@kaelio/ktx 0.14.0 → 0.16.0

package/dist/context/ingest/local-adapters.d.ts

@@ -7,6 +7,7 @@ import { type LookerMappingClient, type LookerTableIdentifierParser } from './ad
 import type { LookerRuntimeClient } from './adapters/looker/fetch.js';
 import type { MetabaseClientLogger } from './adapters/metabase/client.js';
 import type { MetabaseFetchLogger } from './adapters/metabase/fetch.js';
+import type { SigmaFetchLogger } from './adapters/sigma/fetch.js';
 import type { NotionFetchLogger } from './adapters/notion/fetch.js';
 import type { SourceAdapter } from './types.js';
 export interface DefaultLocalIngestAdaptersOptions {
@@ -29,7 +30,7 @@ export interface DefaultLocalIngestAdaptersOptions {
     };
     logger?: LocalIngestOperationalLogger;
 }
-type LocalIngestOperationalLogger = MetabaseClientLogger & MetabaseFetchLogger & LookerClientLogger & NotionFetchLogger;
+type LocalIngestOperationalLogger = MetabaseClientLogger & MetabaseFetchLogger & LookerClientLogger & NotionFetchLogger & SigmaFetchLogger;
 export declare function createDefaultLocalIngestAdapters(project: KtxLocalProject, options?: DefaultLocalIngestAdaptersOptions): SourceAdapter[];
 export declare function localPullConfigForAdapter(project: KtxLocalProject, adapter: SourceAdapter, connectionId: string, options?: DefaultLocalIngestAdaptersOptions): Promise<unknown>;
 export {};

package/dist/context/ingest/local-adapters.js

@@ -22,6 +22,7 @@ import { buildLookerPullConfigFromInputs, } from './adapters/looker/mapping.js';
 import { LookmlSourceAdapter } from './adapters/lookml/lookml.adapter.js';
 import { pullConfigFromIntegrationConfig } from './adapters/lookml/pull-config.js';
 import { createLocalMetabaseSourceAdapter } from './adapters/metabase/local-metabase.adapter.js';
+import { createLocalSigmaSourceAdapter } from './adapters/sigma/local-sigma.adapter.js';
 import { MetricflowSourceAdapter } from './adapters/metricflow/metricflow.adapter.js';
 import { pullConfigFromMetricflowIntegration } from './adapters/metricflow/pull-config.js';
 import { LocalNotionRuntimeStore } from './adapters/notion/local-state-store.js';
@@ -51,6 +52,9 @@ export function createDefaultLocalIngestAdapters(project, options = {}) {
         createLocalMetabaseSourceAdapter(project, {
             ...(options.logger ? { logger: options.logger } : {}),
         }),
+        createLocalSigmaSourceAdapter(project, {
+            ...(options.logger ? { logger: options.logger } : {}),
+        }),
         new GdriveSourceAdapter(),
         new LookerSourceAdapter({
             clientFactory: {
@@ -183,6 +187,24 @@ export async function localPullConfigForAdapter(project, adapter, connectionId,
     if (adapter.source === 'metabase') {
         throw new Error('Metabase scheduled pulls fan out by mapping. Call runLocalMetabaseIngest() or use `ktx ingest <metabase-source-id>` from the CLI.');
     }
+    if (adapter.source === 'sigma') {
+        const sigmaConn = project.config.connections[connectionId];
+        const connectionMappings = sigmaConn && 'connectionMappings' in sigmaConn && sigmaConn.connectionMappings != null
+            ? sigmaConn.connectionMappings
+            : undefined;
+        const workbookFilter = sigmaConn && 'workbookFilter' in sigmaConn && sigmaConn.workbookFilter != null
+            ? sigmaConn.workbookFilter
+            : undefined;
+        const dataModelFilter = sigmaConn && 'dataModelFilter' in sigmaConn && sigmaConn.dataModelFilter != null
+            ? sigmaConn.dataModelFilter
+            : undefined;
+        return {
+            sigmaConnectionId: connectionId,
+            ...(connectionMappings ? { connectionMappings } : {}),
+            ...(workbookFilter ? { workbookFilter } : {}),
+            ...(dataModelFilter ? { dataModelFilter } : {}),
+        };
+    }
     const connection = project.config.connections[connectionId];
     if (adapter.source === HISTORIC_SQL_SOURCE_KEY) {
         if (options.historicSqlPullConfigOverride) {

