@malloydata/malloy 0.0.394 → 0.0.395

package/dist/dialect/dialect.js

@@ -22,10 +22,11 @@
  * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Dialect = exports.dayIndex = exports.MAX_DECIMAL38 = exports.MIN_DECIMAL38 = exports.MAX_INT128 = exports.MIN_INT128 = exports.MAX_INT64 = exports.MIN_INT64 = exports.MAX_INT32 = exports.MIN_INT32 = void 0;
+exports.Dialect = exports.dayIndex = exports.EscapeStyle = exports.MAX_DECIMAL38 = exports.MIN_DECIMAL38 = exports.MAX_INT128 = exports.MIN_INT128 = exports.MAX_INT64 = exports.MIN_INT64 = exports.MAX_INT32 = exports.MIN_INT32 = void 0;
 exports.inDays = inDays;
 exports.qtz = qtz;
 const malloy_types_1 = require("../model/malloy_types");
+const table_path_1 = require("./table-path");
 /*
  * Standard integer type limits.
  * Use these in dialect integerTypeMappings definitions.
@@ -42,6 +43,17 @@ exports.MAX_INT128 = BigInt('170141183460469231731687303715884105727'); // 2^127
 // Decimal(38,0) limits (for Snowflake NUMBER(38,0))
 exports.MIN_DECIMAL38 = BigInt('-99999999999999999999999999999999999999'); // -(10^38 - 1)
 exports.MAX_DECIMAL38 = BigInt('99999999999999999999999999999999999999'); // 10^38 - 1
+/**
+ * Allowed values for `Dialect.stringLiteralStyle` and
+ * `Dialect.identifierEscapeStyle`. Subclasses set their style with
+ * e.g. `stringLiteralStyle = EscapeStyle.Backslash`; the `as const`
+ * is centralized here so dialect files stay free of it.
+ */
+exports.EscapeStyle = {
+    Doubled: 'doubled',
+    Backslash: 'backslash',
+    Unset: 'unset',
+};
 const allUnits = [
     'microsecond',
     'millisecond',
@@ -138,6 +150,57 @@ class Dialect {
             { min: BigInt(exports.MIN_INT32), max: BigInt(exports.MAX_INT32), numberType: 'integer' },
             { min: exports.MIN_INT64, max: exports.MAX_INT64, numberType: 'bigint' },
         ];
+        /**
+         * Regex matching one bare (unquoted) table-path segment for this
+         * dialect, anchored at the start of the input. Drives the default
+         * `sqlValidateTableName` along with `identifierQuoteChar` and
+         * `identifierEscapeStyle`.
+         *
+         * The default is strict ANSI: `[A-Za-z_][A-Za-z0-9_]*`. Override to
+         * widen the char set (Postgres allows `$`, MySQL allows digit-start
+         * with caveats, BigQuery allows dashes, …). The per-dialect regexes
+         * were verified by probing live engines.
+         */
+        this.tablePathBareIdentRegex = /^[A-Za-z_][A-Za-z0-9_]*/;
+        /**
+         * The character the dialect uses to quote identifiers. Most dialects
+         * use ANSI double-quote `"`; MySQL, BigQuery and Databricks use the
+         * backtick `` ` ``. The dialect must escape this character by doubling
+         * inside a quoted identifier.
+         *
+         * Defaults to the empty string sentinel — concrete dialects must set
+         * a real value (or override `sqlQuoteIdentifier`), otherwise the
+         * base method throws to surface the omission immediately.
+         */
+        this.identifierQuoteChar = '';
+        /**
+         * How the dialect escapes the closing quote inside a string literal.
+         * Set via `EscapeStyle` from this module:
+         *
+         * - `EscapeStyle.Doubled`: `''` escapes `'`. Backslash is a literal
+         *   character. (ANSI standard; Postgres, DuckDB, Trino, Presto.)
+         * - `EscapeStyle.Backslash`: `\'` escapes `'`, `\\` escapes `\`.
+         *   (BigQuery, Snowflake, MySQL default mode, Databricks.)
+         * - `EscapeStyle.Unset` (default): base methods throw if reached. A
+         *   new dialect must set this (or override the literal methods).
+         *
+         * `sqlLiteralString` and `sqlLiteralRegexp` share this style — the
+         * regex engine receives whatever the SQL parser decodes, and the two
+         * must agree or regex patterns containing backslashes silently break.
+         */
+        this.stringLiteralStyle = exports.EscapeStyle.Unset;
+        /**
+         * How the dialect escapes the quote character inside a quoted
+         * identifier. Mirrors `stringLiteralStyle`:
+         *
+         * - `EscapeStyle.Doubled`: doubling the quote char escapes it (ANSI
+         *   standard; most dialects).
+         * - `EscapeStyle.Backslash`: backslash-style escape, with `\\` for
+         *   backslash and `\<quote>` for the quote char. (BigQuery — quoted
+         *   identifiers use string-literal escape sequences.)
+         * - `EscapeStyle.Unset` (default): base method throws if reached.
+         */
+        this.identifierEscapeStyle = exports.EscapeStyle.Unset;
     }
     // Generate the lateral join bag clause for window function partitioning.
