@sqlite-sync/ai 0.5.0 → 0.6.0

package/README.md

@@ -6,7 +6,9 @@ AI agent tools for [@sqlite-sync](https://github.com/krolebord-dev/sqlite-sync)
 
 - `createSchemaDoc` — generates a markdown schema doc by introspecting the synced database (structure from `PRAGMA table_info`, semantics from app-provided context).
 - `createAiDbAccess` — server-side access object living next to the storage; its methods double as an RPC contract for cross-Durable-Object setups.
-- `createDbTools` — AI SDK v6 `ToolSet` (currently a `getDbSchema` tool) backed by an `AiDbAccess` or a stub proxying to one.
+- `createDbTools` — AI SDK v6 `ToolSet` (`getDbSchema` and `queryDb` tools) backed by an `AiDbAccess` or a stub proxying to one.
+
+`queryDb` is strictly read-only: a single `SELECT`/`WITH`/`VALUES` statement, verified against SQLite's `EXPLAIN` bytecode for write opcodes, and executed inside a transaction that is always rolled back. Reads are **not** restricted by table — the agent can query every table in the database file (including sqlite-sync's internal event log), so don't colocate data the agent must not see. Results are capped (default 200 rows, 2000 chars per cell) and report `truncated` so the agent can narrow its query.
 
 ## Usage (Cloudflare Durable Object)
 
@@ -21,7 +23,7 @@ async onStart() {
     executor: createKyselyExecutor(this.ctx.storage),
     syncDbSchema,
     context: {
-      overview: "# My app's database\n\nDeletes are soft-deletes; the views below already hide them.",
+      overview: "# My app's database\n\nA todo app for a single user.",
       tables: {
         todos: {
           description: "The user's todos.",
@@ -32,10 +34,13 @@ async onStart() {
   });
 }
 
-// RPC method for agents running elsewhere:
+// RPC methods for agents running elsewhere:
 getDbSchemaDoc() {
   return this.aiDbAccess.getSchemaDoc();
 }
+queryDb(input: AiQueryInput) {
+  return this.aiDbAccess.query(input);
+}
 ```
 
 ```ts
@@ -46,10 +51,15 @@ getTools() {
   return createDbTools({
     access: async () => {
       const stub = await this.getUserDbStub();
-      return { getSchemaDoc: () => stub.getDbSchemaDoc() };
+      return {
+        getSchemaDoc: () => stub.getDbSchemaDoc(),
+        query: (input) => stub.queryDb(input),
+      };
     },
   });
 }
 ```
 
 `context.tables` keys are CRDT view names (`crdtTableName`). The doc skips the internal `tombstone` column and introspects base tables (views lose `NOT NULL` fidelity), presenting them under their view names.
+
+The generated doc always includes a built-in preamble (after your `overview`) explaining sqlite-sync mechanics — that the database syncs between devices and that the listed tables are read-only views with soft-deleted rows already filtered out. Your `context` only needs to describe your domain: what the app is, what each table/column means, and any data conventions (units, enums, timestamp formats).

package/dist/index.d.ts

@@ -17,6 +17,10 @@ type SchemaDocContext = {
  * Structure comes from `PRAGMA table_info` on the base tables (introspecting the views would
  * lose NOT NULL fidelity), presented under the view names the agent queries; semantics come
  * from the consumer-provided context. The internal `tombstone` column is omitted.
+ *
+ * The doc always includes a built-in preamble explaining sqlite-sync mechanics (read-only
+ * views, soft-deletes already filtered) after the consumer's `overview` — consumers only
+ * need to describe their own domain.
  */
 declare function createSchemaDoc(opts: {
     execute: (sql: string) => Record<string, unknown>[];
@@ -31,9 +35,6 @@ type AiDbExecuteParams = {
 /**
  * Minimal executor contract for AI database access. Runtime-specific — inject the one that
  * matches where the storage lives; @sqlite-sync/cloudflare's `createKyselyExecutor` satisfies it.
- *
- * `transaction` MUST roll back everything the callback executed when the callback throws —
- * it backs the read-only enforcement of the query tooling.
  */
 type AiDbExecutor = {
     execute<TResult = unknown>(query: AiDbExecuteParams): {
@@ -41,24 +42,81 @@ type AiDbExecutor = {
     };
     transaction(callback: (tx: Pick<AiDbExecutor, "execute">) => void): void;
 };
+type AiQueryInput = {
+    sql: string;
+    parameters?: readonly unknown[];
+};
+type AiQueryResult = {
+    rows: Record<string, unknown>[];
+    rowCount: number;
+    truncated: boolean;
+} | {
+    error: string;
+};
 /**
  * Read-only AI access to a synced database. Lives where the storage lives; its method names
  * are the RPC contract, so a DO stub proxying to these methods exposes the same surface
  * (promise-wrapped) and satisfies the tool layer's `DbToolsAccess`.
+ *
+ * `query` enforces read-only (single SELECT/WITH/VALUES statement, no write opcodes, executed
+ * in a forced-rollback transaction) but reads are not restricted by table — the whole database
+ * file is in scope for the agent, so don't colocate data the agent must not see.
  */
 type AiDbAccess = {
     getSchemaDoc(): string;
+    query(input: AiQueryInput): AiQueryResult;
 };
-/**
- * Create where the CRDT storage was created (e.g. a Durable Object's `onStart`, after
- * migrations have run) — the schema doc is introspected once and cached.
- */
 declare function createAiDbAccess(opts: {
     executor: AiDbExecutor;
     syncDbSchema: SyncDbSchema;
     context?: SchemaDocContext;
+    limits?: {
+        maxRows?: number;
+        maxCellChars?: number;
+    };
 }): AiDbAccess;
 
+type QueryGuardInput = {
+    sql: string;
+    parameters?: readonly unknown[];
+};
+type QueryGuardRejection = {
+    allowed: false;
+    code: "invalid-statement" | "multi-statement" | "invalid-sql" | "write-detected";
+    message: string;
+};
+type QueryGuardVerdict = {
+    allowed: true;
+} | QueryGuardRejection;
+declare class QueryGuardError extends Error {
+    readonly rejection: QueryGuardRejection;
+    constructor(rejection: QueryGuardRejection);
+}
+type QueryGuard = {
+    /**
+     * Statically verifies the query is a read-only single statement. Reads are not restricted
+     * by table — the whole database file is in scope for the agent, so don't colocate data the
+     * agent must not see.
