@panoboard/core 1.11.6 → 1.12.0

package/dist/query/pipeline.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/query/pipeline.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,SAAS,EACT,WAAW,EAGZ,MAAM,qBAAqB,CAAC;AAI7B,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5E,aAAa,CAAC,EAAE,MAAM,CACpB,MAAM,EACN;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAC9D,CAAC;IACF,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAChE;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,UAAU,EACjB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,WAAW,CAAC,CAmCtB"}

package/dist/query/pipeline.js

@@ -1,49 +0,0 @@
-// Copyright 2026 Mataki Labs LLC
-//
-// Licensed under the Business Source License 1.1 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://github.com/panoboard/panoboard/blob/main/LICENSE
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-import { getStrategy } from "./strategy";
-const SORT_DIRECTION_ALLOWLIST = new Set(["ASC", "DESC", "asc", "desc"]);
-/**
- * Orchestrates query execution via the appropriate strategy:
- *   - SQL datasources: template rendering -> array expansion -> connector.query()
- *   - URL datasources: path + params -> connector.query()
- */
-export async function executePanelQuery(query, resolvedParams, connector) {
-    // 0. Validate format-constrained param bindings (e.g. format: "sort_direction")
-    for (const [paramName, binding] of Object.entries(query.params ?? {})) {
-        if (binding.format === "sort_direction") {
-            const value = resolvedParams[paramName];
-            if (value !== undefined && value !== null) {
-                if (!SORT_DIRECTION_ALLOWLIST.has(String(value))) {
-                    throw new Error(`Invalid sort_direction value "${value}" for param "${paramName}". Must be one of: ASC, DESC, asc, desc`);
-                }
-            }
-        }
-    }
-    const strategy = getStrategy(connector.type);
-    const request = strategy.prepare(query, resolvedParams);
-    // For URL queries, pass panel-level columns via options so the connector can use them for parsing
-    const options = query.columns
-        ? {
-            panelColumns: query.columns.map((c) => ({
-                name: c.name,
-                type: (c.type === "integer"
-                    ? "number"
-                    : c.type),
-                nullable: c.nullable ?? true,
-            })),
-        }
-        : undefined;
-    return strategy.execute(connector, request, options);
-}
-//# sourceMappingURL=pipeline.js.map

package/dist/query/pipeline.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/query/pipeline.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQzC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAazE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAiB,EACjB,cAAuC,EACvC,SAAoB;IAEpB,gFAAgF;IAChF,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,gBAAgB,SAAS,yCAAyC,CACzG,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAC9B,KAAgC,EAChC,cAAc,CACf,CAAC;IAEF,kGAAkG;IAClG,MAAM,OAAO,GAA6B,KAAK,CAAC,OAAO;QACrD,CAAC,CAAC;YACE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;oBACzB,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,CAAC,CAAC,IAAI,CAAuB;gBACjC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;aAC7B,CAAC,CAAC;SACJ;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC"}

package/dist/query/strategy/http.d.ts

@@ -1,7 +0,0 @@
-import type { QueryStrategy } from "./types";
-import type { QueryRequest, Connector, QueryResult, QueryOptions } from "../../connectors/types";
-export declare class HttpStrategy implements QueryStrategy {
-    prepare(query: Record<string, unknown>, resolvedParams: Record<string, unknown>): QueryRequest;
-    execute(connector: Connector, request: QueryRequest, options?: QueryOptions): Promise<QueryResult>;
-}
-//# sourceMappingURL=http.d.ts.map

package/dist/query/strategy/http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/query/strategy/http.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACb,MAAM,wBAAwB,CAAC;AAEhC,qBAAa,YAAa,YAAW,aAAa;IAChD,OAAO,CACL,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,YAAY;IAUT,OAAO,CACX,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC;CAGxB"}

package/dist/query/strategy/http.js

@@ -1,26 +0,0 @@
-// Copyright 2026 Mataki Labs LLC
-//
-// Licensed under the Business Source License 1.1 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://github.com/panoboard/panoboard/blob/main/LICENSE
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-export class HttpStrategy {
-    prepare(query, resolvedParams) {
-        const path = query.path;
-        if (!path) {
-            throw new Error("HttpStrategy requires a 'path' field in the query definition");
-        }
-        return { type: "http", path, params: { ...resolvedParams } };
-    }
-    async execute(connector, request, options) {
-        return connector.query(request, options);
-    }
-}
-//# sourceMappingURL=http.js.map

package/dist/query/strategy/http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/query/strategy/http.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAUjC,MAAM,OAAO,YAAY;IACvB,OAAO,CACL,KAA8B,EAC9B,cAAuC;QAEvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAA0B,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CACX,SAAoB,EACpB,OAAqB,EACrB,OAAsB;QAEtB,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/query/strategy/index.d.ts