     // The expressions are dimension fields that need to be referenced by name
@@ -218,6 +281,34 @@ class Dialect {
             },
         };
     }
+    /**
+     * Validate a user-supplied table-path string for this dialect. On
+     * success, the canonical form is the SQL fragment that gets pasted
+     * into `FROM` clauses and stored in `StructDef.tablePath`. Canonical
+     * equals input verbatim except where a Malloy convenience needs
+     * translating into dialect SQL (today: DuckDB's file-path branch
+     * wraps the input in single quotes).
+     *
+     * The default implementation handles every dialect whose table-path
+     * grammar is a dotted sequence of `bare | quoted` segments — every
+     * dialect we ship except DuckDB. New dialects of that shape need
+     * only override `tablePathBareIdentRegex`; override
+     * `sqlValidateTableName` itself only if your grammar is structurally
+     * different.
+     */
+    sqlValidateTableName(input) {
+        if (this.identifierEscapeStyle !== exports.EscapeStyle.Doubled &&
+            this.identifierEscapeStyle !== exports.EscapeStyle.Backslash) {
+            throw new Error(`${this.name}: sqlValidateTableName requires identifierEscapeStyle ` +
+                'to be set to Doubled or Backslash (or override sqlValidateTableName).');
+        }
+        return (0, table_path_1.validateDottedTablePath)(input, {
+            quoteChar: this.identifierQuoteChar,
+            escapeStyle: this.identifierEscapeStyle,
+            bareIdentRegex: this.tablePathBareIdentRegex,
+            dialectName: this.name,
+        });
+    }
     // Format a CompiledOrderBy[] into an ORDER BY clause string for use
     // inside an aggregate turtle expression. Dialects which support ORDER BY
     // inside aggregate functions can call this helper from sqlAggregateTurtle.
@@ -232,6 +323,33 @@ class Dialect {
     sqlDateToString(sqlDateExp) {
         return this.castToString(`DATE(${sqlDateExp})`);
     }
+    /**
+     * Wrap an identifier in the dialect's quote character, escaping any
+     * embedded quote characters per the dialect's `identifierEscapeStyle`.
+     * This is the only safe way to render a user-controlled identifier
+     * in SQL.
+     */
+    sqlQuoteIdentifier(identifier) {
+        const q = this.identifierQuoteChar;
+        if (!q) {
+            throw new Error(`${this.name}: identifierQuoteChar is not set. ` +
+                'Set it on the dialect (e.g. \'"\' or "`"), ' +
+                'or override sqlQuoteIdentifier.');
+        }
+        if (this.identifierEscapeStyle === exports.EscapeStyle.Doubled) {
+            return q + identifier.split(q).join(q + q) + q;
+        }
+        if (this.identifierEscapeStyle === exports.EscapeStyle.Backslash) {
+            const escaped = identifier
+                .replace(/\\/g, '\\\\')
+                .split(q)
+                .join('\\' + q);
+            return q + escaped + q;
+        }
+        throw new Error(`${this.name}: identifierEscapeStyle is not set. ` +
+            'Set it to EscapeStyle.Doubled or EscapeStyle.Backslash on the dialect, ' +
+            'or override sqlQuoteIdentifier.');
+    }
     sqlLiteralNumber(literal) {
         return literal;
     }
@@ -330,6 +448,32 @@ class Dialect {
         }
         return sql;
     }
+    /**
+     * Render a Malloy string as a SQL string literal. The escape style is
+     * driven by `stringLiteralStyle`; dialects normally do not override
+     * this method.
+     */
+    sqlLiteralString(literal) {
+        if (this.stringLiteralStyle === 'doubled') {
+            return "'" + literal.split("'").join("''") + "'";
+        }
+        if (this.stringLiteralStyle === 'backslash') {
+            const escaped = literal.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+            return "'" + escaped + "'";
+        }
+        throw new Error(`${this.name}: stringLiteralStyle is not set. ` +
+            'Set it to EscapeStyle.Doubled or EscapeStyle.Backslash on the dialect, ' +
+            'or override sqlLiteralString.');
+    }
+    /**
+     * Render a Malloy regex literal as a SQL string literal. Defaults to
+     * `sqlLiteralString` — the regex engine receives whatever bytes the
+     * SQL parser decodes, and `sqlLiteralString` already produces a
+     * correctly decoding literal for both escape styles.
+     */
+    sqlLiteralRegexp(literal) {
+        return this.sqlLiteralString(literal);
+    }
     /**
      * The dialect has a chance to over-ride how expressions are translated. If
      * "undefined" is returned then the translation is left to the query translator.