package/dist/context/mcp/context-tools.js

@@ -171,6 +171,7 @@ const connectionListOutputSchema = z.object({
         connectionType: z.string(),
         members: z.array(z.string()).optional(),
         hint: z.string().optional(),
+        queryPolicy: z.literal('semantic-layer-only').optional(),
     })),
 });
 const wikiSearchOutputSchema = z.object({

package/dist/context/mcp/local-project-ports.d.ts

@@ -1,7 +1,7 @@
 import type { KtxSqlQueryExecutorPort } from '../../context/connections/query-executor.js';
 import type { KtxProjectConnectionConfig } from '../../context/project/config.js';
 import type { KtxEmbeddingPort } from '../../context/core/embedding.js';
-import type { KtxSemanticLayerComputePort } from '../../context/daemon/semantic-layer-compute.js';
+import { type KtxSemanticLayerComputePort } from '../../context/daemon/semantic-layer-compute.js';
 import type { KtxLocalProject } from '../../context/project/project.js';
 import type { LocalScanMcpOptions } from '../../context/scan/local-scan.js';
 import type { SqlAnalysisPort } from '../../context/sql-analysis/ports.js';

package/dist/context/mcp/local-project-ports.js

@@ -1,11 +1,11 @@
 import { KtxExpectedError, KtxQueryError, isNativeProgrammingFault } from '../../errors.js';
 import { isDatabaseDriver, normalizeConnectionDriver } from '../../connection-drivers.js';
 import { sqlDialectNotes } from '../../context/sql-analysis/dialect-notes.js';
-import { executeProjectReadOnlySql } from '../../context/connections/project-sql-executor.js';
-import { FEDERATED_CONNECTION_ID, federatedConnectionListing } from '../../context/connections/federation.js';
-import { assertSqlQueryableConnection } from '../../context/connections/dialects.js';
-import { resolveConfiguredConnection } from '../../context/connections/resolve-connection.js';
+import { executeProjectRawSql } from '../../context/connections/project-sql-executor.js';
+import { federatedConnectionListing } from '../../context/connections/federation.js';
+import { projectAllowsRawSql, restrictedFederatedMemberIds } from '../../context/connections/query-policy.js';
 import { localConnectionInfoFromConfig, } from '../../context/connections/local-warehouse-descriptor.js';
+import { KtxDaemonComputeError } from '../../context/daemon/semantic-layer-compute.js';
 import { createKtxEntityDetailsService } from '../../context/scan/entity-details.js';
 import { createKtxDiscoverDataService } from '../../context/search/discover.js';
 import { sqlAnalysisDialectForDriver } from '../../context/sql-analysis/dialect.js';
@@ -15,8 +15,26 @@ import { readLocalSlSource } from '../../context/sl/local-sl.js';
 import { assertSafeConnectionId } from '../../context/sl/source-files.js';
 import { assertConfiguredConnectionId } from '../../context/connections/configured-connections.js';
 import { readLocalKnowledgePage, searchLocalKnowledgePages } from '../wiki/local-knowledge.js';
+/**
+ * Reclassify a query-path failure. Warehouse/driver rejections and daemon
+ * input-rejections are caller-driven outcomes (KtxQueryError, kept out of Error
+ * Tracking while preserving the underlying diagnostics); native JS faults, daemon
+ * crashes, and already-expected errors propagate unchanged so genuine ktx bugs
+ * still reach Error Tracking.
+ */
+function throwClassifiedQueryError(error) {
+    if (error instanceof KtxDaemonComputeError) {
+        if (error.inputRejected) {
+            throw new KtxQueryError(error.detail, { cause: error });
+        }
+        throw error;
+    }
+    if (isNativeProgrammingFault(error) || error instanceof KtxExpectedError) {
+        throw error;
+    }
+    throw new KtxQueryError(error instanceof Error ? error.message : String(error), { cause: error });
+}
 async function executeValidatedReadOnlySql(project, options, input, onProgress) {
-    await onProgress?.({ progress: 0, message: 'Validating SQL' });
     if (!options.sqlAnalysis) {
         throw new Error('sql_execution requires parser-backed SQL validation.');
     }
@@ -24,50 +42,22 @@ async function executeValidatedReadOnlySql(project, options, input, onProgress)
     if (!createConnector) {
         throw new Error('sql_execution requires a local scan connector factory.');
     }
-    const isFederated = input.connectionId === FEDERATED_CONNECTION_ID;
-    const connectionId = isFederated ? input.connectionId : assertSafeConnectionId(input.connectionId);
-    const connection = isFederated ? undefined : resolveConfiguredConnection(project.config, connectionId);
-    if (!isFederated) {
-        assertSqlQueryableConnection(connectionId, connection.driver);
-    }
-    const dialect = sqlAnalysisDialectForDriver(isFederated ? 'duckdb' : connection.driver);
-    const validation = await options.sqlAnalysis.validateReadOnly(input.sql, dialect);
-    if (!validation.ok) {
-        // A read-only guard rejecting the agent's SQL is an expected outcome, not a
-        // ktx fault: classify it so reportException keeps it out of Error Tracking.
-        throw new KtxQueryError(validation.error ?? 'SQL is not read-only.');