@@ -1,4 +0,0 @@
-import type { DatasourceType } from "../../connectors/types";
-import type { QueryStrategy } from "./types";
-export declare function getStrategy(type: DatasourceType): QueryStrategy;
-//# sourceMappingURL=index.d.ts.map

package/dist/query/strategy/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/query/strategy/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAO7C,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAa/D"}

package/dist/query/strategy/index.js

@@ -1,32 +0,0 @@
-// Copyright 2026 Mataki Labs LLC
-//
-// Licensed under the Business Source License 1.1 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://github.com/panoboard/panoboard/blob/main/LICENSE
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-import { SqlStrategy } from "./sql";
-import { HttpStrategy } from "./http";
-const sqlStrategy = new SqlStrategy();
-const httpStrategy = new HttpStrategy();
-export function getStrategy(type) {
-    switch (type) {
-        case "postgres":
-        case "bigquery":
-        case "redshift":
-        case "redshift-data":
-        case "snowflake":
-            return sqlStrategy;
-        case "url":
-            return httpStrategy;
-        default:
-            throw new Error(`No strategy for datasource type: ${type}`);
-    }
-}
-//# sourceMappingURL=index.js.map

package/dist/query/strategy/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/query/strategy/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAIjC,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;AAExC,MAAM,UAAU,WAAW,CAAC,IAAoB;IAC9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,eAAe,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,YAAY,CAAC;QACtB;YACE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC"}

package/dist/query/strategy/sql.d.ts

@@ -1,7 +0,0 @@
-import type { QueryStrategy } from "./types";
-import type { QueryRequest, Connector, QueryResult, QueryOptions } from "../../connectors/types";
-export declare class SqlStrategy implements QueryStrategy {
-    prepare(query: Record<string, unknown>, resolvedParams: Record<string, unknown>): QueryRequest;
-    execute(connector: Connector, request: QueryRequest, options?: QueryOptions): Promise<QueryResult>;
-}
-//# sourceMappingURL=sql.d.ts.map

package/dist/query/strategy/sql.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../../src/query/strategy/sql.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACb,MAAM,wBAAwB,CAAC;AAIhC,qBAAa,WAAY,YAAW,aAAa;IAC/C,OAAO,CACL,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,YAAY;IAgCT,OAAO,CACX,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC;CAGxB"}

package/dist/query/strategy/sql.js

@@ -1,40 +0,0 @@
-// Copyright 2026 Mataki Labs LLC
-//
-// Licensed under the Business Source License 1.1 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://github.com/panoboard/panoboard/blob/main/LICENSE
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-import { renderTemplate } from "../template";
-import { expandArrayParams } from "../array-expansion";
-export class SqlStrategy {
-    prepare(query, resolvedParams) {
-        const sql = query.sql;
-        if (!sql) {
-            throw new Error("SqlStrategy requires a 'sql' field in the query definition");
-        }
-        const templateVars = (query.template_vars ?? {});
-        const resolvedVarValues = {};
-        for (const [name, def] of Object.entries(templateVars)) {
-            if (def.from_filter && resolvedParams[def.from_filter] !== undefined) {
-                resolvedVarValues[name] = String(resolvedParams[def.from_filter]);
-            }
-            else if (def.value) {
-                resolvedVarValues[name] = def.value;
-            }
-        }
-        const renderedSql = renderTemplate(sql, templateVars, resolvedVarValues, resolvedParams);
-        const expanded = expandArrayParams(renderedSql, resolvedParams);
-        return { type: "sql", sql: expanded.sql, params: expanded.params };
-    }
-    async execute(connector, request, options) {
-        return connector.query(request, options);
-    }
-}
-//# sourceMappingURL=sql.js.map