package/dist/dialect/duckdb/duckdb.d.ts

@@ -2,6 +2,7 @@ import type { Sampling, AtomicTypeDef, RegexMatchExpr, MeasureTimeExpr, BasicAto
 import type { DialectFunctionOverloadDef } from '../functions';
 import type { CompiledOrderBy, DialectFieldList, FieldReferenceType, IntegerTypeMapping } from '../dialect';
 import { PostgresBase } from '../pg_impl';
+import type { ValidateTablePathResult } from '../table-path';
 export declare class DuckDBDialect extends PostgresBase {
     name: string;
     experimental: boolean;
@@ -25,7 +26,7 @@ export declare class DuckDBDialect extends PostgresBase {
     requiresExplicitUnnestOrdering: boolean;
     integerTypeMappings: IntegerTypeMapping[];
     get udfPrefix(): string;
-    quoteTablePath(tableName: string): string;
+    sqlValidateTableName(input: string): ValidateTablePathResult;
     sqlGroupSetTable(groupSetCount: number): string;
     sqlAnyValue(groupSet: number, fieldName: string): string;
     sqlLiteralNumber(literal: string): string;
@@ -48,8 +49,6 @@ export declare class DuckDBDialect extends PostgresBase {
     sqlAggDistinct(key: string, values: string[], func: (valNames: string[]) => string): string;
     sqlSampleTable(tableSQL: string, sample: Sampling | undefined): string;
     sqlOrderBy(orderTerms: string[]): string;
-    sqlLiteralString(literal: string): string;
-    sqlLiteralRegexp(literal: string): string;
     getDialectFunctionOverrides(): {
         [name: string]: DialectFunctionOverloadDef[];
     };

package/dist/dialect/duckdb/duckdb.js

@@ -31,6 +31,7 @@ const pg_impl_1 = require("../pg_impl");
 const dialect_functions_1 = require("./dialect_functions");
 const function_overrides_1 = require("./function_overrides");
 const tiny_parser_1 = require("../tiny_parser");
+const table_path_parser_1 = require("./table-path-parser");
 // need to refactor runSQL to take a SQLBlock instead of just a sql string.
 const hackSplitComment = '-- hack: split on this';
 const duckDBToMalloyTypes = {
@@ -85,9 +86,12 @@ class DuckDBDialect extends pg_impl_1.PostgresBase {
     get udfPrefix() {
         return `__udf${Math.floor(Math.random() * 100000)}`;
     }
-    quoteTablePath(tableName) {
-        // Quote if contains special chars that could be SQL injection or need quoting
-        return tableName.match(/[/*:;-]/) ? `'${tableName}'` : tableName;
+    // DuckDB's table-path grammar is too rich for the shared ANSI parser
+    // (it has file-path and explicit-single-quoted-literal branches in
+    // addition to dotted identifier paths). See
+    // `duckdb/table-path-parser.ts` for the grammar.
+    sqlValidateTableName(input) {
+        return (0, table_path_parser_1.validateDuckDBTablePath)(input);
     }
     sqlGroupSetTable(groupSetCount) {
         return `CROSS JOIN (SELECT UNNEST(GENERATE_SERIES(0,${groupSetCount},1)) as group_set  ) as group_set`;
@@ -174,7 +178,7 @@ class DuckDBDialect extends pg_impl_1.PostgresBase {
             return parentAlias;
         }
         else {
-            return `${parentAlias}.${this.sqlMaybeQuoteIdentifier(childName)}`;
+            return `${parentAlias}.${this.sqlQuoteIdentifier(childName)}`;
         }
     }
     sqlUnnestPipelineHead(isSingleton, sourceSQLExpression) {
@@ -204,7 +208,7 @@ class DuckDBDialect extends pg_impl_1.PostgresBase {
             }
         }
         return `SELECT LIST(STRUCT_PACK(${dialectFieldList
-            .map(d => this.sqlMaybeQuoteIdentifier(d.sqlOutputName))
+            .map(d => this.sqlQuoteIdentifier(d.sqlOutputName))
             .join(',')})${o}) FROM ${lastStageName}\n`;
     }
     sqlSelectAliasAsStruct(alias, dialectFieldList) {
@@ -263,12 +267,6 @@ class DuckDBDialect extends pg_impl_1.PostgresBase {
     sqlOrderBy(orderTerms) {
         return `ORDER BY ${orderTerms.map(t => `${t} NULLS LAST`).join(',')}`;
     }
-    sqlLiteralString(literal) {
-        return "'" + literal.replace(/'/g, "''") + "'";
-    }
-    sqlLiteralRegexp(literal) {
-        return "'" + literal.replace(/'/g, "''") + "'";
-    }
     getDialectFunctionOverrides() {
         return (0, functions_1.expandOverrideMap)(function_overrides_1.DUCKDB_MALLOY_STANDARD_OVERLOADS);
     }
@@ -297,7 +295,7 @@ class DuckDBDialect extends pg_impl_1.PostgresBase {
             const typeSpec = [];
             for (const f of malloyType.fields) {
                 if ((0, malloy_types_1.isAtomic)(f)) {
-                    typeSpec.push(`${this.sqlMaybeQuoteIdentifier(f.name)} ${this.malloyTypeToSQLType(f)}`);
+                    typeSpec.push(`${this.sqlQuoteIdentifier(f.name)} ${this.malloyTypeToSQLType(f)}`);
                 }
             }
             return `STRUCT(${typeSpec.join(', ')})`;
@@ -307,7 +305,7 @@ class DuckDBDialect extends pg_impl_1.PostgresBase {
                 const typeSpec = [];
                 for (const f of malloyType.fields) {
                     if ((0, malloy_types_1.isAtomic)(f)) {
-                        typeSpec.push(`${this.sqlMaybeQuoteIdentifier(f.name)} ${this.malloyTypeToSQLType(f)}`);
+                        typeSpec.push(`${this.sqlQuoteIdentifier(f.name)} ${this.malloyTypeToSQLType(f)}`);
                     }
                 }
                 return `STRUCT(${typeSpec.join(', ')})[]`;
@@ -389,7 +387,7 @@ class DuckDBDialect extends pg_impl_1.PostgresBase {
         return `DATE_SUB('${df.units}', ${lVal}, ${rVal})`;
     }
     sqlLiteralRecord(lit) {
-        const pairs = Object.entries(lit.kids).map(([propName, propVal]) => `${this.sqlMaybeQuoteIdentifier(propName)}:${propVal.sql}`);
+        const pairs = Object.entries(lit.kids).map(([propName, propVal]) => `${this.sqlQuoteIdentifier(propName)}:${propVal.sql}`);
         return '{' + pairs.join(',') + '}';
     }
 }