+     */
+    check(input: QueryGuardInput): QueryGuardVerdict;
+    /**
+     * `check` + execute inside a forced-rollback transaction (the unconditional backstop for
+     * anything the analysis might miss). Throws {@link QueryGuardError} when the check rejects.
+     */
+    execute<TResult = unknown>(input: QueryGuardInput): {
+        rows: TResult[];
+    };
+};
+declare function createQueryGuard(opts: {
+    executor: AiDbExecutor;
+}): QueryGuard;
+/**
+ * Runs `callback` in a transaction that is always rolled back (via a sentinel throw, relying
+ * on the {@link AiDbExecutor} contract that a throwing callback rolls back). This is the
+ * unconditional write guard backing any gap in the static analysis.
+ */
+declare function runWithForcedRollback<T>(executor: Pick<AiDbExecutor, "transaction">, callback: (tx: Pick<AiDbExecutor, "execute">) => T): T;
+
 type MaybePromise<T> = T | Promise<T>;
 /**
  * What the tools need from the database side. Satisfied directly by `AiDbAccess`, or by a
@@ -66,6 +124,7 @@ type MaybePromise<T> = T | Promise<T>;
  */
 type DbToolsAccess = {
     getSchemaDoc(): MaybePromise<string>;
+    query(input: AiQueryInput): MaybePromise<AiQueryResult>;
 };
 /**
  * AI SDK tools for a synced database. `access` is a factory because acquiring the database
@@ -75,4 +134,4 @@ declare function createDbTools(opts: {
     access: () => MaybePromise<DbToolsAccess>;
 }): ToolSet;
 
-export { type AiDbAccess, type AiDbExecuteParams, type AiDbExecutor, type DbToolsAccess, type SchemaDocContext, createAiDbAccess, createDbTools, createSchemaDoc };
+export { type AiDbAccess, type AiDbExecuteParams, type AiDbExecutor, type AiQueryInput, type AiQueryResult, type DbToolsAccess, type QueryGuard, QueryGuardError, type QueryGuardInput, type QueryGuardRejection, type QueryGuardVerdict, type SchemaDocContext, createAiDbAccess, createDbTools, createQueryGuard, createSchemaDoc, runWithForcedRollback };

package/dist/index.js

@@ -1,4 +1,118 @@
+// src/query-guard.ts
+var QueryGuardError = class extends Error {
+  rejection;
+  constructor(rejection) {
+    super(rejection.message);
+    this.name = "QueryGuardError";
+    this.rejection = rejection;
+  }
+};
+var WRITE_OPCODES = /* @__PURE__ */ new Set([
+  "OpenWrite",
+  "Clear",
+  "Destroy",
+  "CreateBtree",
+  "SqlExec",
+  "ParseSchema",
+  "DropTable",
+  "DropIndex",
+  "DropTrigger",
+  "SetCookie",
+  "JournalMode",
+  "Vacuum",
+  "IncrVacuum",
+  "Checkpoint",
+  "MaxPgcnt",
+  "Expire",
+  "AutoCommit",
+  "VUpdate",
+  "VCreate",
+  "VDestroy",
+  "Program"
+]);
+var READ_STATEMENT_PREFIXES = ["select", "with", "values"];
+function createQueryGuard(opts) {
+  function reject(code, message) {
+    return { allowed: false, code, message };
+  }
+  function check(input) {
+    let body = input.sql.trim();
+    while (body.endsWith(";")) {
+      body = body.slice(0, -1).trimEnd();
+    }
+    if (body.includes(";")) {
+      return reject(
+        "multi-statement",
+        "Only a single SQL statement is allowed per query, and semicolons are only allowed at the very end. If the semicolon is inside a string literal, pass the value as a bound parameter instead."
+      );
+    }
+    const lowered = body.toLowerCase();
+    if (!READ_STATEMENT_PREFIXES.some((keyword) => lowered.startsWith(keyword))) {
+      return reject(
+        "invalid-statement",
+        "Only read-only queries are allowed: the statement must start directly with SELECT, WITH, or VALUES (no leading comments)."
+      );
+    }
+    let operations;
+    try {
+      operations = opts.executor.execute({
+        sql: `EXPLAIN ${input.sql}`,
+        parameters: input.parameters ?? []
+      }).rows;
+    } catch (error) {
+      return reject("invalid-sql", `SQL error: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    for (const operation of operations) {
+      if (WRITE_OPCODES.has(operation.opcode)) {
+        return reject(
+          "write-detected",
+          `The statement was rejected because it would modify the database (${operation.opcode}). This tool is strictly read-only; rewrite the query as a pure SELECT.`
+        );
+      }
+    }
+    return { allowed: true };
+  }
+  return {
+    check,
+    execute(input) {
+      const verdict = check(input);
+      if (!verdict.allowed) {
+        throw new QueryGuardError(verdict);
+      }
+      return runWithForcedRollback(opts.executor, (tx) => {
+        return tx.execute({ sql: input.sql, parameters: input.parameters ?? [] });
+      });
+    }
+  };
+}
+function runWithForcedRollback(executor, callback) {
+  let result;
+  let completed = false;
+  const rollbackSentinel = new Error("forced read-only rollback");
+  try {
+    executor.transaction((tx) => {
+      result = callback(tx);
+      completed = true;
+      throw rollbackSentinel;
+    });
+  } catch (error) {
+    if (error !== rollbackSentinel) {
+      throw error;
+    }
+  }
+  if (!completed) {
+    throw new Error("Transaction completed without running the callback");
+  }
+  return result;
+}
+
 // src/schema-doc.ts
+var SCHEMA_DOC_PREAMBLE = [
+  "This is a synced SQLite database \u2014 data replicates automatically between the user's devices.",
+  "All writes go through a sync event log, which is why the tables listed below are exposed as",
+  "read-only SQL views; soft-deleted rows are already filtered out, so query them directly",
+  "without any tombstone filtering. Every table has a unique `id` text primary key."
