapes, doubleEscapes] of [
+            [true, true], [true, false], [false, false],
+        ]) {
+            this.position = 0;
+            while (this.triviaEnd() < this.sql.length) {
+                const quote = this.sql[this.position];
+                if (quote === "'" || quote === '"' || quote === "`") {
+                    const escaped = quote === "'" ? singleEscapes : quote === '"' && doubleEscapes;
+                    if (!this.readQuoted(quote, escaped)) {
+                        throw new StateQLError("INVALID_SQL", "Unterminated quoted SQL value.");
+                    }
+                }
+                else {
+                    this.position += 1;
+                }
+            }
+        }
+        this.position = 0;
+    }
+    triviaEnd() {
+        while (this.position < this.sql.length) {
+            if (/\s/u.test(this.sql[this.position])) {
+                this.position += 1;
+            }
+            else if (this.sql[this.position] === "#") {
+                this.position = lineCommentEnd(this.sql, this.position + 1);
+            }
+            else if (this.sql.startsWith("--", this.position) &&
+                (this.sql[this.position + 2] === undefined || /[\x00-\x20]/u.test(this.sql[this.position + 2]))) {
+                this.position = lineCommentEnd(this.sql, this.position + 2);
+            }
+            else if (this.sql.startsWith("/*", this.position)) {
+                if (this.sql[this.position + 2] === "!") {
+                    throw new StateQLError("INVALID_SQL", "MySQL executable comments are not supported.");
+                }
+                const end = nonNestedBlockCommentEnd(this.sql, this.position + 2);
+                if (end === undefined) {
+                    throw new StateQLError("INVALID_SQL", "Unterminated SQL comment.");
+                }
+                this.position = end;
+            }
+            else {
+                break;
+            }
+        }
+        return this.position;
+    }
+    readWord(skipTrivia = true) {
+        if (skipTrivia)
+            this.triviaEnd();
+        const start = this.position;
+        if (!identifierStart(this.sql[start]))
+            return undefined;
+        this.position += 1;
+        while (identifierPart(this.sql[this.position]))
+            this.position += 1;
+        return { value: this.sql.slice(start, this.position).toUpperCase() };
+    }
+    readQualifiedIdentifier() {
+        if (!this.readIdentifier())
+            return false;
+        if (!this.consume("."))
+            return true;
+        return this.readIdentifier();
+    }
+    consume(value) {
+        this.triviaEnd();
+        if (!this.sql.startsWith(value, this.position))
+            return false;
+        this.position += value.length;
+        return true;
+    }
+    readIdentifier() {
+        this.triviaEnd();
+        if (this.sql[this.position] !== "`")
+            return Boolean(this.readWord(false));
+        return this.readQuoted("`", false);
+    }
+    readQuoted(quote, backslashEscapes) {
+        let index = this.position + 1;
+        while (index < this.sql.length) {
+            if (backslashEscapes && this.sql[index] === "\\") {
+                index += 2;
+            }
+            else if (this.sql[index] !== quote) {
+                index += 1;
+            }
+            else if (this.sql[index + 1] === quote) {
+                index += 2;
+            }
+            else {
+                this.position = index + 1;
+                return true;
+            }
+        }
+        return false;
+    }
+}
+class SqlPrefixScanner {
+    sql;
+    dialect;
+    position = 0;
+    constructor(sql, dialect) {
+        this.sql = sql;
+        this.dialect = dialect;
+    }
     triviaEnd() {
         while (this.position < this.sql.length) {
             if (/\s/u.test(this.sql[this.position])) {
@@ -470,7 +903,9 @@ class PostgresPrefixScanner {
                 this.position = lineCommentEnd(this.sql, this.position + 2);
             }
             else if (this.sql.startsWith("/*", this.position)) {
-                const end = postgresBlockCommentEnd(this.sql, this.position + 2);
+                const end = this.dialect === "postgres"
+                    ? postgresBlockCommentEnd(this.sql, this.position + 2)
+                    : nonNestedBlockCommentEnd(this.sql, this.position + 2);
                 if (end === undefined) {
                     throw new StateQLError("INVALID_SQL", "Unterminated SQL comment.");
                 }
@@ -515,6 +950,61 @@ class PostgresPrefixScanner {
         return true;
     }
 }
+function postgresStatementBody(sql) {
+    let index = 0;
+    let lastTokenStart = 0;
+    let lastTokenEnd = 0;
+    while (index < sql.length) {
+        if (/\s/u.test(sql[index])) {
+            index += 1;
+            continue;
+        }
+        if (sql.startsWith("--", index)) {
+            index = lineCommentEnd(sql, index + 2);
+            continue;
+        }
+        if (sql.startsWith("/*", index)) {
+            const end = postgresBlockCommentEnd(sql, index + 2);
+            if (end === undefined) {
+                throw new StateQLError("INVALID_SQL", "Unterminated SQL comment.");
+            }
+            index = end;
+            continue;
+        }
+        const start = index;
+        const character = sql[index];
+        if (character === "'") {
+            index = postgresQuotedStringScanEnd(sql, index);
+        }
+        else if (character === '"') {
+            const end = postgresQuotedIdentifierEnd(sql, index);
+            if (end === undefined) {
+                throw new StateQLError("INVALID_SQL", "Unterminated quoted SQL identifier.");
+            }
+            index = end;
+        }
+        else if (character === "$") {
+            const delimiter = sql.slice(index).match(/^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)?.[0];
+            if (delimiter) {
+                const end = sql.indexOf(delimiter, index + delimiter.length);
+                if (end < 0) {
+                    throw new StateQLError("INVALID_SQL", "Unterminated dollar-quoted SQL value.");
+                }
+                index = end + delimiter.length;
+            }
+            else {
+                index += 1;
+            }
+        }
+        else {
+            index += 1;
+        }
+        lastTokenStart = start;
+        lastTokenEnd = index;
+    }
+    const end = sql[lastTokenStart] === ";" ? lastTokenStart : lastTokenEnd;
+    return sql.slice(0, end).trim();
+}
 function invalidPostgresSyntax(command) {
     throw new StateQLError("INVALID_SQL", `Unsupported or invalid PostgreSQL ${command} syntax.`);
 }
@@ -551,6 +1041,10 @@ function postgresQuotedStringScanEnd(sql, start) {
     }
     return index;
 }
+function nonNestedBlockCommentEnd(sql, start) {
+    const end = sql.indexOf("*/", start);
+    return end < 0 ? undefined : end + 2;
+}
 function postgresBlockCommentEnd(sql, start) {
     let depth = 1;
     let index = start;
@@ -714,7 +1208,7 @@ function identifierStart(value) {
 function identifierPart(value) {
     return value !== undefined && /[A-Za-z0-9_$\u0080-\uFFFF]/u.test(value);
 }
-function selectContainsWrite(ast) {
+function containsUnexpectedWrite(ast, allowedWrites = new Set()) {
     const visited = new Set();
     const writeTypes = new Set([
         "insert",
@@ -736,7 +1230,7 @@ function selectContainsWrite(ast) {
             return value.some(visit);
         const details = value;
         const type = typeof details.type === "string" ? details.type : undefined;
-        if (type && writeTypes.has(type))
+        if (type && writeTypes.has(type) && !allowedWrites.has(value))
             return true;
         if (type === "select") {
             const into = details.into;