package/dist/query/strategy/sql.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sql.js","sourceRoot":"","sources":["../../../src/query/strategy/sql.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AASjC,OAAO,EAAE,cAAc,EAAoB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,OAAO,WAAW;IACtB,OAAO,CACL,KAA8B,EAC9B,cAAuC;QAEvC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAyB,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAG9C,CAAC;QAEF,MAAM,iBAAiB,GAA2B,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,IAAI,GAAG,CAAC,WAAW,IAAI,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrE,iBAAiB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;YACpE,CAAC;iBAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACrB,iBAAiB,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;YACtC,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAChC,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,cAAc,CACf,CAAC;QACF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAEhE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,SAAoB,EACpB,OAAqB,EACrB,OAAsB;QAEtB,OAAO,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/query/strategy/types.d.ts

@@ -1,6 +0,0 @@
-import type { QueryRequest, Connector, QueryResult, QueryOptions } from "../../connectors/types";
-export interface QueryStrategy {
-    prepare(query: Record<string, unknown>, resolvedParams: Record<string, unknown>): QueryRequest;
-    execute(connector: Connector, request: QueryRequest, options?: QueryOptions): Promise<QueryResult>;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/query/strategy/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/query/strategy/types.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACb,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,aAAa;IAC5B,OAAO,CACL,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,YAAY,CAAC;IAChB,OAAO,CACL,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,YAAY,EACrB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAAC;CACzB"}

package/dist/query/strategy/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/query/strategy/types.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC"}

package/dist/query/template.d.ts

@@ -1,7 +0,0 @@
-export interface TemplateVar {
-    allowlist: string[];
-    from_filter?: string;
-    value?: string;
-}
-export declare function renderTemplate(sql: string, templateVars: Record<string, TemplateVar>, resolvedVarValues: Record<string, string>, params: Record<string, unknown>): string;
-//# sourceMappingURL=template.d.ts.map

package/dist/query/template.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/query/template.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACzC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAgCR"}

package/dist/query/template.js

@@ -1,43 +0,0 @@
-// Copyright 2026 Mataki Labs LLC
-//
-// Licensed under the Business Source License 1.1 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://github.com/panoboard/panoboard/blob/main/LICENSE
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-import nunjucks from "nunjucks";
-const env = new nunjucks.Environment(null, { autoescape: false });
-const PARAMS_INTERPOLATION_RE = /\{\{-?\s*params\./;
-export function renderTemplate(sql, templateVars, resolvedVarValues, params) {
-    // Guard: reject direct param interpolation — this bypasses parameterization
-    if (PARAMS_INTERPOLATION_RE.test(sql)) {
-        throw new Error("SQL template directly interpolates a query parameter via {{ params.X }}. " +
-            "This bypasses parameterized queries and is a SQL injection risk. " +
-            "Use a bound parameter (:param_name) in the SQL and declare it under query.params instead.");
-    }
-    // 1. Validate each template var value against its allowlist
-    for (const [name, def] of Object.entries(templateVars)) {
-        const value = resolvedVarValues[name];
-        if (value === undefined && def.value) {
-            // Use the hardcoded default value
-            resolvedVarValues[name] = def.value;
-        }
-        const finalValue = resolvedVarValues[name];
-        if (finalValue !== undefined && !def.allowlist.includes(finalValue)) {
-            throw new Error(`Template variable '${name}' value '${finalValue}' is not in the allowlist: [${def.allowlist.join(", ")}]`);
-        }
-    }
-    // 2. Render with Nunjucks -- context contains only declared template vars and params
-    const context = {
-        ...resolvedVarValues,
-        params, // for {% if params.x %} conditional blocks
-    };
-    return env.renderString(sql, context);
-}
-//# sourceMappingURL=template.js.map

package/dist/query/template.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"template.js","sourceRoot":"","sources":["../../src/query/template.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAElE,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAQpD,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,YAAyC,EACzC,iBAAyC,EACzC,MAA+B;IAE/B,4EAA4E;IAC5E,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,mEAAmE;YACnE,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACrC,kCAAkC;YAClC,iBAAiB,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC;QACtC,CAAC;QACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,YAAY,UAAU,+BAA+B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,OAAO,GAAG;QACd,GAAG,iBAAiB;QACpB,MAAM,EAAE,2CAA2C;KACpD,CAAC;IAEF,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC"}

package/dist/startup/index.d.ts

@@ -1,5 +0,0 @@
-export { lintDashboardQueries } from "./sql-lint";
-export type { SqlLintError } from "./sql-lint";
-export { checkParamInterpolation } from "./sentinel-check";
-export type { ParamInterpolationViolation } from "./sentinel-check";
-//# sourceMappingURL=index.d.ts.map

package/dist/startup/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/startup/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,YAAY,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/startup/index.js