+].join("\n");
 function quoteId(name) {
   return `"${name.replaceAll('"', '""')}"`;
 }
@@ -8,6 +122,7 @@ function createSchemaDoc(opts) {
   if (overview) {
     sections.push(overview);
   }
+  sections.push(SCHEMA_DOC_PREAMBLE);
   for (const table of opts.syncDbSchema.tablesConfig) {
     const tableContext = opts.context?.tables?.[table.crdtTableName];
     const columns = opts.execute(`PRAGMA table_info(${quoteId(table.baseTableName)})`);
@@ -29,8 +144,18 @@ function createSchemaDoc(opts) {
 }
 
 // src/db-access.ts
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
 function createAiDbAccess(opts) {
   let schemaDoc;
+  const guard = createQueryGuard({ executor: opts.executor });
+  const maxRows = opts.limits?.maxRows ?? 200;
+  const maxCellChars = opts.limits?.maxCellChars ?? 2e3;
   return {
     getSchemaDoc() {
       schemaDoc ??= createSchemaDoc({
@@ -39,6 +164,34 @@ function createAiDbAccess(opts) {
         context: opts.context
       });
       return schemaDoc;
+    },
+    query(input) {
+      let resultRows;
+      try {
+        resultRows = guard.execute(input).rows;
+      } catch (error) {
+        if (error instanceof QueryGuardError) {
+          return { error: error.message };
+        }
+        throw error;
+      }
+      let truncated = resultRows.length > maxRows;
+      function shapeCell(value) {
+        if (value instanceof Uint8Array) {
+          if (Math.ceil(value.byteLength / 3) * 4 <= maxCellChars) {
+            return `<blob base64 ${toBase64(value)}>`;
+          }
+          truncated = true;
+          return `<blob ${value.byteLength} bytes>`;
+        }
+        if (typeof value === "string" && value.length > maxCellChars) {
+          truncated = true;
+          return `${value.slice(0, maxCellChars)}\u2026`;
+        }
+        return value;
+      }
+      const rows = resultRows.slice(0, maxRows).map((row) => Object.fromEntries(Object.entries(row).map(([column, value]) => [column, shapeCell(value)])));
+      return { rows, rowCount: resultRows.length, truncated };
     }
   };
 }
@@ -50,6 +203,22 @@ var emptyInputSchema = jsonSchema({
   properties: {},
   additionalProperties: false
 });
+var queryInputSchema = jsonSchema({
+  type: "object",
+  properties: {
+    sql: {
+      type: "string",
+      description: "A single read-only SQLite statement starting with SELECT, WITH, or VALUES. Use ? placeholders for values."
+    },
+    parameters: {
+      type: "array",
+      items: { type: ["string", "number", "boolean", "null"] },
+      description: "Values bound to the ? placeholders, in order."
+    }
+  },
+  required: ["sql"],
+  additionalProperties: false
+});
 function createDbTools(opts) {
   return {
     getDbSchema: tool({
@@ -59,12 +228,23 @@ function createDbTools(opts) {
         const access = await opts.access();
         return await access.getSchemaDoc();
       }
+    }),
+    queryDb: tool({
+      description: "Run a read-only SQL query against the synced SQLite database. Only a single SELECT/WITH/VALUES statement is allowed \u2014 anything that writes is rejected. Pass values as ? placeholders via `parameters` instead of inlining them as literals. Results are capped; ask for fewer columns or add LIMIT/WHERE if `truncated` is true.",
+      inputSchema: queryInputSchema,
+      execute: async ({ sql, parameters }) => {
+        const access = await opts.access();
+        return await access.query({ sql, parameters });
+      }
     })
   };
 }
 export {
+  QueryGuardError,
   createAiDbAccess,
   createDbTools,
-  createSchemaDoc
+  createQueryGuard,
+  createSchemaDoc,
+  runWithForcedRollback
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/schema-doc.ts","../src/db-access.ts","../src/tools.ts"],"sourcesContent":["import type { SyncDbSchema } from \"@sqlite-sync/core\";\n\n/**\n * App-provided semantics merged into the generated schema doc.\n * Keys of `tables` are CRDT view names (`crdtTableName`), not base table names.\n */\nexport type SchemaDocContext = {\n  overview?: string;\n  tables?: Record<string, { description?: string; columns?: Record<string, string> }>;\n};\n\ntype TableInfoRow = {\n  cid: number;\n  name: string;\n  type: string;\n  notnull: number;\n};\n\nfunction quoteId(name: string) {\n  return `\"${name.replaceAll('\"', '\"\"')}\"`;\n}\n\n/**\n * Generates a markdown schema doc for an AI agent by introspecting the synced database.\n * Structure comes from `PRAGMA table_info` on the base tables (introspecting the views would\n * lose NOT NULL fidelity), presented under the view names the agent queries; semantics come\n * from the consumer-provided context. The internal `tombstone` column is omitted.\n */\nexport function createSchemaDoc(opts: {\n  execute: (sql: string) => Record<string, unknown>[];\n  syncDbSchema: SyncDbSchema;\n  context?: SchemaDocContext;\n}): string {\n  const sections: string[] = [];\n\n  const overview = opts.context?.overview?.trim();\n  if (overview) {\n    sections.push(overview);\n  }\n\n  for (const table of opts.syncDbSchema.tablesConfig) {\n    const tableContext = opts.context?.tables?.