-    }
-    await onProgress?.({ progress: 0.3, message: 'Executing' });
-    const result = await executeProjectReadOnlySql({
+    const result = await executeProjectRawSql({
         project,
-        input: {
-            connectionId,
-            projectDir: project.projectDir,
-            connection,
-            sql: input.sql,
-            maxRows: input.maxRows,
-        },
+        connectionId: input.connectionId,
+        sql: input.sql,
+        maxRows: input.maxRows,
+        sqlAnalysis: options.sqlAnalysis,
         createConnector,
         runId: 'mcp-sql-execution',
-    }).catch((error) => {
-        // A warehouse/driver rejection (e.g. the agent's SQL failed to compile) is a
-        // surfaced operational outcome, not a ktx fault: mark it expected while
-        // preserving the warehouse's own diagnostics. A native JS error (TypeError,
-        // etc.) signals a bug in connector code — let it propagate unchanged so Error
-        // Tracking still sees it.
-        if (isNativeProgrammingFault(error) || error instanceof KtxExpectedError) {
-            throw error;
-        }
-        throw new KtxQueryError(error instanceof Error ? error.message : String(error), { cause: error });
+        onProgress,
     });
-    const response = {
+    return {
         headers: result.headers,
         ...(result.headerTypes ? { headerTypes: result.headerTypes } : {}),
         rows: result.rows,
         rowCount: result.rowCount ?? result.rows.length,
     };
-    await onProgress?.({ progress: 1, message: `Fetched ${response.rowCount} rows` });
-    return response;
 }
 /** @internal Resolves a connection's dialect SQL notes; throws KtxExpectedError for an unknown or non-SQL-warehouse connection. */
 export function resolveDialectNotesForConnection(connectionId, connection) {
@@ -92,12 +82,16 @@ export function createLocalProjectMcpContextPorts(project, options) {
                     .sort((a, b) => a.id.localeCompare(b.id));
                 const federated = federatedConnectionListing(project.config.connections, project.projectDir);
                 if (federated) {
+                    const restricted = restrictedFederatedMemberIds(project.config, project.projectDir);
                     configured.push({
                         id: federated.id,
                         name: federated.id,
                         connectionType: 'DUCKDB',
                         members: federated.members,
-                        hint: federated.hint,
+                        hint: restricted.length > 0
+                            ? `Federated SQL is disabled: member connection(s) ${restricted.join(', ')} have query_policy: semantic-layer-only.`
+                            : federated.hint,
+                        ...(restricted.length > 0 ? { queryPolicy: 'semantic-layer-only' } : {}),
                     });
                 }
                 return configured;
@@ -158,15 +152,20 @@ export function createLocalProjectMcpContextPorts(project, options) {
                 if (!options.semanticLayerCompute) {
                     throw new Error('sl_query requires a semantic-layer query adapter.');
                 }
-                return compileLocalSlQuery(project, {
-                    connectionId: input.connectionId,
-                    query: input.query,
-                    compute: options.semanticLayerCompute,
-                    execute: Boolean(options.queryExecutor),
-                    maxRows: input.query.limit,
-                    queryExecutor: options.queryExecutor,
-                    onProgress: executionOptions?.onProgress,
-                });
+                try {
+                    return await compileLocalSlQuery(project, {
+                        connectionId: input.connectionId,
+                        query: input.query,
+                        compute: options.semanticLayerCompute,
+                        execute: Boolean(options.queryExecutor),
+                        maxRows: input.query.limit,
+                        queryExecutor: options.queryExecutor,
+                        onProgress: executionOptions?.onProgress,
+                    });
+                }
+                catch (error) {
+                    throwClassifiedQueryError(error);
+                }
             },
         },
         entityDetails: {
@@ -191,7 +190,10 @@ export function createLocalProjectMcpContextPorts(project, options) {
             },
         },
     };
-    if (options.sqlAnalysis && options.localScan?.createConnector) {
+    // Register sql_execution only when some connection can accept raw SQL; in
+    // mixed projects the tool stays and executeProjectRawSql rejects restricted
+    // connection ids at request time.
+    if (options.sqlAnalysis && options.localScan?.createConnector && projectAllowsRawSql(project.config)) {
         ports.sqlExecution = {
             async execute(input, executionOptions) {
                 return executeValidatedReadOnlySql(project, options, input, executionOptions?.onProgress);