@@ -1,16 +0,0 @@
-// Copyright 2026 Mataki Labs LLC
-//
-// Licensed under the Business Source License 1.1 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://github.com/panoboard/panoboard/blob/main/LICENSE
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-export { lintDashboardQueries } from "./sql-lint";
-export { checkParamInterpolation } from "./sentinel-check";
-//# sourceMappingURL=index.js.map

package/dist/startup/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/startup/index.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/startup/sentinel-check.d.ts

@@ -1,12 +0,0 @@
-import type { Dashboard } from "../schemas/dashboard";
-export interface ParamInterpolationViolation {
-    slug: string;
-    panelId: string;
-    paramName: string;
-}
-/**
- * Check all panel SQL queries for direct param interpolation.
- * Returns one violation per (slug, panelId, paramName) combination found.
- */
-export declare function checkParamInterpolation(dashboards: Map<string, Dashboard>): ParamInterpolationViolation[];
-//# sourceMappingURL=sentinel-check.d.ts.map

package/dist/startup/sentinel-check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sentinel-check.d.ts","sourceRoot":"","sources":["../../src/startup/sentinel-check.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,SAAS,EAAuB,MAAM,sBAAsB,CAAC;AAI3E,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AA8CD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,GACjC,2BAA2B,EAAE,CA0E/B"}

package/dist/startup/sentinel-check.js

@@ -1,142 +0,0 @@
-// Copyright 2026 Mataki Labs LLC
-//
-// Licensed under the Business Source License 1.1 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://github.com/panoboard/panoboard/blob/main/LICENSE
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-/**
- * Sentinel-based param interpolation check.
- *
- * For each panel query that has params, this check injects symbol-only sentinel
- * values (immune to Nunjucks string filters like | upper / | lower) and renders
- * the SQL template directly via Nunjucks. If any sentinel appears in the output,
- * the template is directly interpolating a user-supplied parameter into SQL —
- * a SQL injection risk.
- *
- * Symbol-only alphabet means sentinels survive filters like | upper, | lower,
- * | title, | capitalize, | trim without transformation.
- *
- * Note: We render via Nunjucks directly (bypassing renderTemplate) so that the
- * Task 1 guard — which throws on {{ params.X }} patterns — does not prevent
- * detection. The sentinel check IS the detection mechanism for that pattern.
- */
-import nunjucks from "nunjucks";
-const env = new nunjucks.Environment(null, { autoescape: false });
-/** Alphabet of symbols only — immune to Nunjucks case/trim filters. */
-const SENTINEL_ALPHABET = "@#$%^&!~";
-const SENTINEL_LENGTH = 16;
-function generateSentinel() {
-    let s = "";
-    for (let i = 0; i < SENTINEL_LENGTH; i++) {
-        s += SENTINEL_ALPHABET[Math.floor(Math.random() * SENTINEL_ALPHABET.length)];
-    }
-    return s;
-}
-/**
- * Collect all panels from any dashboard layout:
- * - top-level panels (classic)
- * - section panels (classic with sections)
- * - tab section panels (tabbed)
- */
-function getAllPanels(dashboard) {
-    const panels = [];
-    for (const p of dashboard.panels ?? []) {
-        panels.push(p);
-    }
-    const d = dashboard;
-    for (const section of d.sections ?? []) {
-        for (const p of section.panels) {
-            panels.push(p);
-        }
-    }
-    for (const tab of d.tabs ?? []) {
-        for (const section of tab.sections) {
-            for (const p of section.panels) {
-                panels.push(p);
-            }
-        }
-    }
-    return panels;
-}
-/**
- * Check all panel SQL queries for direct param interpolation.
- * Returns one violation per (slug, panelId, paramName) combination found.
- */
-export function checkParamInterpolation(dashboards) {
-    const violations = [];
-    for (const [slug, dashboard] of dashboards) {
-        for (const panel of getAllPanels(dashboard)) {
-            if (!("query" in panel) || !panel.query)
-                continue;
-            const query = panel.query;
-            if (!("sql" in query) || typeof query.sql !== "string")
-                continue;
-            if (!("params" in query) || !query.params)
-                continue;
-            const params = query.params;
-            const paramNames = Object.keys(params);
-            if (paramNames.length === 0)
-                continue;
-            // Build sentinel map: paramName → unique sentinel value
-            const sentinelMap = new Map(); // paramName → sentinel
-            const sentinelToParam = new Map(); // sentinel → paramName
-            for (const paramName of paramNames) {
-                let sentinel;
-                do {
-                    sentinel = generateSentinel();
-                } while (sentinelToParam.has(sentinel));
-                sentinelMap.set(paramName, sentinel);
-                sentinelToParam.set(sentinel, paramName);
-            }
-            // Build sentinel params object
-            const sentinelParams = {};
-            for (const [paramName, sentinel] of sentinelMap) {
-                sentinelParams[paramName] = sentinel;
-            }
-            // Stub template_vars with first allowlist value or default
-            const templateVars = ("template_vars" in query ? query.template_vars : undefined);
-            const stubVarValues = {};
-            let canRender = true;
-            for (const [varName, varDef] of Object.entries(templateVars ?? {})) {
-                const stubValue = varDef.allowlist[0] ?? varDef.value;
-                if (stubValue === undefined) {
-                    canRender = false;
-                    break;
-                }
-                stubVarValues[varName] = stubValue;
-            }
-            if (!canRender)
-                continue;
-            // Render via Nunjucks directly — bypassing renderTemplate's guard so we
-            // can detect the interpolation pattern ourselves via sentinel scanning.
-            let rendered;
-            try {
-                rendered = env.renderString(query.sql, {
-                    ...stubVarValues,
-                    params: sentinelParams,
-                });
-            }
-            catch {
-                // Unrelated Nunjucks syntax error — skip this panel.
-                // The runtime guard in renderTemplate or sql-lint will surface it.
-                continue;
-            }
-            // Scan rendered SQL for any sentinel
-            for (const [sentinel, paramName] of sentinelToParam) {
-                if (rendered.includes(sentinel)) {
-                    violations.push({ slug, panelId: panel.id, paramName });
-                    break; // one violation per panel is enough
-                }
-            }
-        }
-    }
-    return violations;
-}
-//# sourceMappingURL=sentinel-check.js.map