package/dist/dialect/duckdb/table-path-parser.d.ts

@@ -0,0 +1,2 @@
+import type { ValidateTablePathResult } from '../table-path';
+export declare function validateDuckDBTablePath(input: string): ValidateTablePathResult;

package/dist/dialect/duckdb/table-path-parser.js

@@ -0,0 +1,57 @@
+"use strict";
+/*
+ * Copyright Contributors to the Malloy project
+ * SPDX-License-Identifier: MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateDuckDBTablePath = validateDuckDBTablePath;
+const table_path_1 = require("../table-path");
+const DUCKDB_FILE_PATH_RE = /^[A-Za-z0-9._\-/:?*]+$/;
+const DUCKDB_SINGLE_QUOTED_RE = /^'(?:[^']|'')*'$/;
+function validateDuckDBTablePath(input) {
+    if (input.length === 0) {
+        return { ok: false, error: 'DuckDB table path is empty' };
+    }
+    // Branch 1: explicit single-quoted literal.
+    if (input[0] === "'") {
+        if (DUCKDB_SINGLE_QUOTED_RE.test(input)) {
+            const body = input.slice(1, -1).replace(/''/g, "'");
+            if (body.includes(';') || body.includes('--')) {
+                return {
+                    ok: false,
+                    error: `Invalid DuckDB table path: ${JSON.stringify(input)} — ` +
+                        'forbidden character `;` or `--` in single-quoted body.',
+                };
+            }
+            return { ok: true, canonical: input };
+        }
+        return {
+            ok: false,
+            error: `Invalid DuckDB table path: ${JSON.stringify(input)} — ` +
+                'unterminated or trailing-junk single-quoted literal.',
+        };
+    }
+    // Branch 2: identifier path (same grammar as ANSI dialects).
+    const id = (0, table_path_1.validateDottedTablePath)(input, {
+        quoteChar: '"',
+        escapeStyle: 'doubled',
+        bareIdentRegex: /^[A-Za-z_][A-Za-z0-9_]*/,
+        dialectName: 'DuckDB',
+    });
+    if (id.ok)
+        return id;
+    // Branch 3: file-path convenience.
+    if (DUCKDB_FILE_PATH_RE.test(input)) {
+        return { ok: true, canonical: `'${input}'` };
+    }
+    return {
+        ok: false,
+        error: `Invalid DuckDB table path: ${JSON.stringify(input)} — expected an ` +
+            'identifier path, a quoted identifier path, a single-quoted ' +
+            "literal ('foo.csv'), or a file-path-shaped string of letters, " +
+            'digits, and `._-/:?*`. For table-valued function calls (e.g. ' +
+            "read_parquet('foo.parquet')) or other table expressions, use a " +
+            'SQL block instead: connection.sql("""SELECT * FROM …""").',
+    };
+}
+//# sourceMappingURL=table-path-parser.js.map

