@querypanel/node-sdk 1.3.8 → 1.3.9

package/dist/index.d.cts

@@ -230,6 +230,29 @@ declare class ClickHouseAdapter implements DatabaseAdapter {
     private extractRows;
 }
 
+/** Attach option for schema-per-tenant isolation. */
+interface TenantSchemaConfig {
+    /** Schema name with one `{tenant}` placeholder, e.g. `group_{tenant}_indexed`. */
+    template: string;
+    /** Extra schemas every tenant may read (lookup tables etc.). */
+    sharedSchemas?: string[];
+}
+declare class TenantSchemaError extends Error {
+    constructor(message: string);
+}
+interface ParsedTemplate {
+    prefix: string;
+    suffix: string;
+}
+declare function parseTenantSchemaTemplate(template: string): ParsedTemplate;
+/** The schema a tenant's queries run against. Throws for unsafe tenant ids. */
+declare function resolveTenantSchema(template: string, tenantId: string): string;
+/**
+ * Rewrite every template-schema qualifier to the tenant's schema. Fails closed when
+ * another tenant's schema is still named anywhere (strings and comments included).
+ */
+declare function rewriteTenantSchema(sql: string, template: string, tenantId: string): string;
+
 interface PostgresQueryResult {
     rows: Array<Record<string, unknown>>;
     fields: Array<{
@@ -257,6 +280,12 @@ interface PostgresAdapterOptions {
      * to these tables only.
      */
     allowedTables?: string[];
+    /**
+     * Schema-per-tenant connection: SQL has been rewritten to the caller's tenant
+     * schema, so queries may read any schema the template produces (or the tables
+     * `allowedTables` names in it) plus `sharedSchemas`, and nothing else.
+     */
+    tenantSchema?: TenantSchemaConfig;
 }
 /**
  * Simplified PostgreSQL adapter following IngestRequest format
@@ -270,6 +299,8 @@ declare class PostgresAdapter implements DatabaseAdapter {
     private readonly kind;
     private readonly dialect;
     private readonly allowedTables?;
+    /** Undefined when queries are unrestricted. */
+    private readonly allowsRelation?;
     constructor(clientFn: PostgresClientFn, options?: PostgresAdapterOptions);
     execute(sql: string, params?: Record<string, string | number | boolean | string[] | number[]>): Promise<DatabaseExecutionResult>;
     private validateQueryTables;
@@ -1327,6 +1358,16 @@ declare function mapGeneratedParams(params: Array<Record<string, unknown>>): Par
  */
 declare function normalizeSqlParamsInput(params: unknown[] | Record<string, unknown> | null | undefined): ParamRecord;
 
+/** Schema-per-tenant option for attachPostgres / attachRedshift (instead of tenantFieldName). */
+interface TenantSchemaAttachOptions {
+    /**
+     * Each tenant has its own schema, e.g. `{ template: "group_{tenant}_indexed" }`.
+     * SQL naming any schema the template produces runs against the caller's tenant
+     * schema, and only that schema (plus `sharedSchemas`) may be read.
+     */
+    tenantSchema?: TenantSchemaConfig;
+}
+
 /** Options when constructing the SDK with HTTP (default) or with a custom API implementation. */
 interface QueryPanelSdkAPIOptions {
     defaultTenantId?: string;
@@ -1406,7 +1447,7 @@ declare class QueryPanelSdkAPI {
         tenantFieldName?: string;
         tenantFieldType?: string;
         enforceTenantIsolation?: boolean;
-    }): void;
+    } & TenantSchemaAttachOptions): void;
     /**
      * Attach an Amazon Redshift database. Redshift speaks the Postgres wire
      * protocol, so `clientFn` can wrap a `pg` client; introspection uses
@@ -1418,7 +1459,7 @@ declare class QueryPanelSdkAPI {
         tenantFieldName?: string;
         tenantFieldType?: string;
         enforceTenantIsolation?: boolean;
-    }): void;
+    } & TenantSchemaAttachOptions): void;
     attachBigQuery(name: string, clientFn: BigQueryClientFn, options: BigQueryAdapterOptions & {
         description?: string;
         tags?: string[];
@@ -2193,4 +2234,4 @@ declare class QueryPanelSdkAPI {
     }, signal?: AbortSignal): Promise<SdkDashboard[]>;
 }
 