package/dist/startup/sentinel-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sentinel-check.js","sourceRoot":"","sources":["../../src/startup/sentinel-check.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAGhC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAQlE,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,UAAU,CAAC;AACrC,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,SAAS,gBAAgB;IACvB,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,SAAoB;IACxC,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,GAAG,SAAmD,CAAC;IAE9D,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAkC;IAElC,MAAM,UAAU,GAAkC,EAAE,CAAC;IAErD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,SAAS;YAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBAAE,SAAS;YACjE,IAAI,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,SAAS;YAEpD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAiC,CAAC;YACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEtC,wDAAwD;YACxD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,uBAAuB;YACtE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,uBAAuB;YAC1E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,QAAgB,CAAC;gBACrB,GAAG,CAAC;oBACF,QAAQ,GAAG,gBAAgB,EAAE,CAAC;gBAChC,CAAC,QAAQ,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;gBACxC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACrC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC3C,CAAC;YAED,+BAA+B;YAC/B,MAAM,cAAc,GAA2B,EAAE,CAAC;YAClD,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC;gBAChD,cAAc,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC;YACvC,CAAC;YAED,2DAA2D;YAC3D,MAAM,YAAY,GAAG,CACnB,eAAe,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CACY,CAAC;YAEzE,MAAM,aAAa,GAA2B,EAAE,CAAC;YACjD,IAAI,SAAS,GAAG,IAAI,CAAC;YACrB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;gBACnE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC;gBACtD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;oBAC5B,SAAS,GAAG,KAAK,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,aAAa,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE;oBACrC,GAAG,aAAa;oBAChB,MAAM,EAAE,cAAc;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;gBACrD,mEAAmE;gBACnE,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,eAAe,EAAE,CAAC;gBACpD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAChC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;oBACxD,MAAM,CAAC,oCAAoC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/startup/sql-lint.d.ts