package/dist/context/project/config.d.ts

@@ -109,36 +109,82 @@ declare const connectionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"mysql">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"snowflake">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"bigquery">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"sqlite">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
+}, z.core.$loose>, z.ZodObject<{
+    driver: z.ZodLiteral<"duckdb">;
+    url: z.ZodOptional<z.ZodString>;
+    enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"clickhouse">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"sqlserver">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
+}, z.core.$loose>, z.ZodObject<{
+    driver: z.ZodLiteral<"athena">;
+    url: z.ZodOptional<z.ZodString>;
+    enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"mongodb">;
     url: z.ZodString;
@@ -223,6 +269,21 @@ declare const connectionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         path: z.ZodOptional<z.ZodString>;
         auth_token_ref: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>;
+}, z.core.$loose>, z.ZodObject<{
+    driver: z.ZodLiteral<"sigma">;
+    api_url: z.ZodDefault<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    client_secret_ref: z.ZodOptional<z.ZodString>;
+    connectionMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    workbookFilter: z.ZodOptional<z.ZodObject<{
+        includeArchived: z.ZodDefault<z.ZodBoolean>;
+        includeExplorations: z.ZodDefault<z.ZodBoolean>;
+        updatedSince: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    dataModelFilter: z.ZodOptional<z.ZodObject<{
+        updatedSince: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$loose>], "driver">;
 declare const ktxProjectConfigSchema: z.ZodObject<{
     setup: z.ZodOptional<z.ZodObject<{
@@ -233,36 +294,82 @@ declare const ktxProjectConfigSchema: z.ZodObject<{
         url: z.ZodOptional<z.ZodString>;
         enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
         query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
     }, z.core.$loose>, z.ZodObject<{
         driver: z.ZodLiteral<"mysql">;
         url: z.ZodOptional<z.ZodString>;
         enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
         query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
     }, z.core.$loose>, z.ZodObject<{
         driver: z.ZodLiteral<"snowflake">;
         url: z.ZodOptional<z.ZodString>;
         enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
         query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
     }, z.core.$loose>, z.ZodObject<{
         driver: z.ZodLiteral<"bigquery">;
         url: z.ZodOptional<z.ZodString>;
         enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
         query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
     }, z.core.$loose>, z.ZodObject<{
         driver: z.ZodLiteral<"sqlite">;
         url: z.ZodOptional<z.ZodString>;
         enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
         query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
+    }, z.core.$loose>, z.ZodObject<{
+        driver: z.ZodLiteral<"duckdb">;
+        url: z.ZodOptional<z.ZodString>;
+        enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
     }, z.core.$loose>, z.ZodObject<{
         driver: z.ZodLiteral<"clickhouse">;
         url: z.ZodOptional<z.ZodString>;
         enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
         query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
     }, z.core.$loose>, z.ZodObject<{
         driver: z.ZodLiteral<"sqlserver">;
         url: z.ZodOptional<z.ZodString>;
         enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
         query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
+    }, z.core.$loose>, z.ZodObject<{
+        driver: z.ZodLiteral<"athena">;
+        url: z.ZodOptional<z.ZodString>;
+        enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+        query_policy: z.ZodOptional<z.ZodEnum<{
+            "read-only-sql": "read-only-sql";
+            "semantic-layer-only": "semantic-layer-only";
+        }>>;
     }, z.core.$loose>, z.ZodObject<{
         driver: z.ZodLiteral<"mongodb">;
         url: z.ZodString;
@@ -347,6 +454,21 @@ declare const ktxProjectConfigSchema: z.ZodObject<{
             path: z.ZodOptional<z.ZodString>;
             auth_token_ref: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
+    }, z.core.$loose>, z.ZodObject<{
+        driver: z.ZodLiteral<"sigma">;
+        api_url: z.ZodDefault<z.ZodString>;
+        client_id: z.ZodString;
+        client_secret: z.ZodOptional<z.ZodString>;
+        client_secret_ref: z.ZodOptional<z.ZodString>;
+        connectionMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        workbookFilter: z.ZodOptional<z.ZodObject<{
+            includeArchived: z.ZodDefault<z.ZodBoolean>;
+            includeExplorations: z.ZodDefault<z.ZodBoolean>;
+            updatedSince: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        dataModelFilter: z.ZodOptional<z.ZodObject<{
+            updatedSince: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
     }, z.core.$loose>], "driver">>>;
     storage: z.ZodPrefault<z.ZodObject<{
         state: z.ZodDefault<z.ZodEnum<{