package/dist/dialect/index.d.ts

@@ -14,3 +14,5 @@ export { getMalloyStandardFunctions } from './functions';
 export type { MalloyStandardFunctionImplementations } from './functions';
 export type { TinyToken } from './tiny_parser';
 export { TinyParser } from './tiny_parser';
+export type { DecodeDottedTablePathResult, DottedTablePathOptions, TablePathEscapeStyle, TablePathSegment, ValidateTablePathResult, } from './table-path';
+export { decodeDottedTablePath, validateDottedTablePath } from './table-path';

package/dist/dialect/index.js

@@ -22,7 +22,7 @@
  * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TinyParser = exports.getMalloyStandardFunctions = exports.registerDialect = exports.getDialect = exports.DatabricksDialect = exports.MySQLDialect = exports.TrinoDialect = exports.SnowflakeDialect = exports.DuckDBDialect = exports.PostgresDialect = exports.StandardSQLDialect = exports.qtz = exports.Dialect = exports.sql = exports.literal = exports.variadicParam = exports.param = exports.spread = exports.maxScalar = exports.minAggregate = exports.minScalar = exports.overload = exports.makeParam = exports.anyExprType = exports.arg = void 0;
+exports.validateDottedTablePath = exports.decodeDottedTablePath = exports.TinyParser = exports.getMalloyStandardFunctions = exports.registerDialect = exports.getDialect = exports.DatabricksDialect = exports.MySQLDialect = exports.TrinoDialect = exports.SnowflakeDialect = exports.DuckDBDialect = exports.PostgresDialect = exports.StandardSQLDialect = exports.qtz = exports.Dialect = exports.sql = exports.literal = exports.variadicParam = exports.param = exports.spread = exports.maxScalar = exports.minAggregate = exports.minScalar = exports.overload = exports.makeParam = exports.anyExprType = exports.arg = void 0;
 var util_1 = require("./functions/util");
 Object.defineProperty(exports, "arg", { enumerable: true, get: function () { return util_1.arg; } });
 Object.defineProperty(exports, "anyExprType", { enumerable: true, get: function () { return util_1.anyExprType; } });
@@ -60,4 +60,7 @@ var functions_1 = require("./functions");
 Object.defineProperty(exports, "getMalloyStandardFunctions", { enumerable: true, get: function () { return functions_1.getMalloyStandardFunctions; } });
 var tiny_parser_1 = require("./tiny_parser");
 Object.defineProperty(exports, "TinyParser", { enumerable: true, get: function () { return tiny_parser_1.TinyParser; } });
+var table_path_1 = require("./table-path");
+Object.defineProperty(exports, "decodeDottedTablePath", { enumerable: true, get: function () { return table_path_1.decodeDottedTablePath; } });
+Object.defineProperty(exports, "validateDottedTablePath", { enumerable: true, get: function () { return table_path_1.validateDottedTablePath; } });
 //# sourceMappingURL=index.js.map