@@ -1,13 +0,0 @@
-import type { Dashboard } from "../schemas/dashboard";
-export interface SqlLintError {
-    dashboardSlug: string;
-    panelId: string;
-    error: string;
-    renderedSql: string;
-}
-/**
- * Lint all panel queries across all dashboards.
- * Returns an array of errors (empty = all clear).
- */
-export declare function lintDashboardQueries(dashboards: Map<string, Dashboard>): SqlLintError[];
-//# sourceMappingURL=sql-lint.d.ts.map

package/dist/startup/sql-lint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sql-lint.d.ts","sourceRoot":"","sources":["../../src/startup/sql-lint.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,GACjC,YAAY,EAAE,CAgChB"}

package/dist/startup/sql-lint.js

@@ -1,87 +0,0 @@
-// Copyright 2026 Mataki Labs LLC
-//
-// Licensed under the Business Source License 1.1 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://github.com/panoboard/panoboard/blob/main/LICENSE
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-/**
- * Deep SQL lint — best-effort static analysis of panel queries.
- *
- * When `startup_checks.deep_sql_lint: true`, each dashboard panel query
- * is rendered with the first allowlist value for each template var, then
- * parsed with node-sql-parser to detect syntax errors.
- *
- * This is best-effort: not all dialect-specific SQL will parse correctly.
- * Bind parameters (:name) are replaced with placeholder values before parsing.
- */
-import nodeSqlParser from "node-sql-parser";
-const { Parser } = nodeSqlParser;
-import { renderTemplate } from "../query/template";
-/**
- * Lint all panel queries across all dashboards.
- * Returns an array of errors (empty = all clear).
- */
-export function lintDashboardQueries(dashboards) {
-    const parser = new Parser();
-    const errors = [];
-    for (const [slug, dashboard] of dashboards) {
-        for (const panel of dashboard.panels ?? []) {
-            if (!("query" in panel) || !panel.query)
-                continue;
-            const query = panel.query;
-            if (!("sql" in query) || !query.sql)
-                continue;
-            const renderedSql = renderSqlForLint(query.sql, "template_vars" in query
-                ? query.template_vars
-                : undefined);
-            const sanitized = replaceBindParams(renderedSql);
-            try {
-                parser.astify(sanitized, { database: "PostgreSQL" });
-            }
-            catch (err) {
-                errors.push({
-                    dashboardSlug: slug,
-                    panelId: panel.id,
-                    error: err instanceof Error ? err.message : String(err),
-                    renderedSql: sanitized,
-                });
-            }
-        }
-    }
-    return errors;
-}
-/**
- * Render template vars using the first allowlist value for each.
- */
-function renderSqlForLint(sql, templateVars) {
-    if (!templateVars || Object.keys(templateVars).length === 0) {
-        return sql;
-    }
-    const resolvedValues = {};
-    for (const [name, def] of Object.entries(templateVars)) {
-        resolvedValues[name] = def.value ?? def.allowlist[0] ?? name;
-    }
-    try {
-        return renderTemplate(sql, templateVars, resolvedValues, {});
-    }
-    catch {
-        // If template rendering fails, return raw SQL
-        return sql;
-    }
-}
-/**
- * Replace :bind_param placeholders with safe literal values
- * so the SQL parser does not choke on them.
- */
-function replaceBindParams(sql) {
-    // Replace :word tokens (but not :: type casts) with '1'
-    return sql.replace(/(?<!:):([a-zA-Z_]\w*)/g, "'1'");
-}
-//# sourceMappingURL=sql-lint.js.map

package/dist/startup/sql-lint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sql-lint.js","sourceRoot":"","sources":["../../src/startup/sql-lint.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC;;;;;;;;;GASG;AAEH,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAoB,MAAM,mBAAmB,CAAC;AASrE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,SAAS;YAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG;gBAAE,SAAS;YAE9C,MAAM,WAAW,GAAG,gBAAgB,CAClC,KAAK,CAAC,GAAG,EACT,eAAe,IAAI,KAAK;gBACtB,CAAC,CAAE,KAAK,CAAC,aAAyD;gBAClE,CAAC,CAAC,SAAS,CACd,CAAC;YACF,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAEjD,IAAI,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACV,aAAa,EAAE,IAAI;oBACnB,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBACvD,WAAW,EAAE,SAAS;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,GAAW,EACX,YAA0C;IAE1C,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,wDAAwD;IACxD,OAAO,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC"}