-export { ALL_VIZ_CHART_TYPES, type ActiveChartBulkGetResponse, type ActiveChartCreateInput, type ActiveChartListOptions, type ActiveChartUpdateInput, type AggregateOp, type AskOptions, type AskResponse, type AxisField, type AxisFieldInput, BigQueryAdapter, type BigQueryAdapterOptions, type BigQueryClientFn, type BigQueryQueryRequest, type BigQueryQueryResult, CallbackApiClient, type CatalogSchema, type CatalogTable, type CatalogTableType, type ChartBulkGetResponse, type ChartCreateInput, type ChartEncoding, type ChartEnvelope, type ChartListAllOptions, type ChartListOptions, type ChartModifyInput, type ChartModifyOptions, type ChartModifyResponse, type ChartSpec, type ChartType, type ChartUpdateInput, ClickHouseAdapter, type ClickHouseAdapterOptions, type ClickHouseClientFn, type ContextDocument, type DashboardCreateInput, type DashboardForkInput, type DashboardForkUpdateInput, type DashboardListOptions, type DashboardUpdateInput, type DatabaseAdapter, type DatabaseDialect, type DateRangeInput, type EncodingHints, type FieldRef, type FieldRefInput, type FieldType, type IQueryPanelApi, type IngestResponse, type IntentResult, type ListTablesOptions, type MapEncoding, type MapLocation, type MapLocationMode, type MapSpec, type MetricEncoding, type MetricField, type MetricSpec, type PaginatedResponse$1 as PaginatedResponse, type PaginationInfo$1 as PaginationInfo, type PaginationQuery$1 as PaginationQuery, type ParamRecord, type ParamValue, type PipelineTrace, PostgresAdapter, type PostgresAdapterOptions, type PostgresClientFn, type PostgresWireDialect, QueryErrorCode, QueryErrorCode as QueryErrorCodeType, QueryPanelSdkAPI, type QueryPanelSdkAPIOptions, QueryPipelineError, type RequestHandler, type RequestHandlerOptions, type RequestHandlerResult, type SchemaIngestBatchEmbedResponse, type SchemaIngestRequestOptions, type SchemaIntrospection, type SchemaSyncOptions, type SchemaSyncProgressEvent, SchemaTooLargeError, type SdkActiveChart, type SdkChart, type SdkDashboard, type SdkSession, type SdkSessionTurn, type SessionGetOptions, type SessionListOptions, type SessionUpdateInput, type SqlModifications, type StackingMode, type StageSchemaIngestOptions, type StageSchemaIngestResult, type SyncSchemaInBatchesOptions, type TableColumn, type TableEncoding, type TableSpec, type TimeUnit, type ValueFormat, type VizModifications, type VizSpec, type VizSpecGenerateInput, type VizSpecGenerateOptions, type VizSpecGeneratorInput, type VizSpecKind, type VizSpecResponse, type VizSpecResult, anonymizeResults, mapGeneratedParams, normalizeSqlParamsInput, resolveQueryPipeline };
+export { ALL_VIZ_CHART_TYPES, type ActiveChartBulkGetResponse, type ActiveChartCreateInput, type ActiveChartListOptions, type ActiveChartUpdateInput, type AggregateOp, type AskOptions, type AskResponse, type AxisField, type AxisFieldInput, BigQueryAdapter, type BigQueryAdapterOptions, type BigQueryClientFn, type BigQueryQueryRequest, type BigQueryQueryResult, CallbackApiClient, type CatalogSchema, type CatalogTable, type CatalogTableType, type ChartBulkGetResponse, type ChartCreateInput, type ChartEncoding, type ChartEnvelope, type ChartListAllOptions, type ChartListOptions, type ChartModifyInput, type ChartModifyOptions, type ChartModifyResponse, type ChartSpec, type ChartType, type ChartUpdateInput, ClickHouseAdapter, type ClickHouseAdapterOptions, type ClickHouseClientFn, type ContextDocument, type DashboardCreateInput, type DashboardForkInput, type DashboardForkUpdateInput, type DashboardListOptions, type DashboardUpdateInput, type DatabaseAdapter, type DatabaseDialect, type DateRangeInput, type EncodingHints, type FieldRef, type FieldRefInput, type FieldType, type IQueryPanelApi, type IngestResponse, type IntentResult, type ListTablesOptions, type MapEncoding, type MapLocation, type MapLocationMode, type MapSpec, type MetricEncoding, type MetricField, type MetricSpec, type PaginatedResponse$1 as PaginatedResponse, type PaginationInfo$1 as PaginationInfo, type PaginationQuery$1 as PaginationQuery, type ParamRecord, type ParamValue, type PipelineTrace, PostgresAdapter, type PostgresAdapterOptions, type