package/dist/dialect/mysql/mysql.d.ts

@@ -4,6 +4,9 @@ import { Dialect } from '../dialect';
 import type { DialectFunctionOverloadDef } from '../functions';
 export declare class MySQLDialect extends Dialect {
     name: string;
+    stringLiteralStyle: "backslash";
+    identifierEscapeStyle: "doubled";
+    identifierQuoteChar: string;
     defaultNumberType: string;
     defaultDecimalType: string;
     udfPrefix: string;
@@ -32,9 +35,9 @@ export declare class MySQLDialect extends Dialect {
     booleanType: BooleanTypeSupport;
     orderByClause: OrderByClauseType;
     maxIdentifierLength: number;
+    tablePathBareIdentRegex: RegExp;
     malloyTypeToSQLType(malloyType: AtomicTypeDef): string;
     sqlTypeToMalloyType(sqlType: string): BasicAtomicTypeDef;
-    quoteTablePath(tablePath: string): string;
     sqlGroupSetTable(groupSetCount: number): string;
     sqlAnyValue(_groupSet: number, fieldName: string): string;
     private mapFields;
@@ -54,7 +57,6 @@ export declare class MySQLDialect extends Dialect {
     sqlCreateFunction(id: string, funcText: string): string;
     sqlCreateFunctionCombineLastStage(lastStageName: string): string;
     sqlSelectAliasAsStruct(_alias: string, _fieldList: DialectFieldList): string;
-    sqlMaybeQuoteIdentifier(identifier: string): string;
     sqlCreateTableAsSelect(_tableName: string, _sql: string): string;
     sqlNowExpr(): string;
     sqlConvertToCivilTime(expr: string, timezone: string, _typeDef: AtomicTypeDef): {
@@ -73,8 +75,6 @@ export declare class MySQLDialect extends Dialect {
     sqlMeasureTimeExpr(df: MeasureTimeExpr): string;
     sqlAggDistinct(_key: string, _values: string[], _func: (valNames: string[]) => string): string;
     sqlSampleTable(tableSQL: string, sample: Sampling | undefined): string;
-    sqlLiteralString(literal: string): string;
-    sqlLiteralRegexp(literal: string): string;
     getDialectFunctionOverrides(): {
         [name: string]: DialectFunctionOverloadDef[];
     };

package/dist/dialect/mysql/mysql.js

@@ -94,6 +94,9 @@ class MySQLDialect extends dialect_1.Dialect {
     constructor() {
         super(...arguments);
         this.name = 'mysql';
+        this.stringLiteralStyle = dialect_1.EscapeStyle.Backslash;
+        this.identifierEscapeStyle = dialect_1.EscapeStyle.Doubled;
+        this.identifierQuoteChar = '`';
         this.defaultNumberType = 'DOUBLE PRECISION';
         this.defaultDecimalType = 'DECIMAL';
         this.udfPrefix = 'ms_temp.__udf';
@@ -121,6 +124,11 @@ class MySQLDialect extends dialect_1.Dialect {
         this.booleanType = 'simulated';
         this.orderByClause = 'ordinal';
         this.maxIdentifierLength = 64;
+        // MySQL bare identifiers allow `$` and may start with a digit, but
+        // cannot be entirely digits (or they lex as number literals). The
+        // regex requires at least one non-digit char somewhere in the run.
+        // Verified against the live engine.
+        this.tablePathBareIdentRegex = /^[A-Za-z0-9_$]*[A-Za-z_$][A-Za-z0-9_$]*/;
     }
     malloyTypeToSQLType(malloyType) {
         switch (malloyType.type) {
@@ -154,12 +162,6 @@ class MySQLDialect extends dialect_1.Dialect {
             rawType: baseSqlType,
         });
     }
-    quoteTablePath(tablePath) {
-        return tablePath
-            .split('.')
-            .map(part => `\`${part}\``)
-            .join('.');
-    }
     sqlGroupSetTable(groupSetCount) {
         return `CROSS JOIN (select number - 1 as group_set from JSON_TABLE(cast(concat("[1", repeat(",1", ${groupSetCount}), "]") as JSON),"$[*]" COLUMNS(number FOR ORDINALITY)) group_set) as group_set`;
     }
@@ -167,7 +169,11 @@ class MySQLDialect extends dialect_1.Dialect {
         return `MAX(${fieldName})`;
     }
     mapFields(fieldList) {
-        return fieldList.map(f => `"${f.rawName}", ${f.sqlExpression}`).join(', ');
+        // JSON_OBJECT key is a string value. Routing rawName through
+        // sqlLiteralString also keeps the SQL valid under ANSI_QUOTES mode.
+        return fieldList
+            .map(f => `${this.sqlLiteralString(f.rawName)}, ${f.sqlExpression}`)
+            .join(', ');
     }
     sqlAggregateTurtle(groupSet, fieldList, orderBy) {
         const separator = ',';
@@ -218,7 +224,12 @@ class MySQLDialect extends dialect_1.Dialect {
                 ((_a = f.typeDef.rawType) === null || _a === void 0 ? void 0 : _a.match(/json/))) {
                 fType = f.typeDef.rawType.toUpperCase();
             }
-            fields.push(`${this.sqlMaybeQuoteIdentifier(f.sqlOutputName)} ${fType}  PATH "$.${f.rawName}"`);
+            // JSON_TABLE PATH argument is a string literal containing a
+            // JSONPath. Render rawName through sqlLiteralString so a single
+            // quote in the user-controlled field name cannot close the SQL
+            // string literal.
+            const jsonPathLit = this.sqlLiteralString('$.' + f.rawName);
+            fields.push(`${this.sqlQuoteIdentifier(f.sqlOutputName)} ${fType}  PATH ${jsonPathLit}`);
         }
         return fields.join(',\n');
     }
@@ -266,7 +277,11 @@ class MySQLDialect extends dialect_1.Dialect {
     }
     sqlFieldReference(parentAlias, parentType, childName, childType) {
         if (parentType === 'array[scalar]' || parentType === 'record') {
-            let ret = `JSON_UNQUOTE(JSON_EXTRACT(${parentAlias},'$.${childName}'))`;
+            // childName comes from user-controlled record field names; render
+            // the JSON path through sqlLiteralString so a single quote in the
+            // name cannot close the SQL string literal.
+            const jsonPathLit = this.sqlLiteralString('$.' + childName);
+            let ret = `JSON_UNQUOTE(JSON_EXTRACT(${parentAlias},${jsonPathLit}))`;
             if (parentType === 'array[scalar]') {
                 ret = `JSON_UNQUOTE(${parentAlias}.\`value\`)`;
             }
@@ -280,7 +295,7 @@ class MySQLDialect extends dialect_1.Dialect {
                     return `CAST(${ret} as JSON)`;
             }
         }
-        const child = this.sqlMaybeQuoteIdentifier(childName);
+        const child = this.sqlQuoteIdentifier(childName);
         return `${parentAlias}.${child}`;
     }
     sqlCreateFunction(id, funcText) {
@@ -297,9 +312,6 @@ class MySQLDialect extends dialect_1.Dialect {
         //   .map(name => `'${name.replace(/`/g, '')}', \`${alias}\`.${name}`)
         //   .join(',')})`;
     }
-    sqlMaybeQuoteIdentifier(identifier) {
-        return '`' + identifier.replace(/`/g, '``') + '`';
-    }
     // TODO: Check what this is.
     sqlCreateTableAsSelect(_tableName, _sql) {
         throw new Error('Not implemented Yet');
@@ -441,13 +453,6 @@ class MySQLDialect extends dialect_1.Dialect {
         }
         return tableSQL;
     }
-    sqlLiteralString(literal) {
-        const noVirgule = literal.replace(/\\/g, '\\\\');
-        return "'" + noVirgule.replace(/'/g, "\\'") + "'";
-    }
-    sqlLiteralRegexp(literal) {
-        return "'" + literal.replace(/'/g, "''") + "'";
-    }
     getDialectFunctionOverrides() {
         return (0, functions_1.expandOverrideMap)(function_overrides_1.MYSQL_MALLOY_STANDARD_OVERLOADS);
     }