package/dist/context/project/driver-schemas.d.ts

@@ -4,36 +4,82 @@ export declare const connectionConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"mysql">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"snowflake">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"bigquery">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"sqlite">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
+}, z.core.$loose>, z.ZodObject<{
+    driver: z.ZodLiteral<"duckdb">;
+    url: z.ZodOptional<z.ZodString>;
+    enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"clickhouse">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"sqlserver">;
     url: z.ZodOptional<z.ZodString>;
     enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
     query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
+}, z.core.$loose>, z.ZodObject<{
+    driver: z.ZodLiteral<"athena">;
+    url: z.ZodOptional<z.ZodString>;
+    enabled_tables: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    query_timeout_ms: z.ZodOptional<z.ZodNumber>;
+    query_policy: z.ZodOptional<z.ZodEnum<{
+        "read-only-sql": "read-only-sql";
+        "semantic-layer-only": "semantic-layer-only";
+    }>>;
 }, z.core.$loose>, z.ZodObject<{
     driver: z.ZodLiteral<"mongodb">;
     url: z.ZodString;
@@ -118,4 +164,19 @@ export declare const connectionConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
         path: z.ZodOptional<z.ZodString>;
         auth_token_ref: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>;
+}, z.core.$loose>, z.ZodObject<{
+    driver: z.ZodLiteral<"sigma">;
+    api_url: z.ZodDefault<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodOptional<z.ZodString>;
+    client_secret_ref: z.ZodOptional<z.ZodString>;
+    connectionMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    workbookFilter: z.ZodOptional<z.ZodObject<{
+        includeArchived: z.ZodDefault<z.ZodBoolean>;
+        includeExplorations: z.ZodDefault<z.ZodBoolean>;
+        updatedSince: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    dataModelFilter: z.ZodOptional<z.ZodObject<{
+        updatedSince: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$loose>], "driver">;