PostgresClientFn, type PostgresWireDialect, QueryErrorCode, QueryErrorCode as QueryErrorCodeType, QueryPanelSdkAPI, type QueryPanelSdkAPIOptions, QueryPipelineError, type RequestHandler, type RequestHandlerOptions, type RequestHandlerResult, type SchemaIngestBatchEmbedResponse, type SchemaIngestRequestOptions, type SchemaIntrospection, type SchemaSyncOptions, type SchemaSyncProgressEvent, SchemaTooLargeError, type SdkActiveChart, type SdkChart, type SdkDashboard, type SdkSession, type SdkSessionTurn, type SessionGetOptions, type SessionListOptions, type SessionUpdateInput, type SqlModifications, type StackingMode, type StageSchemaIngestOptions, type StageSchemaIngestResult, type SyncSchemaInBatchesOptions, type TableColumn, type TableEncoding, type TableSpec, type TenantSchemaAttachOptions, type TenantSchemaConfig, TenantSchemaError, type TimeUnit, type ValueFormat, type VizModifications, type VizSpec, type VizSpecGenerateInput, type VizSpecGenerateOptions, type VizSpecGeneratorInput, type VizSpecKind, type VizSpecResponse, type VizSpecResult, anonymizeResults, mapGeneratedParams, normalizeSqlParamsInput, parseTenantSchemaTemplate, resolveQueryPipeline, resolveTenantSchema, rewriteTenantSchema };

package/dist/index.d.ts

@@ -230,6 +230,29 @@ declare class ClickHouseAdapter implements DatabaseAdapter {
     private extractRows;
 }
 
+/** Attach option for schema-per-tenant isolation. */
+interface TenantSchemaConfig {
+    /** Schema name with one `{tenant}` placeholder, e.g. `group_{tenant}_indexed`. */
+    template: string;
+    /** Extra schemas every tenant may read (lookup tables etc.). */
+    sharedSchemas?: string[];
+}
+declare class TenantSchemaError extends Error {
+    constructor(message: string);
+}
+interface ParsedTemplate {
+    prefix: string;
+    suffix: string;
+}
+declare function parseTenantSchemaTemplate(template: string): ParsedTemplate;
+/** The schema a tenant's queries run against. Throws for unsafe tenant ids. */
+declare function resolveTenantSchema(template: string, tenantId: string): string;
+/**
+ * Rewrite every template-schema qualifier to the tenant's schema. Fails closed when
+ * another tenant's schema is still named anywhere (strings and comments included).
+ */
+declare function rewriteTenantSchema(sql: string, template: string, tenantId: string): string;
+
 interface PostgresQueryResult {
     rows: Array<Record<string, unknown>>;
     fields: Array<{
@@ -257,6 +280,12 @@ interface PostgresAdapterOptions {
      * to these tables only.
      */
     allowedTables?: string[];
+    /**
+     * Schema-per-tenant connection: SQL has been rewritten to the caller's tenant
+     * schema, so queries may read any schema the template produces (or the tables
+     * `allowedTables` names in it) plus `sharedSchemas`, and nothing else.
+     */
+    tenantSchema?: TenantSchemaConfig;
 }
 /**
  * Simplified PostgreSQL adapter following IngestRequest format
@@ -270,6 +299,8 @@ declare class PostgresAdapter implements DatabaseAdapter {
     private readonly kind;
     private readonly dialect;
     private readonly allowedTables?;
+    /** Undefined when queries are unrestricted. */
+    private readonly allowsRelation?;
     constructor(clientFn: PostgresClientFn, options?: PostgresAdapterOptions);
     execute(sql: string, params?: Record<string, string | number | boolean | string[] | number[]>): Promise<DatabaseExecutionResult>;
     private validateQueryTables;
@@ -1327,6 +1358,16 @@ declare function mapGeneratedParams(params: Array<Record<string, unknown>>): Par
  */
 declare function normalizeSqlParamsInput(params: unknown[] | Record<string, unknown> | null | undefined): ParamRecord;
 
+/** Schema-per-tenant option for attachPostgres / attachRedshift (instead of tenantFieldName). */
+interface TenantSchemaAttachOptions {
+    /**
+     * Each tenant has its own schema, e.g. `{ template: "group_{tenant}_indexed" }`.
+     * SQL naming any schema the template produces runs against the caller's tenant
+     * schema, and only that schema (plus `sharedSchemas`) may be read.