[table.crdtTableName];\n    const columns = opts.execute(`PRAGMA table_info(${quoteId(table.baseTableName)})`) as TableInfoRow[];\n\n    const lines = [`## ${table.crdtTableName}`];\n    if (tableContext?.description) {\n      lines.push(\"\", tableContext.description.trim());\n    }\n    lines.push(\"\", \"Columns:\");\n    for (const column of columns) {\n      if (column.name === \"tombstone\") continue;\n      const description = tableContext?.columns?.[column.name];\n      lines.push(\n        `- \\`${column.name}\\` ${column.type}${column.notnull ? \" NOT NULL\" : \"\"}${description ? ` — ${description}` : \"\"}`,\n      );\n    }\n    sections.push(lines.join(\"\\n\"));\n  }\n\n  return sections.join(\"\\n\\n\");\n}\n","import type { SyncDbSchema } from \"@sqlite-sync/core\";\nimport { createSchemaDoc, type SchemaDocContext } from \"./schema-doc\";\n\nexport type AiDbExecuteParams = {\n  sql: string;\n  parameters: readonly unknown[];\n};\n\n/**\n * Minimal executor contract for AI database access. Runtime-specific — inject the one that\n * matches where the storage lives; @sqlite-sync/cloudflare's `createKyselyExecutor` satisfies it.\n *\n * `transaction` MUST roll back everything the callback executed when the callback throws —\n * it backs the read-only enforcement of the query tooling.\n */\nexport type AiDbExecutor = {\n  execute<TResult = unknown>(query: AiDbExecuteParams): { rows: TResult[] };\n  transaction(callback: (tx: Pick<AiDbExecutor, \"execute\">) => void): void;\n};\n\n/**\n * Read-only AI access to a synced database. Lives where the storage lives; its method names\n * are the RPC contract, so a DO stub proxying to these methods exposes the same surface\n * (promise-wrapped) and satisfies the tool layer's `DbToolsAccess`.\n */\nexport type AiDbAccess = {\n  getSchemaDoc(): string;\n};\n\n/**\n * Create where the CRDT storage was created (e.g. a Durable Object's `onStart`, after\n * migrations have run) — the schema doc is introspected once and cached.\n */\nexport function createAiDbAccess(opts: {\n  executor: AiDbExecutor;\n  syncDbSchema: SyncDbSchema;\n  context?: SchemaDocContext;\n}): AiDbAccess {\n  let schemaDoc: string | undefined;\n\n  return {\n    getSchemaDoc() {\n      schemaDoc ??= createSchemaDoc({\n        execute: (sql) => opts.executor.execute<Record<string, unknown>>({ sql, parameters: [] }).rows,\n        syncDbSchema: opts.syncDbSchema,\n        context: opts.context,\n      });\n      return schemaDoc;\n    },\n  };\n}\n","import { jsonSchema, type ToolSet, tool } from \"ai\";\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * What the tools need from the database side. Satisfied directly by `AiDbAccess`, or by a\n * Durable Object stub whose RPC methods delegate to one (RPC wraps returns in promises).\n */\nexport type DbToolsAccess = {\n  getSchemaDoc(): MaybePromise<string>;\n};\n\nconst emptyInputSchema = jsonSchema<Record<string, never>>({\n  type: \"object\",\n  properties: {},\n  additionalProperties: false,\n});\n\n/**\n * AI SDK tools for a synced database. `access` is a factory because acquiring the database\n * may itself be async per call (e.g. resolving a Durable Object stub from another DO).\n */\nexport function createDbTools(opts: { access: () => MaybePromise<DbToolsAccess> }): ToolSet {\n  return {\n    getDbSchema: tool({\n      description:\n        \"Get the schema documentation for the synced SQLite database: tables, columns, types, and data conventions. Call this before reasoning about the data.\",\n      inputSchema: emptyInputSchema,\n      execute: async () => {\n        const access = await opts.access();\n        return await access.getSchemaDoc();\n      },\n    }),\n  };\n}\n"],"mappings":";AAkBA,SAAS,QAAQ,MAAc;AAC7B,SAAO,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC;AACvC;AAQO,SAAS,gBAAgB,MAIrB;AACT,QAAM,WAAqB,CAAC;AAE5B,QAAM,WAAW,KAAK,SAAS,UAAU,KAAK;AAC9C,MAAI,UAAU;AACZ,aAAS,KAAK,QAAQ;AAAA,EACxB;AAEA,aAAW,SAAS,KAAK,aAAa,cAAc;AAClD,UAAM,eAAe,KAAK,SAAS,SAAS,MAAM,aAAa;AAC/D,UAAM,UAAU,KAAK,QAAQ,qBAAqB,QAAQ,MAAM,aAAa,CAAC,GAAG;AAEjF,UAAM,QAAQ,CAAC,MAAM,MAAM,aAAa,EAAE;AAC1C,QAAI,cAAc,aAAa;AAC7B,YAAM,KAAK,IAAI,aAAa,YAAY,KAAK,CAAC;AAAA,IAChD;AACA,UAAM,KAAK,IAAI,UAAU;AACzB,eAAW,UAAU,SAAS;AAC5B,UAAI,OAAO,SAAS,YAAa;AACjC,YAAM,cAAc,cAAc,UAAU,OAAO,IAAI;AACvD,YAAM;AAAA,QACJ,OAAO,OAAO,IAAI,MAAM,OAAO,IAAI,GAAG,OAAO,UAAU,cAAc,EAAE,GAAG,cAAc,WAAM,WAAW,KAAK,EAAE;AAAA,MAClH;AAAA,IACF;AACA,aAAS,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,EAChC;AAEA,SAAO,SAAS,KAAK,MAAM;AAC7B;;;AC3BO,SAAS,iBAAiB,MAIlB;AACb,MAAI;AAEJ,SAAO;AAAA,IACL,eAAe;AACb,oBAAc,gBAAgB;AAAA,QAC5B,SAAS,CAAC,QAAQ,KAAK,SAAS,QAAiC,EAAE,KAAK,YAAY,CAAC,EAAE,CAAC,EAAE;AAAA,QAC1F,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AClDA,SAAS,YAA0B,YAAY;AAY/C,IAAM,mBAAmB,WAAkC;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,CAAC;AAAA,EACb,sBAAsB;AACxB,CAAC;AAMM,SAAS,cAAc,MAA8D;AAC1F,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,MAChB,aACE;AAAA,MACF,aAAa;AAAA,MACb,SAAS,YAAY;AACnB,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,eAAO,MAAM,OAAO,aAAa;AAAA,MACnC;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}