package/dist/dialect/pg_impl.d.ts

@@ -9,6 +9,9 @@ export declare const timeExtractMap: Record<string, string>;
 export declare abstract class PostgresBase extends Dialect {
     hasTimestamptz: boolean;
     supportsBigIntPrecision: boolean;
+    stringLiteralStyle: "doubled";
+    identifierEscapeStyle: "doubled";
+    identifierQuoteChar: string;
     sqlNowExpr(): string;
     sqlTimeExtractExpr(qi: QueryInfo, from: TimeExtractExpr): string;
     sqlCast(qi: QueryInfo, cast: TypecastExpr): string;
@@ -18,7 +21,6 @@ export declare abstract class PostgresBase extends Dialect {
     sqlTimestamptzLiteral(_qi: QueryInfo, literal: string, timezone: string): string;
     sqlLiteralRecord(_lit: RecordLiteralNode): string;
     sqlLiteralArray(lit: ArrayLiteralNode): string;
-    sqlMaybeQuoteIdentifier(identifier: string): string;
     sqlConvertToCivilTime(expr: string, timezone: string, typeDef: AtomicTypeDef): {
         sql: string;
         typeDef: AtomicTypeDef;

package/dist/dialect/pg_impl.js

@@ -23,6 +23,12 @@ class PostgresBase extends dialect_1.Dialect {
         this.hasTimestamptz = true;
         // Postgres-family dialects use JSON serialization which loses bigint precision
         this.supportsBigIntPrecision = false;
+        // All current Postgres-family dialects (Postgres, DuckDB, Trino, Presto)
+        // use ANSI doubled-quote literal escaping and ANSI double-quote identifiers.
+        // Subclasses may override.
+        this.stringLiteralStyle = dialect_1.EscapeStyle.Doubled;
+        this.identifierEscapeStyle = dialect_1.EscapeStyle.Doubled;
+        this.identifierQuoteChar = '"';
     }
     sqlNowExpr() {
         return 'LOCALTIMESTAMP';
@@ -96,9 +102,6 @@ class PostgresBase extends dialect_1.Dialect {
         const array = lit.kids.values.map(val => val.sql);
         return 'ARRAY[' + array.join(',') + ']';
     }
-    sqlMaybeQuoteIdentifier(identifier) {
-        return '"' + identifier.replace(/"/g, '""') + '"';
-    }
     sqlConvertToCivilTime(expr, timezone, typeDef) {
         // PostgreSQL/DuckDB: AT TIME ZONE is polymorphic
         // For timestamptz (TIMESTAMPTZ): AT TIME ZONE converts to plain TIMESTAMP (civil in timezone)