+     */
+    tenantSchema?: TenantSchemaConfig;
+}
+
 /** Options when constructing the SDK with HTTP (default) or with a custom API implementation. */
 interface QueryPanelSdkAPIOptions {
     defaultTenantId?: string;
@@ -1406,7 +1447,7 @@ declare class QueryPanelSdkAPI {
         tenantFieldName?: string;
         tenantFieldType?: string;
         enforceTenantIsolation?: boolean;
-    }): void;
+    } & TenantSchemaAttachOptions): void;
     /**
      * Attach an Amazon Redshift database. Redshift speaks the Postgres wire
      * protocol, so `clientFn` can wrap a `pg` client; introspection uses
@@ -1418,7 +1459,7 @@ declare class QueryPanelSdkAPI {
         tenantFieldName?: string;
         tenantFieldType?: string;
         enforceTenantIsolation?: boolean;
-    }): void;
+    } & TenantSchemaAttachOptions): void;
     attachBigQuery(name: string, clientFn: BigQueryClientFn, options: BigQueryAdapterOptions & {
         description?: string;
         tags?: string[];
@@ -2193,4 +2234,4 @@ declare class QueryPanelSdkAPI {
     }, signal?: AbortSignal): Promise<SdkDashboard[]>;
 }
 
-export { ALL_VIZ_CHART_TYPES, type ActiveChartBulkGetResponse, type ActiveChartCreateInput, type ActiveChartListOptions, type ActiveChartUpdateInput, type AggregateOp, type AskOptions, type AskResponse, type AxisField, type AxisFieldInput, BigQueryAdapter, type BigQueryAdapterOptions, type BigQueryClientFn, type BigQueryQueryRequest, type BigQueryQueryResult, CallbackApiClient, type CatalogSchema, type CatalogTable, type CatalogTableType, type ChartBulkGetResponse, type ChartCreateInput, type ChartEncoding, type ChartEnvelope, type ChartListAllOptions, type ChartListOptions, type ChartModifyInput, type ChartModifyOptions, type ChartModifyResponse, type ChartSpec, type ChartType, type ChartUpdateInput, ClickHouseAdapter, type ClickHouseAdapterOptions, type ClickHouseClientFn, type ContextDocument, type DashboardCreateInput, type DashboardForkInput, type DashboardForkUpdateInput, type DashboardListOptions, type DashboardUpdateInput, type DatabaseAdapter, type DatabaseDialect, type DateRangeInput, type EncodingHints, type FieldRef, type FieldRefInput, type FieldType, type IQueryPanelApi, type IngestResponse, type IntentResult, type ListTablesOptions, type MapEncoding, type MapLocation, type MapLocationMode, type MapSpec, type MetricEncoding, type MetricField, type MetricSpec, type PaginatedResponse$1 as PaginatedResponse, type PaginationInfo$1 as PaginationInfo, type PaginationQuery$1 as PaginationQuery, type ParamRecord, type ParamValue, type PipelineTrace, PostgresAdapter, type PostgresAdapterOptions, type PostgresClientFn, type PostgresWireDialect, QueryErrorCode, QueryErrorCode as QueryErrorCodeType, QueryPanelSdkAPI, type QueryPanelSdkAPIOptions, QueryPipelineError, type RequestHandler, type RequestHandlerOptions, type RequestHandlerResult, type SchemaIngestBatchEmbedResponse, type SchemaIngestRequestOptions, type SchemaIntrospection, type SchemaSyncOptions, type SchemaSyncProgressEvent, SchemaTooLargeError, type SdkActiveChart, type SdkChart, type SdkDashboard, type SdkSession, type SdkSessionTurn, type SessionGetOptions, type SessionListOptions, type SessionUpdateInput, type SqlModifications, type StackingMode, type StageSchemaIngestOptions, type StageSchemaIngestResult, type SyncSchemaInBatchesOptions, type TableColumn, type TableEncoding, type TableSpec, type TimeUnit, type ValueFormat, type VizModifications, type VizSpec, type VizSpecGenerateInput, type VizSpecGenerateOptions, type VizSpecGeneratorInput, type VizSpecKind, type VizSpecResponse, type VizSpecResult, anonymizeResults, mapGeneratedParams, normalizeSqlParamsInput, resolveQueryPipeline };