+{"version":3,"sources":["../src/query-guard.ts","../src/schema-doc.ts","../src/db-access.ts","../src/tools.ts"],"sourcesContent":["import type { AiDbExecutor } from \"./db-access\";\n\nexport type QueryGuardInput = {\n  sql: string;\n  parameters?: readonly unknown[];\n};\n\nexport type QueryGuardRejection = {\n  allowed: false;\n  code: \"invalid-statement\" | \"multi-statement\" | \"invalid-sql\" | \"write-detected\";\n  message: string;\n};\n\nexport type QueryGuardVerdict = { allowed: true } | QueryGuardRejection;\n\nexport class QueryGuardError extends Error {\n  readonly rejection: QueryGuardRejection;\n\n  constructor(rejection: QueryGuardRejection) {\n    super(rejection.message);\n    this.name = \"QueryGuardError\";\n    this.rejection = rejection;\n  }\n}\n\nexport type QueryGuard = {\n  /**\n   * Statically verifies the query is a read-only single statement. Reads are not restricted\n   * by table — the whole database file is in scope for the agent, so don't colocate data the\n   * agent must not see.\n   */\n  check(input: QueryGuardInput): QueryGuardVerdict;\n  /**\n   * `check` + execute inside a forced-rollback transaction (the unconditional backstop for\n   * anything the analysis might miss). Throws {@link QueryGuardError} when the check rejects.\n   */\n  execute<TResult = unknown>(input: QueryGuardInput): { rows: TResult[] };\n};\n\n/**\n * Opcodes that prove a statement is not read-only. `OpenWrite` covers row-level writes (every\n * real-table mutation opens its cursor through it), `Clear`/`Destroy` cover whole-table\n * deletes that skip cursors (truncate optimization), the rest cover DDL, pragma-class\n * statements (which a transaction rollback would NOT undo), virtual-table writes, and trigger\n * subprograms. `Insert`/`Delete`/`IdxInsert` are deliberately absent — they also run against\n * ephemeral/sorter cursors in ordinary SELECTs (DISTINCT, ORDER BY) and are only dangerous on\n * a cursor an `OpenWrite` would have created.\n */\nconst WRITE_OPCODES = new Set([\n  \"OpenWrite\",\n  \"Clear\",\n  \"Destroy\",\n  \"CreateBtree\",\n  \"SqlExec\",\n  \"ParseSchema\",\n  \"DropTable\",\n  \"DropIndex\",\n  \"DropTrigger\",\n  \"SetCookie\",\n  \"JournalMode\",\n  \"Vacuum\",\n  \"IncrVacuum\",\n  \"Checkpoint\",\n  \"MaxPgcnt\",\n  \"Expire\",\n  \"AutoCommit\",\n  \"VUpdate\",\n  \"VCreate\",\n  \"VDestroy\",\n  \"Program\",\n]);\n\ntype ExplainRow = {\n  opcode: string;\n};\n\nconst READ_STATEMENT_PREFIXES = [\"select\", \"with\", \"values\"];\n\nexport function createQueryGuard(opts: { executor: AiDbExecutor }): QueryGuard {\n  function reject(code: QueryGuardRejection[\"code\"], message: string): QueryGuardRejection {\n    return { allowed: false, code, message };\n  }\n\n  function check(input: QueryGuardInput): QueryGuardVerdict {\n    let body = input.sql.trim();\n    while (body.endsWith(\";\")) {\n      body = body.slice(0, -1).trimEnd();\n    }\n\n    if (body.includes(\";\")) {\n      return reject(\n        \"multi-statement\",\n        \"Only a single SQL statement is allowed per query, and semicolons are only allowed at the very end. If the semicolon is inside a string literal, pass the value as a bound parameter instead.\",\n      );\n    }\n\n    const lowered = body.toLowerCase();\n    if (!READ_STATEMENT_PREFIXES.some((keyword) => lowered.startsWith(keyword))) {\n      return reject(\n        \"invalid-statement\",\n        \"Only read-only queries are allowed: the statement must start directly with SELECT, WITH, or VALUES (no leading comments).\",\n      );\n    }\n\n    let operations: ExplainRow[];\n    try {\n      operations = opts.executor.execute<ExplainRow>({\n        sql: `EXPLAIN ${input.sql}`,\n        parameters: input.parameters ?? [],\n      }).rows;\n    } catch (error) {\n      return reject(\"invalid-sql\", `SQL error: ${error instanceof Error ? error.message : String(error)}`);\n    }\n\n    for (const operation of operations) {\n      if (WRITE_OPCODES.has(operation.opcode)) {\n        return reject(\n          \"write-detected\",\n          `The statement was rejected because it would modify the database (${operation.opcode}). This tool is strictly read-only; rewrite the query as a pure SELECT.`,\n        );\n      }\n    }\n\n    return { allowed: true };\n  }\n\n  return {\n    check,\n    execute(input) {\n      const verdict = check(input);\n      if (!verdict.allowed) {\n        throw new QueryGuardError(verdict);\n      }\n      return runWithForcedRollback(opts.executor, (tx) => {\n        return tx.execute({ sql: input.sql, parameters: input.parameters ?? [] });\n      });\n    },\n  };\n}\n\n/**\n * Runs `callback` in a transaction that is always rolled back (via a sentinel throw, relying\n * on the {@link AiDbExecutor} contract that a throwing callback rolls back). This is the\n * unconditional write guard backing any gap in the static analysis.