@mongrov/analytics 0.8.0 → 0.8.2

package/UPGRADING.md

@@ -1,5 +1,27 @@
 # Upgrading
 
+## @mongrov/data-access 0.2.0 → 0.3.0 — bind only referenced placeholders
+
+**Behaviour fix. No API change, but it repairs queries that could never run.**
+
+DuckDB binds parameters by NAME and **rejects** any bound parameter the
+statement does not declare — `Failed to retrieve bind parameter index`. The
+dispatcher injected `brand` / `familyId` / `tz` unconditionally, so every
+query whose SQL omitted one of them failed at bind time.
+
+Three ZivaOne registry queries did exactly that (`spo2.compareBaseline`,
+`spo2.worthALookInsight`, `device.lastSyncedAt` — all use `$userId`,
+`$brand`, `$familyId` but not `$tz`). It went unnoticed because the app's
+`duckdb` adapter routed to Timon and mapped every error to `[]`.
+
+`mergeTenantParams(input, ctx, sql?)` now filters to placeholders the SQL
+actually references. Tenant values still win over caller input, so the
+anti-forgery guarantee is unchanged.
+
+If you assert on the params passed to your engine adapter, expect a smaller
+object — only what the SQL uses.
+
+
 ## 0.7.0 → 0.8.0 — `device_config` firmware contract (Sprint 5 §2, T-02/T-09/T-10)
 
 **Breaking, and it changes both a table and a mapper input type.**

package/dist/core/extensions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../src/core/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,kDAAmD,CAAA;AAEnF;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,6BAA8B,CAAA;AAE3D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAQpE;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,YAAY,EAChB,IAAI,GAAE,aAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAEzE"}
+{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../src/core/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,kDAAmD,CAAA;AAEnF;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,6BAA8B,CAAA;AAE3D,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAQpE;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,YAAY,EAChB,IAAI,GAAE,aAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAEzE"}

package/dist/core/extensions.js

@@ -67,12 +67,31 @@ export async function bootstrapExtensions(db, mode = 'r2') {
         if (booted.has(ext)) {
             continue;
         }
+        // LOAD first, INSTALL only as a fallback.
+        //
+        // A statically linked extension needs no INSTALL, and on mobile the
+        // INSTALL cannot succeed: there is no artifact to fetch. iOS asks for
+        // `http://extensions.duckdb.org/<ver>/ios_arm64/<ext>.duckdb_extension.gz`
+        // and gets a 404, so issuing INSTALL unconditionally made a correctly
+        // built binary fail exactly as loudly as a missing one.
+        //
+        // Ordering it this way keeps both cases working: linked extensions load
+        // straight away, and a desktop build that genuinely needs a download
+        // still gets one from the fallback.
         try {
-            await db.execute(`INSTALL ${ext};`);
             await db.execute(`LOAD ${ext};`);
         }
-        catch (cause) {
-            throw new AnalyticsError('extension_load_failed', `Failed to load DuckDB extension: ${ext}`, cause);
+        catch (loadCause) {
+            try {
+                await db.execute(`INSTALL ${ext};`);
+                await db.execute(`LOAD ${ext};`);
+            }
+            catch {
+                // Report the original LOAD failure: if the extension is meant to be
+                // linked in, "could not load" is the real problem and the INSTALL
+                // 404 is just noise about a fetch that was never going to work.
+                throw new AnalyticsError('extension_load_failed', `Failed to load DuckDB extension: ${ext}`, loadCause);
+            }
         }
         booted.add(ext);
     }

package/dist/core/extensions.js.map

@@ -1 +1 @@
-{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../src/core/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAIzC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAU,CAAA;AAEnF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,CAAU,CAAA;AAI3D;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,OAAO,EAA6B,CAAA;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAgB,EAChB,OAAsB,IAAI;IAE1B,IAAI,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAA;QAClB,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,UAAU,GACZ,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IAE7D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,CAAA;YACnC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CACtB,uBAAuB,EACvB,oCAAoC,GAAG,EAAE,EACzC,KAAK,CACN,CAAA;QACH,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAgB;IAClD,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../src/core/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAIzC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAU,CAAA;AAEnF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,CAAU,CAAA;AAI3D;;;GAGG;AACH,MAAM,UAAU,GAAG,IAAI,OAAO,EAA6B,CAAA;AAE3D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAgB,EAChB,OAAsB,IAAI;IAE1B,IAAI,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAA;QAClB,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC;IAED,MAAM,UAAU,GACZ,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IAE7D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,SAAQ;QACV,CAAC;QACD,0CAA0C;QAC1C,EAAE;QACF,oEAAoE;QACpE,sEAAsE;QACtE,2EAA2E;QAC3E,sEAAsE;QACtE,wDAAwD;QACxD,EAAE;QACF,wEAAwE;QACxE,qEAAqE;QACrE,oCAAoC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,CAAA;gBACnC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAA;YAClC,CAAC;YACD,MAAM,CAAC;gBACL,oEAAoE;gBACpE,kEAAkE;gBAClE,gEAAgE;gBAChE,MAAM,IAAI,cAAc,CACtB,uBAAuB,EACvB,oCAAoC,GAAG,EAAE,EACzC,SAAS,CACV,CAAA;YACH,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAgB;IAClD,OAAO,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAE,CAAA;AACxC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mongrov/analytics",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "sideEffects": false,
   "description": "DuckDB + R2 Iceberg local analytics for @mongrov apps",
   "license": "MIT",
@@ -61,12 +61,12 @@
   ],
   "peerDependencies": {
     "@modelcontextprotocol/sdk": ">=1.20.0",
-    "@mongrov/types": "^0.5.0",
+    "@mongrov/types": "^0.5.1",
     "ai": ">=4",
     "react": ">=19",
     "react-native": ">=0.81",
     "react-native-duckdb": ">=1.0.0",
-    "@mongrov/db": "0.3.0"
+    "@mongrov/db": "^0.3.0"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/sdk": {
@@ -107,8 +107,8 @@
     "typescript": "^5.9.3",
     "vitest": "^2.1.9",
     "zod": "^3.23.8",
-    "@mongrov/db": "0.3.0",
-    "@mongrov/types": "0.5.0"
+    "@mongrov/types": "0.5.1",
+    "@mongrov/db": "0.3.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",