+export { ALL_VIZ_CHART_TYPES, type ActiveChartBulkGetResponse, type ActiveChartCreateInput, type ActiveChartListOptions, type ActiveChartUpdateInput, type AggregateOp, type AskOptions, type AskResponse, type AxisField, type AxisFieldInput, BigQueryAdapter, type BigQueryAdapterOptions, type BigQueryClientFn, type BigQueryQueryRequest, type BigQueryQueryResult, CallbackApiClient, type CatalogSchema, type CatalogTable, type CatalogTableType, type ChartBulkGetResponse, type ChartCreateInput, type ChartEncoding, type ChartEnvelope, type ChartListAllOptions, type ChartListOptions, type ChartModifyInput, type ChartModifyOptions, type ChartModifyResponse, type ChartSpec, type ChartType, type ChartUpdateInput, ClickHouseAdapter, type ClickHouseAdapterOptions, type ClickHouseClientFn, type ContextDocument, type DashboardCreateInput, type DashboardForkInput, type DashboardForkUpdateInput, type DashboardListOptions, type DashboardUpdateInput, type DatabaseAdapter, type DatabaseDialect, type DateRangeInput, type EncodingHints, type FieldRef, type FieldRefInput, type FieldType, type IQueryPanelApi, type IngestResponse, type IntentResult, type ListTablesOptions, type MapEncoding, type MapLocation, type MapLocationMode, type MapSpec, type MetricEncoding, type MetricField, type MetricSpec, type PaginatedResponse$1 as PaginatedResponse, type PaginationInfo$1 as PaginationInfo, type PaginationQuery$1 as PaginationQuery, type ParamRecord, type ParamValue, type PipelineTrace, PostgresAdapter, type PostgresAdapterOptions, type PostgresClientFn, type PostgresWireDialect, QueryErrorCode, QueryErrorCode as QueryErrorCodeType, QueryPanelSdkAPI, type QueryPanelSdkAPIOptions, QueryPipelineError, type RequestHandler, type RequestHandlerOptions, type RequestHandlerResult, type SchemaIngestBatchEmbedResponse, type SchemaIngestRequestOptions, type SchemaIntrospection, type SchemaSyncOptions, type SchemaSyncProgressEvent, SchemaTooLargeError, type SdkActiveChart, type SdkChart, type SdkDashboard, type SdkSession, type SdkSessionTurn, type SessionGetOptions, type SessionListOptions, type SessionUpdateInput, type SqlModifications, type StackingMode, type StageSchemaIngestOptions, type StageSchemaIngestResult, type SyncSchemaInBatchesOptions, type TableColumn, type TableEncoding, type TableSpec, type TenantSchemaAttachOptions, type TenantSchemaConfig, TenantSchemaError, type TimeUnit, type ValueFormat, type VizModifications, type VizSpec, type VizSpecGenerateInput, type VizSpecGenerateOptions, type VizSpecGeneratorInput, type VizSpecKind, type VizSpecResponse, type VizSpecResult, anonymizeResults, mapGeneratedParams, normalizeSqlParamsInput, parseTenantSchemaTemplate, resolveQueryPipeline, resolveTenantSchema, rewriteTenantSchema };

package/dist/index.js

@@ -581,6 +581,248 @@ function toNumber(value) {
   return Number.isNaN(parsed) ? void 0 : parsed;
 }
 
+// src/core/sql-relations.ts
+function tokenize(sql) {
+  const tokens = [];
+  let i = 0;
+  while (i < sql.length) {
+    const ch = sql[i];
+    const next = sql[i + 1];
+    if (/\s/.test(ch)) {
+      i++;
+    } else if (ch === "-" && next === "-") {
+      while (i < sql.length && sql[i] !== "\n") i++;
+    } else if (ch === "/" && next === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      i = end < 0 ? sql.length : end + 2;
+    } else if (ch === "'") {
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === "\\") i += 2;
+        else if (sql[i] === "'" && sql[i + 1] === "'") i += 2;
+        else if (sql[i] === "'") break;
+        else i++;
+      }
+      i++;
+    } else if (ch === "$" && /[A-Za-z_$]/.test(next ?? "")) {
+      const tag = /^\$[A-Za-z_]*\$/.exec(sql.slice(i))?.[0];
+      if (tag) {
+        const end = sql.indexOf(tag, i + tag.length);
+        i = end < 0 ? sql.length : end + tag.length;
+      } else {
+        i++;
+      }
+    } else if (ch === '"') {
+      const start = i;
+      let text = "";
+      i++;
+      while (i < sql.length) {
+        if (sql[i] === '"' && sql[i + 1] === '"') {
+          text += '"';
+          i += 2;
+        } else if (sql[i] === '"') break;
+        else text += sql[i++];
+      }
+      i++;
+      tokens.push({ kind: "word", text, quoted: true, start, end: i });
+    } else if (/[A-Za-z_]/.test(ch)) {
+      const start = i;
+      while (i < sql.length && /[A-Za-z0-9_$]/.test(sql[i])) i++;
+      tokens.push({ kind: "word", text: sql.slice(start, i), quoted: false, start, end: i });
+    } else if (/[0-9]/.test(ch)) {