package/dist/context/project/driver-schemas.js

@@ -6,8 +6,10 @@ const warehouseDrivers = [
     'snowflake',
     'bigquery',
     'sqlite',
+    'duckdb',
     'clickhouse',
     'sqlserver',
+    'athena',
 ];
 function warehouseConnectionSchema(driver) {
     return z
@@ -28,6 +30,10 @@ function warehouseConnectionSchema(driver) {
             .positive()
             .optional()
             .describe('Maximum execution time for a single read-only query, in milliseconds (default 30000). Enforced as a server-side statement timeout for remote engines and by SIGKILL-ing a forked query subprocess for in-process SQLite. A query exceeding it is cancelled and returns a "query exceeded Ns" error so the agent can revise.'),
+        query_policy: z
+            .enum(['read-only-sql', 'semantic-layer-only'])
+            .optional()
+            .describe('Agent-facing query authorship policy (default "read-only-sql"). "read-only-sql" allows parser-validated read-only SQL plus semantic-layer queries. "semantic-layer-only" rejects raw SQL on this connection (`ktx sql`, the sql_execution tool, and federated queries that include it) and restricts semantic-layer queries to measures predefined in the semantic-layer sources. ktx-internal scan and ingest queries are unaffected.'),
     })
         .describe(`${driver} warehouse connection. Additional driver-tunable fields (e.g. context.queryHistory) are accepted and passed through.`);
 }
@@ -37,8 +43,10 @@ const warehouseConnectionSchemas = [
     warehouseConnectionSchema('snowflake'),
     warehouseConnectionSchema('bigquery'),
     warehouseConnectionSchema('sqlite'),
+    warehouseConnectionSchema('duckdb'),
     warehouseConnectionSchema('clickhouse'),
     warehouseConnectionSchema('sqlserver'),
+    warehouseConnectionSchema('athena'),
 ];
 const mongodbConnectionSchema = z
     .looseObject({
@@ -218,6 +226,44 @@ const metricflowConnectionSchema = z
         .describe('Nested MetricFlow configuration block.'),
 })
     .describe('MetricFlow / SL context-source connection.');
+const sigmaConnectionSchema = z
+    .looseObject({
+    driver: z.literal('sigma'),
+    api_url: z
+        .string()
+        .url()
+        .default('https://api.sigmacomputing.com')
+        .describe('Sigma API base URL. Defaults to the GCP US endpoint; change for other regions.'),
+    client_id: z.string().min(1).describe('Sigma API client ID.'),
+    client_secret: z.string().min(1).optional().describe('Literal Sigma client secret. Prefer client_secret_ref.'),
+    client_secret_ref: z
+        .string()
+        .min(1)
+        .optional()
+        .describe('Reference to Sigma client secret (e.g. env:SIGMA_CLIENT_SECRET).'),
+    connectionMappings: z
+        .record(z.string(), z.string())
+        .optional()
+        .describe('Maps Sigma internal connection UUIDs to ktx warehouse connection IDs. ' +
+        'When set, projected semantic-layer sources land under the mapped warehouse connection ' +
+        'instead of the Sigma connection, enabling sl_validate. ' +
+        'Find UUIDs in data model specs under source.connectionId.'),
+    workbookFilter: z
+        .object({
+        includeArchived: z.boolean().default(false),
+        includeExplorations: z.boolean().default(false),
+        updatedSince: z.string().optional().describe('ISO 8601 date string. Only workbooks updated on or after this date are ingested.'),
+    })
+        .optional()
+        .describe('Filters applied when listing workbooks during ingest. Defaults exclude archived and exploration workbooks.'),
+    dataModelFilter: z
+        .object({
+        updatedSince: z.string().optional().describe('ISO 8601 date string. Only data models updated on or after this date are fetched.'),
+    })
+        .optional()
+        .describe('Filters applied when listing data models during ingest.'),
+})
+    .describe('Sigma Computing API connection for ingesting data models.');
 export const connectionConfigSchema = z.discriminatedUnion('driver', [
     ...warehouseConnectionSchemas,
     mongodbConnectionSchema,
@@ -228,4 +274,5 @@ export const connectionConfigSchema = z.discriminatedUnion('driver', [
     gdriveConnectionSchema,
     dbtConnectionSchema,
     metricflowConnectionSchema,
+    sigmaConnectionSchema,
 ]);

package/dist/context/scan/local-scan.js

@@ -43,15 +43,17 @@ function normalizeDriver(driver) {
     const normalized = (driver ?? '').toLowerCase();
     if (normalized === 'postgres' ||
         normalized === 'sqlite' ||
+        normalized === 'duckdb' ||
         normalized === 'mysql' ||
         normalized === 'clickhouse' ||
         normalized === 'sqlserver' ||
         normalized === 'bigquery' ||
         normalized === 'snowflake' ||
+        normalized === 'athena' ||
         normalized === 'mongodb') {
         return normalized;
     }
-    throw new Error(`Standalone ktx scan supports postgres/sqlite/mysql/clickhouse/sqlserver/bigquery/snowflake/mongodb in this phase, received "${driver ?? 'unknown'}"`);
+    throw new Error(`Standalone ktx scan supports postgres/sqlite/duckdb/mysql/clickhouse/sqlserver/bigquery/snowflake/athena/mongodb in this phase, received "${driver ?? 'unknown'}"`);
 }
 function tablePathCount(paths) {
     return paths.filter((path) => path.startsWith('tables/') && path.endsWith('.json')).length;