\n */\nexport function runWithForcedRollback<T>(\n  executor: Pick<AiDbExecutor, \"transaction\">,\n  callback: (tx: Pick<AiDbExecutor, \"execute\">) => T,\n): T {\n  let result: T | undefined;\n  let completed = false;\n  const rollbackSentinel = new Error(\"forced read-only rollback\");\n\n  try {\n    executor.transaction((tx) => {\n      result = callback(tx);\n      completed = true;\n      throw rollbackSentinel;\n    });\n  } catch (error) {\n    if (error !== rollbackSentinel) {\n      throw error;\n    }\n  }\n\n  if (!completed) {\n    throw new Error(\"Transaction completed without running the callback\");\n  }\n  return result as T;\n}\n","import type { SyncDbSchema } from \"@sqlite-sync/core\";\n\n/**\n * App-provided semantics merged into the generated schema doc.\n * Keys of `tables` are CRDT view names (`crdtTableName`), not base table names.\n */\nexport type SchemaDocContext = {\n  overview?: string;\n  tables?: Record<string, { description?: string; columns?: Record<string, string> }>;\n};\n\n// Library mechanics every generated doc should explain, so consumers only have to describe\n// their own domain in `context`. Kept free of tombstone-column details the agent never sees.\nconst SCHEMA_DOC_PREAMBLE = [\n  \"This is a synced SQLite database — data replicates automatically between the user's devices.\",\n  \"All writes go through a sync event log, which is why the tables listed below are exposed as\",\n  \"read-only SQL views; soft-deleted rows are already filtered out, so query them directly\",\n  \"without any tombstone filtering. Every table has a unique `id` text primary key.\",\n].join(\"\\n\");\n\ntype TableInfoRow = {\n  cid: number;\n  name: string;\n  type: string;\n  notnull: number;\n};\n\nfunction quoteId(name: string) {\n  return `\"${name.replaceAll('\"', '\"\"')}\"`;\n}\n\n/**\n * Generates a markdown schema doc for an AI agent by introspecting the synced database.\n * Structure comes from `PRAGMA table_info` on the base tables (introspecting the views would\n * lose NOT NULL fidelity), presented under the view names the agent queries; semantics come\n * from the consumer-provided context. The internal `tombstone` column is omitted.\n *\n * The doc always includes a built-in preamble explaining sqlite-sync mechanics (read-only\n * views, soft-deletes already filtered) after the consumer's `overview` — consumers only\n * need to describe their own domain.\n */\nexport function createSchemaDoc(opts: {\n  execute: (sql: string) => Record<string, unknown>[];\n  syncDbSchema: SyncDbSchema;\n  context?: SchemaDocContext;\n}): string {\n  const sections: string[] = [];\n\n  const overview = opts.context?.overview?.trim();\n  if (overview) {\n    sections.push(overview);\n  }\n  sections.push(SCHEMA_DOC_PREAMBLE);\n\n  for (const table of opts.syncDbSchema.tablesConfig) {\n    const tableContext = opts.context?.tables?.[table.crdtTableName];\n    const columns = opts.execute(`PRAGMA table_info(${quoteId(table.baseTableName)})`) as TableInfoRow[];\n\n    const lines = [`## ${table.crdtTableName}`];\n    if (tableContext?.description) {\n      lines.push(\"\", tableContext.description.trim());\n    }\n    lines.push(\"\", \"Columns:\");\n    for (const column of columns) {\n      if (column.name === \"tombstone\") continue;\n      const description = tableContext?.columns?.[column.name];\n      lines.push(\n        `- \\`${column.name}\\` ${column.type}${column.notnull ? \" NOT NULL\" : \"\"}${description ? ` — ${description}` : \"\"}`,\n      );\n    }\n    sections.push(lines.join(\"\\n\"));\n  }\n\n  return sections.join(\"\\n\\n\");\n}\n","import type { SyncDbSchema } from \"@sqlite-sync/core\";\nimport { createQueryGuard, QueryGuardError } from \"./query-guard\";\nimport { createSchemaDoc, type SchemaDocContext } from \"./schema-doc\";\n\nexport type AiDbExecuteParams = {\n  sql: string;\n  parameters: readonly unknown[];\n};\n\n/**\n * Minimal executor contract for AI database access. Runtime-specific — inject the one that\n * matches where the storage lives; @sqlite-sync/cloudflare's `createKyselyExecutor` satisfies it.\n */\nexport type AiDbExecutor = {\n  execute<TResult = unknown>(query: AiDbExecuteParams): { rows: TResult[] };\n  transaction(callback: (tx: Pick<AiDbExecutor, \"execute\">) => void): void;\n};\n\nexport type AiQueryInput = {\n  sql: string;\n  parameters?: readonly unknown[];\n};\n\nexport type AiQueryResult =\n  | {\n      rows: Record<string, unknown>[];\n      rowCount: number;\n      truncated: boolean;\n    }\n  | {\n      error: string;\n    };\n\n/**\n * Read-only AI access to a synced database. Lives where the storage lives; its method names\n * are the RPC contract, so a DO stub proxying to these methods exposes the same surface\n * (promise-wrapped) and satisfies the tool layer's `DbToolsAccess`.