+      while (i < sql.length && /[0-9.eE]/.test(sql[i])) i++;
+    } else {
+      tokens.push({ kind: "punct", text: ch, start: i, end: i + 1 });
+      i++;
+    }
+  }
+  return tokens;
+}
+var identifier = (t) => t?.kind === "word" ? t.quoted ? t.text : t.text.toLowerCase() : void 0;
+var isKeyword = (t, word) => t?.kind === "word" && !t.quoted && t.text.toLowerCase() === word;
+var isPunct = (t, p) => t?.kind === "punct" && t.text === p;
+var CLAUSE_WORDS = /* @__PURE__ */ new Set([
+  "where",
+  "group",
+  "order",
+  "limit",
+  "having",
+  "union",
+  "intersect",
+  "except",
+  "join",
+  "inner",
+  "left",
+  "right",
+  "full",
+  "cross",
+  "natural",
+  "on",
+  "using",
+  "window",
+  "qualify",
+  "offset",
+  "fetch",
+  "for",
+  "lateral",
+  "as"
+]);
+var FROM_CLAUSE_END = /* @__PURE__ */ new Set([
+  "where",
+  "group",
+  "having",
+  "order",
+  "limit",
+  "offset",
+  "fetch",
+  "union",
+  "intersect",
+  "except",
+  "window",
+  "qualify",
+  "for",
+  "returning"
+]);
+function cteNames(tokens) {
+  const names = /* @__PURE__ */ new Set();
+  for (let k = 0; k + 2 < tokens.length; k++) {
+    const value = identifier(tokens[k]);
+    if (!value) continue;
+    if (isKeyword(tokens[k + 1], "as") && isPunct(tokens[k + 2], "(")) names.add(value);
+    if (isPunct(tokens[k + 1], "(")) {
+      let j = k + 2;
+      while (j < tokens.length && !isPunct(tokens[j], ")")) j++;
+      if (isKeyword(tokens[j + 1], "as") && isPunct(tokens[j + 2], "(")) names.add(value);
+    }
+  }
+  return names;
+}
+function findRelations(sql) {
+  const tokens = tokenize(sql);
+  const ctes = cteNames(tokens);
+  const relations = [];
+  const readItem = (start) => {
+    let k = start;
+    if (isKeyword(tokens[k], "lateral")) k++;
+    const first = identifier(tokens[k]);
+    if (!first) return k;
+    const parts = [first];
+    k++;
+    while (isPunct(tokens[k], ".") && identifier(tokens[k + 1])) {
+      parts.push(identifier(tokens[k + 1]));
+      k += 2;
+    }
+    if (isPunct(tokens[k], "(")) return k;
+    if (!(parts.length === 1 && ctes.has(first))) relations.push({ parts });
+    if (isKeyword(tokens[k], "as")) k++;
+    const alias = tokens[k];
+    if (alias?.kind === "word" && (alias.quoted || !CLAUSE_WORDS.has(alias.text.toLowerCase()))) k++;
+    return k;
+  };
+  const selectAtDepth = [false];
+  const inFromAtDepth = [false];
+  const top = () => selectAtDepth.length - 1;
+  for (let k = 0; k < tokens.length; k++) {
+    const token = tokens[k];
+    if (isPunct(token, "(")) {
+      selectAtDepth.push(false);
+      inFromAtDepth.push(false);
+    } else if (isPunct(token, ")")) {
+      if (selectAtDepth.length > 1) {
+        selectAtDepth.pop();
+        inFromAtDepth.pop();
+      }
+    } else if (isKeyword(token, "select")) {
+      selectAtDepth[top()] = true;
+      inFromAtDepth[top()] = false;
+    } else if (isKeyword(token, "join")) {
+      k = readItem(k + 1) - 1;
+    } else if (isKeyword(token, "from") && selectAtDepth[top()] && !isKeyword(tokens[k - 1], "distinct")) {
+      inFromAtDepth[top()] = true;
+      k = readItem(k + 1) - 1;
+    } else if (isPunct(token, ",") && inFromAtDepth[top()]) {
+      k = readItem(k + 1) - 1;
+    } else if (token?.kind === "word" && !token.quoted && FROM_CLAUSE_END.has(token.text.toLowerCase())) {
+      inFromAtDepth[top()] = false;
+    }
+  }
+  return relations;
+}
+
+// src/core/tenant-schema.ts
+var TenantSchemaError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TenantSchemaError";
+  }
+};
+var PLACEHOLDER = "{tenant}";
+var TEMPLATE_PART = /^[a-z0-9_]*$/;
+var TENANT_ID = /^[A-Za-z0-9_]{1,64}$/;
+function parseTenantSchemaTemplate(template) {
+  const value = template.trim().toLowerCase();
+  const index = value.indexOf(PLACEHOLDER);
+  if (index < 0 || value.indexOf(PLACEHOLDER, index + 1) >= 0) {
+    throw new TenantSchemaError(
+      `Tenant schema template must contain ${PLACEHOLDER} exactly once`
+    );
+  }
+  const prefix = value.slice(0, index);
+  const suffix = value.slice(index + PLACEHOLDER.length);
