@ganju/utils 0.0.16 → 0.0.17

package/src/dataCsv.ts

@@ -0,0 +1,99 @@
+/**
+ * Reading a CSV file into rows of text, with no parser package behind it:
+ * the CLI's import and the owner's data-admin tool read files the same way.
+ *
+ * RFC 4180 plus the two things spreadsheets actually write: a byte-order mark
+ * in front, and `;` between fields where the decimal mark is a comma (Excel in
+ * Spanish). The separator is read from the header line, so the same file
+ * exported from either locale imports the same way.
+ *
+ * Every cell comes back as text. Deciding what "28.000" means is the shared
+ * import code's job, so the CLI and the dashboard decide it the same way.
+ */
+
+export interface ParsedCsv {
+  headers: string[];
+  rows: string[][];
+  // The file line each row starts on, counting the header as line 1, since a
+  // quoted cell can span lines and blank lines are skipped.
+  lines: number[];
+}
+
+const SEPARATORS = [',', ';', '\t'] as const;
+
+// The separator that appears most in the first line, outside quotes.
+export const detectSeparator = (text: string): string => {
+  const counts = new Map<string, number>(SEPARATORS.map(s => [s, 0]));
+  let quoted = false;
+  for (const char of text) {
+    if (char === '"') quoted = !quoted;
+    else if (!quoted && (char === '\n' || char === '\r')) break;
+    else if (!quoted && counts.has(char))
+      counts.set(char, counts.get(char)! + 1);
+  }
+  let best = ',';
+  for (const [separator, count] of counts) {
+    if (count > counts.get(best)!) best = separator;
+  }
+  return best;
+};
+
+export const parseCsv = (input: string, separator?: string): ParsedCsv => {
+  const text = input.charCodeAt(0) === 0xfeff ? input.slice(1) : input;
+  const sep = separator ?? detectSeparator(text);
+  const records: { cells: string[]; line: number }[] = [];
+  let cells: string[] = [];
+  let cell = '';
+  let quoted = false;
+  let line = 1;
+  let startLine = 1;
+
+  const endCell = () => {
+    cells.push(cell);
+    cell = '';
+  };
+  const endRecord = () => {
+    endCell();
+    // A blank line, or one of nothing but separators, is not a row.
+    if (cells.some(c => c.trim() !== '')) {
+      records.push({ cells, line: startLine });
+    }
+    cells = [];
+  };
+
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (quoted) {
+      if (char === '"') {
+        if (text[i + 1] === '"') {
+          cell += '"';
+          i++;
+        } else quoted = false;
+      } else {
+        if (char === '\n') line++;
+        cell += char;
+      }
+      continue;
+    }
+    if (char === '"' && cell === '') {
+      quoted = true;
+    } else if (char === sep) {
+      endCell();
+    } else if (char === '\n' || char === '\r') {
+      if (char === '\r' && text[i + 1] === '\n') i++;
+      endRecord();
+      line++;
+      startLine = line;
+    } else {
+      cell += char;
+    }
+  }
+  if (cell !== '' || cells.length) endRecord();
+
+  const [header, ...body] = records;
+  return {
+    headers: (header?.cells ?? []).map(h => h.trim()),
+    rows: body.map(r => r.cells),
+    lines: body.map(r => r.line)
+  };
+};

package/src/dataEngine.ts

@@ -172,6 +172,22 @@ export const INTERNAL_MIGRATIONS: readonly (readonly string[])[] = [
       WHERE c.table_id = _ganju_tables.id AND c.type = 'text'
       ORDER BY c.position, c.id LIMIT 1
     ) WHERE display_column_id IS NULL AND created_at < '2026-10-24T00:00:00Z'`
+  ],
+  // Named queries: the owner's SELECTs, run by name. `tables` and `plan` are
+  // what the check found when each was saved.
+  [
+    `CREATE TABLE IF NOT EXISTS _ganju_queries (
+      name TEXT PRIMARY KEY,
+      description TEXT,
+      sql TEXT NOT NULL,
+      params TEXT NOT NULL DEFAULT '[]',
+      assistant INTEGER NOT NULL DEFAULT 0,
+      tables TEXT NOT NULL DEFAULT '[]',
+      plan TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL DEFAULT (${DATA_NOW_SQL}),
+      updated_at TEXT NOT NULL DEFAULT (${DATA_NOW_SQL}),
+      updated_by TEXT
+    ) WITHOUT ROWID`
   ]
 ];
 
@@ -271,7 +287,8 @@ export const loadSchema = (runner: SqlRunner): DataSchema => {
             position: Number(c.position)
           };
         })
-    }))
+    })),
+    timeZone: getMeta(runner, 'time_zone')
   };
 };
 
@@ -1356,7 +1373,8 @@ const insertValues = (
 // A bot may only point a relation at a row it could read: none in a table
 // hidden from it, and only its own customer's in a scoped one. Otherwise it
 // could link an order to another customer and read their name back as the
-// label.
+// label. A caller held to some tables (a function's `data.tables`) may not
+// point outside them either.
 const assertRelationsVisible = (
   runner: SqlRunner,
   schema: DataSchema,
@@ -1364,7 +1382,7 @@ const assertRelationsVisible = (
   table: DataTable,
   values: Map<string, SqlValue>
 ) => {
-  if (!caller.restricted) return;
+  if (!caller.restricted && !caller.tables) return;
   for (const [name, value] of values) {
     if (value === null) continue;
     const column = table.columns.find(c => c.name === name);
@@ -1373,7 +1391,9 @@ const assertRelationsVisible = (
     if (!target) continue;
     if (!canRead(caller, target)) {
       throw new DataError(
-        `${table.name}.${name} points at a table the assistant can't use.`,
+        caller.restricted
+          ? `${table.name}.${name} points at a table the assistant can't use.`
+          : `${table.name}.${name} points at ${target.name}, which isn't one of this caller's tables.`,
         'forbidden'
       );
     }

package/src/dataImport.ts

@@ -552,3 +552,6 @@ export const csvLine = (cells: ImportCell[]) =>
       return /[",\n\r]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value;
     })
     .join(',');
+
+export { detectSeparator, parseCsv } from './dataCsv';
+export type { ParsedCsv } from './dataCsv';