package/dist/dialect/postgres/postgres.d.ts

@@ -27,7 +27,7 @@ export declare class PostgresDialect extends PostgresBase {
     compoundObjectInSchema: boolean;
     likeEscape: boolean;
     maxIdentifierLength: number;
-    quoteTablePath(tablePath: string): string;
+    tablePathBareIdentRegex: RegExp;
     sqlGroupSetTable(groupSetCount: number): string;
     sqlAnyValue(groupSet: number, fieldName: string): string;
     mapFields(fieldList: DialectFieldList): string;
@@ -52,8 +52,6 @@ export declare class PostgresDialect extends PostgresBase {
     sqlAggDistinct(key: string, values: string[], func: (valNames: string[]) => string): string;
     sqlSampleTable(tableSQL: string, sample: Sampling | undefined): string;
     sqlOrderBy(orderTerms: string[]): string;
-    sqlLiteralString(literal: string): string;
-    sqlLiteralRegexp(literal: string): string;
     getDialectFunctionOverrides(): {
         [name: string]: DialectFunctionOverloadDef[];
     };

package/dist/dialect/postgres/postgres.js

@@ -99,12 +99,9 @@ class PostgresDialect extends pg_impl_1.PostgresBase {
         this.compoundObjectInSchema = false;
         this.likeEscape = false;
         this.maxIdentifierLength = 63;
-    }
-    quoteTablePath(tablePath) {
-        return tablePath
-            .split('.')
-            .map(part => `"${part}"`)
-            .join('.');
+        // Postgres bare-identifier continuation allows `$` (verified against
+        // the live engine: `postgres.table('foo$bar')` resolves successfully).
+        this.tablePathBareIdentRegex = /^[A-Za-z_][A-Za-z0-9_$]*/;
     }
     sqlGroupSetTable(groupSetCount) {
         return `CROSS JOIN GENERATE_SERIES(0,${groupSetCount},1) as group_set`;
@@ -164,7 +161,8 @@ class PostgresDialect extends pg_impl_1.PostgresBase {
             return `(${parentAlias}->>'__row_id')`;
         }
         if (parentType !== 'table') {
-            let ret = `JSONB_EXTRACT_PATH_TEXT(${parentAlias},'${childName}')`;
+            const nameLit = this.sqlLiteralString(childName);
+            let ret = `JSONB_EXTRACT_PATH_TEXT(${parentAlias},${nameLit})`;
             switch (childType) {
                 case 'string':
                     break;
@@ -176,13 +174,13 @@ class PostgresDialect extends pg_impl_1.PostgresBase {
                 case 'record':
                 case 'array[record]':
                 case 'sql native':
-                    ret = `JSONB_EXTRACT_PATH(${parentAlias},'${childName}')`;
+                    ret = `JSONB_EXTRACT_PATH(${parentAlias},${nameLit})`;
                     break;
             }
             return ret;
         }
         else {
-            const child = this.sqlMaybeQuoteIdentifier(childName);
+            const child = this.sqlQuoteIdentifier(childName);
             return `${parentAlias}.${child}`;
         }
     }
@@ -307,12 +305,6 @@ class PostgresDialect extends pg_impl_1.PostgresBase {
     sqlOrderBy(orderTerms) {
         return `ORDER BY ${orderTerms.map(t => `${t} NULLS LAST`).join(',')}`;
     }
-    sqlLiteralString(literal) {
-        return "'" + literal.replace(/'/g, "''") + "'";
-    }
-    sqlLiteralRegexp(literal) {
-        return "'" + literal.replace(/'/g, "''") + "'";
-    }
     getDialectFunctionOverrides() {
         return (0, functions_1.expandOverrideMap)(function_overrides_1.POSTGRES_MALLOY_STANDARD_OVERLOADS);
     }
@@ -372,7 +364,7 @@ class PostgresDialect extends pg_impl_1.PostgresBase {
     sqlLiteralRecord(lit) {
         const props = [];
         for (const [kName, kVal] of Object.entries(lit.kids)) {
-            props.push(`'${kName}',${kVal.sql}`);
+            props.push(`${this.sqlLiteralString(kName)},${kVal.sql}`);
         }
         return `JSONB_BUILD_OBJECT(${props.join(', ')})`;
     }