+  if (!TEMPLATE_PART.test(prefix) || !TEMPLATE_PART.test(suffix) || !(prefix || suffix)) {
+    throw new TenantSchemaError(
+      "Tenant schema template may only use a-z, 0-9 and _ around {tenant}"
+    );
+  }
+  return { prefix, suffix };
+}
+function matchesTemplate({ prefix, suffix }, schema) {
+  const value = schema.toLowerCase();
+  return value.length > prefix.length + suffix.length && value.startsWith(prefix) && value.endsWith(suffix) && /^[a-z0-9_]+$/.test(value.slice(prefix.length, value.length - suffix.length));
+}
+function resolveTenantSchema(template, tenantId) {
+  const { prefix, suffix } = parseTenantSchemaTemplate(template);
+  const id = tenantId.trim();
+  if (!TENANT_ID.test(id)) {
+    throw new TenantSchemaError(
+      "tenantId must be 1-64 characters of letters, digits or _ for schema-per-tenant isolation"
+    );
+  }
+  return `${prefix}${id.toLowerCase()}${suffix}`;
+}
+function rewriteTenantSchema(sql, template, tenantId) {
+  const parsed = parseTenantSchemaTemplate(template);
+  const tenantSchema = resolveTenantSchema(template, tenantId);
+  const tokens = tokenize(sql);
+  let rewritten = "";
+  let cursor = 0;
+  for (let k = 0; k < tokens.length; k++) {
+    const token = tokens[k];
+    const value = identifier(token);
+    if (!token || !value || !isPunct(tokens[k + 1], ".")) continue;
+    if (!matchesTemplate(parsed, value) || value.toLowerCase() === tenantSchema) continue;
+    const replacement = token.kind === "word" && token.quoted ? `"${tenantSchema}"` : tenantSchema;
+    rewritten += sql.slice(cursor, token.start) + replacement;
+    cursor = token.end;
+  }
+  rewritten += sql.slice(cursor);
+  const pattern = new RegExp(`${escapeRegex(parsed.prefix)}[a-z0-9_]+${escapeRegex(parsed.suffix)}`, "gi");
+  for (const match of rewritten.matchAll(pattern)) {
+    if (match[0].toLowerCase() !== tenantSchema) {
+      throw new TenantSchemaError("Query references another tenant's schema");
+    }
+  }
+  return rewritten;
+}
+var TENANT_SCHEMA_KEY = PLACEHOLDER;
+function tenantSchemaKey(template) {
+  const parsed = parseTenantSchemaTemplate(template);
+  return (schema) => matchesTemplate(parsed, schema) ? TENANT_SCHEMA_KEY : schema.toLowerCase();
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 // src/adapters/postgres.ts
 var WILDCARD = "*";
 function maxPostgresPlaceholderIndex(sql) {
@@ -627,6 +869,11 @@ var PostgresAdapter = class {
         this.defaultSchema
       );
     }
+    this.allowsRelation = buildRelationAllowlist(
+      this.allowedTables,
+      options.tenantSchema,
+      this.defaultSchema
+    );
   }
   clientFn;
   databaseName;
@@ -634,9 +881,11 @@ var PostgresAdapter = class {
   kind;
   dialect;
   allowedTables;
+  /** Undefined when queries are unrestricted. */
+  allowsRelation;
   async execute(sql, params) {
-    if (this.allowedTables) {
-      this.validateQueryTables(sql);
+    if (this.allowsRelation) {
+      this.validateQueryTables(sql, this.allowsRelation);
     }
     const boundParams = filterParamsForPostgresSql(sql, params);
     let paramArray;
@@ -647,29 +896,11 @@ var PostgresAdapter = class {
     const fields = result.fields.map((f) => f.name);
     return { fields, rows: result.rows };
   }
-  validateQueryTables(sql) {
-    if (!this.allowedTables || this.allowedTables.length === 0) {
-      return;
-    }
-    const allowedSet = new Set(
-      this.allowedTables.map((t) => tableKey2(t.schema, t.table))
-    );
-    const allowedSchemas = new Set(
-      this.allowedTables.filter((t) => t.table === WILDCARD).map((t) => t.schema)
-    );
-    const neutralizedSql = sql.replace(/EXTRACT\s*\([^)]*FROM\s+[^)]+\)/gi, "EXTRACT(/*neutralized*/)").replace(/SUBSTRING\s*\([^)]*FROM\s+[^)]+\)/gi, "SUBSTRING(/*neutralized*/)").replace(/TRIM\s*\([^)]*FROM\s+[^)]+\)/gi, "TRIM(/*neutralized*/)").replace(/POSITION\s*\([^)]*FROM\s+[^)]+\)/gi, "POSITION(/*neutralized*/)");
-    const tablePattern = /(?:FROM|JOIN)\s+(?:ONLY\s+)?(?:([a-zA-Z_][a-zA-Z0-9_]*)\.)?(["']?[a-zA-Z_][a-zA-Z0-9_]*["']?)/gi;
-    const matches = neutralizedSql.matchAll(tablePattern);