\n *\n * `query` enforces read-only (single SELECT/WITH/VALUES statement, no write opcodes, executed\n * in a forced-rollback transaction) but reads are not restricted by table — the whole database\n * file is in scope for the agent, so don't colocate data the agent must not see.\n */\nexport type AiDbAccess = {\n  getSchemaDoc(): string;\n  query(input: AiQueryInput): AiQueryResult;\n};\n\nfunction toBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary);\n}\n\nexport function createAiDbAccess(opts: {\n  executor: AiDbExecutor;\n  syncDbSchema: SyncDbSchema;\n  context?: SchemaDocContext;\n  limits?: { maxRows?: number; maxCellChars?: number };\n}): AiDbAccess {\n  let schemaDoc: string | undefined;\n  const guard = createQueryGuard({ executor: opts.executor });\n  const maxRows = opts.limits?.maxRows ?? 200;\n  const maxCellChars = opts.limits?.maxCellChars ?? 2000;\n\n  return {\n    getSchemaDoc() {\n      schemaDoc ??= createSchemaDoc({\n        execute: (sql) => opts.executor.execute<Record<string, unknown>>({ sql, parameters: [] }).rows,\n        syncDbSchema: opts.syncDbSchema,\n        context: opts.context,\n      });\n      return schemaDoc;\n    },\n    query(input) {\n      let resultRows: Record<string, unknown>[];\n      try {\n        resultRows = guard.execute<Record<string, unknown>>(input).rows;\n      } catch (error) {\n        if (error instanceof QueryGuardError) {\n          return { error: error.message };\n        }\n        throw error;\n      }\n\n      let truncated = resultRows.length > maxRows;\n\n      function shapeCell(value: unknown): unknown {\n        if (value instanceof Uint8Array) {\n          // Base64 inflates by 4/3, so budget the encoded length against the cell cap.\n          if (Math.ceil(value.byteLength / 3) * 4 <= maxCellChars) {\n            return `<blob base64 ${toBase64(value)}>`;\n          }\n          truncated = true;\n          return `<blob ${value.byteLength} bytes>`;\n        }\n        if (typeof value === \"string\" && value.length > maxCellChars) {\n          truncated = true;\n          return `${value.slice(0, maxCellChars)}…`;\n        }\n        return value;\n      }\n\n      const rows = resultRows\n        .slice(0, maxRows)\n        .map((row) => Object.fromEntries(Object.entries(row).map(([column, value]) => [column, shapeCell(value)])));\n\n      return { rows, rowCount: resultRows.length, truncated };\n    },\n  };\n}\n","import { jsonSchema, type ToolSet, tool } from \"ai\";\nimport type { AiQueryInput, AiQueryResult } from \"./db-access\";\n\ntype MaybePromise<T> = T | Promise<T>;\n\n/**\n * What the tools need from the database side. Satisfied directly by `AiDbAccess`, or by a\n * Durable Object stub whose RPC methods delegate to one (RPC wraps returns in promises).\n */\nexport type DbToolsAccess = {\n  getSchemaDoc(): MaybePromise<string>;\n  query(input: AiQueryInput): MaybePromise<AiQueryResult>;\n};\n\nconst emptyInputSchema = jsonSchema<Record<string, never>>({\n  type: \"object\",\n  properties: {},\n  additionalProperties: false,\n});\n\nconst queryInputSchema = jsonSchema<{ sql: string; parameters?: unknown[] }>({\n  type: \"object\",\n  properties: {\n    sql: {\n      type: \"string\",\n      description:\n        \"A single read-only SQLite statement starting with SELECT, WITH, or VALUES. Use ? placeholders for values.\",\n    },\n    parameters: {\n      type: \"array\",\n      items: { type: [\"string\", \"number\", \"boolean\", \"null\"] },\n      description: \"Values bound to the ? placeholders, in order.\",\n    },\n  },\n  required: [\"sql\"],\n  additionalProperties: false,\n});\n\n/**\n * AI SDK tools for a synced database. `access` is a factory because acquiring the database\n * may itself be async per call (e.g. resolving a Durable Object stub from another DO).\n */\nexport function createDbTools(opts: { access: () => MaybePromise<DbToolsAccess> }): ToolSet {\n  return {\n    getDbSchema: tool({\n      description:\n        \"Get the schema documentation for the synced SQLite database: tables, columns, types, and data conventions. Call this before reasoning about the data.\",\n      inputSchema: emptyInputSchema,\n      execute: async () => {\n        const access = await opts.access();\n        return await access.getSchemaDoc();\n      },\n    }),\n    queryDb: tool({\n      description:\n        \"Run a read-only SQL query against the synced SQLite database. Only a single SELECT/WITH/VALUES statement is allowed — anything that writes is rejected. Pass values as ? placeholders via `parameters` instead of inlining them as literals. Results are capped; ask for fewer columns or add LIMIT/WHERE if `truncated` is true.