@kaelio/ktx 0.13.0 → 0.13.1

package/dist/connectors/sqlserver/connector.js

@@ -1,4 +1,4 @@
-import { assertReadOnlySql, stripTrailingSqlNoise } from '../../context/connections/read-only-sql.js';
+import { assertReadOnlySql, hoistLeadingCte, stripTrailingSqlNoise } from '../../context/connections/read-only-sql.js';
 import { getDialectForDriver } from '../../context/connections/dialects.js';
 import { tryConstraintQuery } from '../../context/scan/constraint-discovery.js';
 import { scopedTableNames } from '../../context/scan/table-ref.js';
@@ -136,7 +136,8 @@ function limitSqlForSqlServerExecution(sqlText, maxRows) {
     if (!Number.isInteger(maxRows) || maxRows <= 0) {
         throw new Error('maxRows must be a positive integer.');
     }
-    return `SELECT TOP ${maxRows} * FROM (${trimmed}) AS ktx_query_result`;
+    const { withPrefix, body } = hoistLeadingCte(trimmed);
+    return `${withPrefix}SELECT TOP ${maxRows} * FROM (${body}) AS ktx_query_result`;
 }
 export function isKtxSqlServerConnectionConfig(connection) {
     return String(connection?.driver ?? '').toLowerCase() === 'sqlserver';

package/dist/context/connections/read-only-sql.d.ts

@@ -1,3 +1,8 @@
 export declare function assertReadOnlySql(sql: string): string;
+/** @internal */
+export declare function hoistLeadingCte(sql: string): {
+    withPrefix: string;
+    body: string;
+};
 export declare function stripTrailingSqlNoise(sql: string): string;
 export declare function limitSqlForExecution(sql: string, maxRows: number | undefined): string;

package/dist/context/connections/read-only-sql.js

@@ -91,6 +91,143 @@ export function assertReadOnlySql(sql) {
     assertSingleSqlStatement(trimmed);
     return trimmed;
 }
+function isSqlIdentifierPart(char) {
+    return char !== undefined && /[A-Za-z0-9_$]/.test(char);
+}
+function keywordAt(sql, index, keyword) {
+    if (sql.slice(index, index + keyword.length).toLowerCase() !== keyword.toLowerCase()) {
+        return false;
+    }
+    return !isSqlIdentifierPart(sql[index - 1]) && !isSqlIdentifierPart(sql[index + keyword.length]);
+}
+function skipWhitespaceAndComments(sql, index) {
+    let current = index;
+    while (current < sql.length) {
+        while (/\s/.test(sql[current] ?? '')) {
+            current += 1;
+        }
+        if (sql.startsWith('--', current) || sql.startsWith('/*', current)) {
+            current = skipQuotedOrComment(sql, current);
+            continue;
+        }
+        return current;
+    }
+    return current;
+}
+function skipBracketIdentifier(sql, index) {
+    let current = index + 1;
+    while (current < sql.length) {
+        if (sql[current] === ']') {
+            if (sql[current + 1] === ']') {
+                current += 2;
+                continue;
+            }
+            return current + 1;
+        }
+        current += 1;
+    }
+    return -1;
+}
+function skipBacktickIdentifier(sql, index) {
+    let current = index + 1;
+    while (current < sql.length) {
+        if (sql[current] === '`') {
+            if (sql[current + 1] === '`') {
+                current += 2;
+                continue;
+            }
+            return current + 1;
+        }
+        current += 1;
+    }
+    return -1;
+}
+function skipIdentifier(sql, index) {
+    if (sql[index] === '"') {
+        const skipped = skipQuotedOrComment(sql, index);
+        return skipped > index ? skipped : -1;
+    }
+    if (sql[index] === '[') {
+        return skipBracketIdentifier(sql, index);
+    }
+    if (sql[index] === '`') {
+        return skipBacktickIdentifier(sql, index);
+    }
+    let current = index;
+    while (isSqlIdentifierPart(sql[current])) {
+        current += 1;
+    }
+    return current > index ? current : -1;
+}
+function skipBalancedParentheses(sql, index) {
+    if (sql[index] !== '(') {
+        return -1;
+    }
+    let current = index;
+    let depth = 0;
+    while (current < sql.length) {
+        const skipped = skipQuotedOrComment(sql, current);
+        if (skipped > current) {
+            current = skipped;
+            continue;
+        }
+        if (sql[current] === '(') {
+            depth += 1;
+        }
+        else if (sql[current] === ')') {
+            depth -= 1;
+            if (depth === 0) {
+                return current + 1;
+            }
+        }
+        current += 1;
+    }
+    return -1;
+}
+/** @internal */
+export function hoistLeadingCte(sql) {
+    const trimmed = sql.trim();
+    if (!keywordAt(trimmed, 0, 'with')) {
+        return { withPrefix: '', body: sql };
+    }
+    let current = skipWhitespaceAndComments(trimmed, 4);
+    if (keywordAt(trimmed, current, 'recursive')) {
+        current = skipWhitespaceAndComments(trimmed, current + 'recursive'.length);
+    }
+    while (current < trimmed.length) {
+        current = skipIdentifier(trimmed, current);
+        if (current < 0) {
+            return { withPrefix: '', body: trimmed };
+        }
+        current = skipWhitespaceAndComments(trimmed, current);
+        if (trimmed[current] === '(') {
+            current = skipBalancedParentheses(trimmed, current);
+            if (current < 0) {
+                return { withPrefix: '', body: trimmed };
+            }
+            current = skipWhitespaceAndComments(trimmed, current);
+        }
+        if (!keywordAt(trimmed, current, 'as')) {
+            return { withPrefix: '', body: trimmed };
+        }
+        current = skipWhitespaceAndComments(trimmed, current + 2);
+        current = skipBalancedParentheses(trimmed, current);
+        if (current < 0) {
+            return { withPrefix: '', body: trimmed };
+        }
+        current = skipWhitespaceAndComments(trimmed, current);
+        if (trimmed[current] === ',') {
+            current = skipWhitespaceAndComments(trimmed, current + 1);
+            continue;
+        }
+        const body = trimmed.slice(current).trimStart();
+        if (!body) {
+            return { withPrefix: '', body: trimmed };
+        }
+        return { withPrefix: `${trimmed.slice(0, current).trimEnd()} `, body };
+    }
+    return { withPrefix: '', body: trimmed };
+}
 // `assertReadOnlySql` deliberately keeps trailing semicolons, comments, and
 // whitespace (e.g. `select 1; -- done`) — harmless for direct single-statement
 // execution. A row-limit subquery wrapper needs a bare expression instead: a
@@ -130,5 +267,6 @@ export function limitSqlForExecution(sql, maxRows) {
     if (!Number.isInteger(maxRows) || maxRows <= 0) {
         throw new KtxQueryError('maxRows must be a positive integer.');
     }
-    return `select * from (${trimmed}) as ktx_query_result limit ${maxRows}`;
+    const { withPrefix, body } = hoistLeadingCte(trimmed);
+    return `${withPrefix}select * from (${body}) as ktx_query_result limit ${maxRows}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kaelio/ktx",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Standalone ktx context layer for data agents",
   "author": {
     "name": "Kaelio",