-    for (const match of matches) {
-      const schema = match[1] ?? this.defaultSchema;
-      const table = match[2]?.replace(/['"]/g, "");
-      if (table) {
-        const key = tableKey2(schema, table);
-        if (!allowedSet.has(key) && !allowedSchemas.has(schema)) {
-          throw new Error(
-            `Query references table "${schema}.${table}" which is not in the allowed tables list`
-          );
-        }
+  validateQueryTables(sql, allows) {
+    for (const relation of findRelations(sql)) {
+      if (!allows(relation)) {
+        const name = relation.parts.length === 1 ? `${this.defaultSchema}.${relation.parts[0]}` : relation.parts.join(".");
+        throw new Error(`Query references table "${name}" which is not in the allowed tables list`);
       }
     }
   }
@@ -707,6 +938,9 @@ var PostgresAdapter = class {
     return positionalParams;
   }
   async validate(sql, params) {
+    if (this.allowsRelation) {
+      this.validateQueryTables(sql, this.allowsRelation);
+    }
     const boundParams = filterParamsForPostgresSql(sql, params);
     let paramArray;
     if (boundParams) {
@@ -996,6 +1230,27 @@ function buildListTablesQuery(dialect, options) {
   LIMIT ${limit};`;
   return { sql, params };
 }
+function buildRelationAllowlist(allowedTables, tenantSchema, defaultSchema) {
+  if (!allowedTables?.length && !tenantSchema) return void 0;
+  const schemaKey = tenantSchema ? tenantSchemaKey(tenantSchema.template) : (schema) => schema.toLowerCase();
+  const entries = [
+    ...allowedTables?.length ? allowedTables : [{ schema: TENANT_SCHEMA_KEY, table: WILDCARD }],
+    ...(tenantSchema?.sharedSchemas ?? []).map((schema) => ({ schema, table: WILDCARD }))
+  ];
+  const tables = /* @__PURE__ */ new Set();
+  const wildcardSchemas = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    const schema = entry.schema === TENANT_SCHEMA_KEY ? entry.schema : schemaKey(entry.schema);
+    if (entry.table === WILDCARD) wildcardSchemas.add(schema);
+    else tables.add(tableKey2(schema, entry.table.toLowerCase()));
+  }
+  return ({ parts }) => {
+    if (parts.length > 2) return false;
+    const table = parts[parts.length - 1].toLowerCase();
+    const schema = schemaKey(parts.length === 2 ? parts[0] : defaultSchema);
+    return wildcardSchemas.has(schema) || tables.has(tableKey2(schema, table));
+  };
+}
 function tableKey2(schema, table) {
   return `${schema}.${table}`;
 }
@@ -1600,7 +1855,9 @@ var QueryEngine = class {
     const adapter = this.getDatabase(databaseName);
     const metadata = this.getDatabaseMetadata(databaseName);
     let finalSql = sql;
-    if (metadata) {
+    if (metadata?.tenantSchema) {
+      finalSql = rewriteTenantSchema(sql, metadata.tenantSchema.template, tenantId);
+    } else if (metadata) {
       finalSql = this.ensureTenantIsolation(sql, params, metadata, tenantId);
     }
     await adapter.validate(finalSql, params);
@@ -3349,6 +3606,9 @@ var QueryPanelSdkAPI = class _QueryPanelSdkAPI {
     this.queryEngine.attachDatabase(name, adapter, metadata);
   }
   attachPostgres(name, clientFn, options) {
+    if (options?.tenantSchema && options.tenantFieldName) {
+      throw new Error("Use either tenantSchema or tenantFieldName for tenant isolation, not both");
+    }
     const adapter = new PostgresAdapter(clientFn, options);
     const metadata = {
       name,
@@ -3360,7 +3620,8 @@ var QueryPanelSdkAPI = class _QueryPanelSdkAPI {
       enforceTenantIsolation: resolveAttachEnforceTenantIsolation(
         options?.tenantFieldName,
         options?.enforceTenantIsolation
-      )
+      ),
+      tenantSchema: options?.tenantSchema
     };
     this.queryEngine.attachDatabase(name, adapter, metadata);
   }
@@ -4414,9 +4675,13 @@ export {
   QueryPanelSdkAPI,
   QueryPipelineError,
   SchemaTooLargeError,
+  TenantSchemaError,
   anonymizeResults,
   mapGeneratedParams,
   normalizeSqlParamsInput,
-  resolveQueryPipeline
+  parseTenantSchemaTemplate,
+  resolveQueryPipeline,
+  resolveTenantSchema,
+  rewriteTenantSchema
 };
 //# sourceMappingURL=index.js.map