\",\n      inputSchema: queryInputSchema,\n      execute: async ({ sql, parameters }) => {\n        const access = await opts.access();\n        return await access.query({ sql, parameters });\n      },\n    }),\n  };\n}\n"],"mappings":";AAeO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAChC;AAAA,EAET,YAAY,WAAgC;AAC1C,UAAM,UAAU,OAAO;AACvB,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;AAyBA,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMD,IAAM,0BAA0B,CAAC,UAAU,QAAQ,QAAQ;AAEpD,SAAS,iBAAiB,MAA8C;AAC7E,WAAS,OAAO,MAAmC,SAAsC;AACvF,WAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AAAA,EACzC;AAEA,WAAS,MAAM,OAA2C;AACxD,QAAI,OAAO,MAAM,IAAI,KAAK;AAC1B,WAAO,KAAK,SAAS,GAAG,GAAG;AACzB,aAAO,KAAK,MAAM,GAAG,EAAE,EAAE,QAAQ;AAAA,IACnC;AAEA,QAAI,KAAK,SAAS,GAAG,GAAG;AACtB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,YAAY;AACjC,QAAI,CAAC,wBAAwB,KAAK,CAAC,YAAY,QAAQ,WAAW,OAAO,CAAC,GAAG;AAC3E,aAAO;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,mBAAa,KAAK,SAAS,QAAoB;AAAA,QAC7C,KAAK,WAAW,MAAM,GAAG;AAAA,QACzB,YAAY,MAAM,cAAc,CAAC;AAAA,MACnC,CAAC,EAAE;AAAA,IACL,SAAS,OAAO;AACd,aAAO,OAAO,eAAe,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAAA,IACrG;AAEA,eAAW,aAAa,YAAY;AAClC,UAAI,cAAc,IAAI,UAAU,MAAM,GAAG;AACvC,eAAO;AAAA,UACL;AAAA,UACA,oEAAoE,UAAU,MAAM;AAAA,QACtF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,OAAO;AACb,YAAM,UAAU,MAAM,KAAK;AAC3B,UAAI,CAAC,QAAQ,SAAS;AACpB,cAAM,IAAI,gBAAgB,OAAO;AAAA,MACnC;AACA,aAAO,sBAAsB,KAAK,UAAU,CAAC,OAAO;AAClD,eAAO,GAAG,QAAQ,EAAE,KAAK,MAAM,KAAK,YAAY,MAAM,cAAc,CAAC,EAAE,CAAC;AAAA,MAC1E,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOO,SAAS,sBACd,UACA,UACG;AACH,MAAI;AACJ,MAAI,YAAY;AAChB,QAAM,mBAAmB,IAAI,MAAM,2BAA2B;AAE9D,MAAI;AACF,aAAS,YAAY,CAAC,OAAO;AAC3B,eAAS,SAAS,EAAE;AACpB,kBAAY;AACZ,YAAM;AAAA,IACR,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,UAAU,kBAAkB;AAC9B,YAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO;AACT;;;AC5JA,IAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,IAAI;AASX,SAAS,QAAQ,MAAc;AAC7B,SAAO,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC;AACvC;AAYO,SAAS,gBAAgB,MAIrB;AACT,QAAM,WAAqB,CAAC;AAE5B,QAAM,WAAW,KAAK,SAAS,UAAU,KAAK;AAC9C,MAAI,UAAU;AACZ,aAAS,KAAK,QAAQ;AAAA,EACxB;AACA,WAAS,KAAK,mBAAmB;AAEjC,aAAW,SAAS,KAAK,aAAa,cAAc;AAClD,UAAM,eAAe,KAAK,SAAS,SAAS,MAAM,aAAa;AAC/D,UAAM,UAAU,KAAK,QAAQ,qBAAqB,QAAQ,MAAM,aAAa,CAAC,GAAG;AAEjF,UAAM,QAAQ,CAAC,MAAM,MAAM,aAAa,EAAE;AAC1C,QAAI,cAAc,aAAa;AAC7B,YAAM,KAAK,IAAI,aAAa,YAAY,KAAK,CAAC;AAAA,IAChD;AACA,UAAM,KAAK,IAAI,UAAU;AACzB,eAAW,UAAU,SAAS;AAC5B,UAAI,OAAO,SAAS,YAAa;AACjC,YAAM,cAAc,cAAc,UAAU,OAAO,IAAI;AACvD,YAAM;AAAA,QACJ,OAAO,OAAO,IAAI,MAAM,OAAO,IAAI,GAAG,OAAO,UAAU,cAAc,EAAE,GAAG,cAAc,WAAM,WAAW,KAAK,EAAE;AAAA,MAClH;AAAA,IACF;AACA,aAAS,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,EAChC;AAEA,SAAO,SAAS,KAAK,MAAM;AAC7B;;;AC3BA,SAAS,SAAS,OAA2B;AAC3C,MAAI,SAAS;AACb,aAAW,QAAQ,OAAO;AACxB,cAAU,OAAO,aAAa,IAAI;AAAA,EACpC;AACA,SAAO,KAAK,MAAM;AACpB;AAEO,SAAS,iBAAiB,MAKlB;AACb,MAAI;AACJ,QAAM,QAAQ,iBAAiB,EAAE,UAAU,KAAK,SAAS,CAAC;AAC1D,QAAM,UAAU,KAAK,QAAQ,WAAW;AACxC,QAAM,eAAe,KAAK,QAAQ,gBAAgB;AAElD,SAAO;AAAA,IACL,eAAe;AACb,oBAAc,gBAAgB;AAAA,QAC5B,SAAS,CAAC,QAAQ,KAAK,SAAS,QAAiC,EAAE,KAAK,YAAY,CAAC,EAAE,CAAC,EAAE;AAAA,QAC1F,cAAc,KAAK;AAAA,QACnB,SAAS,KAAK;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO;AACX,UAAI;AACJ,UAAI;AACF,qBAAa,MAAM,QAAiC,KAAK,EAAE;AAAA,MAC7D,SAAS,OAAO;AACd,YAAI,iBAAiB,iBAAiB;AACpC,iBAAO,EAAE,OAAO,MAAM,QAAQ;AAAA,QAChC;AACA,cAAM;AAAA,MACR;AAEA,UAAI,YAAY,WAAW,SAAS;AAEpC,eAAS,UAAU,OAAyB;AAC1C,YAAI,iBAAiB,YAAY;AAE/B,cAAI,KAAK,KAAK,MAAM,aAAa,CAAC,IAAI,KAAK,cAAc;AACvD,mBAAO,gBAAgB,SAAS,KAAK,CAAC;AAAA,UACxC;AACA,sBAAY;AACZ,iBAAO,SAAS,MAAM,UAAU;AAAA,QAClC;AACA,YAAI,OAAO,UAAU,YAAY,MAAM,SAAS,cAAc;AAC5D,sBAAY;AACZ,iBAAO,GAAG,MAAM,MAAM,GAAG,YAAY,CAAC;AAAA,QACxC;AACA,eAAO;AAAA,MACT;AAEA,YAAM,OAAO,WACV,MAAM,GAAG,OAAO,EAChB,IAAI,CAAC,QAAQ,OAAO,YAAY,OAAO,QAAQ,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC;AAE5G,aAAO,EAAE,MAAM,UAAU,WAAW,QAAQ,UAAU;AAAA,IACxD;AAAA,EACF;AACF;;;AC/GA,SAAS,YAA0B,YAAY;AAc/C,IAAM,mBAAmB,WAAkC;AAAA,EACzD,MAAM;AAAA,EACN,YAAY,CAAC;AAAA,EACb,sBAAsB;AACxB,CAAC;AAED,IAAM,mBAAmB,WAAoD;AAAA,EAC3E,MAAM;AAAA,EACN,YAAY;AAAA,IACV,KAAK;AAAA,MACH,MAAM;AAAA,MACN,aACE;AAAA,IACJ;AAAA,IACA,YAAY;AAAA,MACV,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,CAAC,UAAU,UAAU,WAAW,MAAM,EAAE;AAAA,MACvD,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,UAAU,CAAC,KAAK;AAAA,EAChB,sBAAsB;AACxB,CAAC;AAMM,SAAS,cAAc,MAA8D;AAC1F,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,MAChB,aACE;AAAA,MACF,aAAa;AAAA,MACb,SAAS,YAAY;AACnB,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,eAAO,MAAM,OAAO,aAAa;AAAA,MACnC;AAAA,IACF,CAAC;AAAA,IACD,SAAS,KAAK;AAAA,MACZ,aACE;AAAA,MACF,aAAa;AAAA,MACb,SAAS,OAAO,EAAE,KAAK,WAAW,MAAM;AACtC,cAAM,SAAS,MAAM,KAAK,OAAO;AACjC,eAAO,MAAM,OAAO,MAAM,EAAE,KAAK,WAAW,CAAC;AAAA,MAC/C;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sqlite-sync/ai",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "AI agent tools for @sqlite-sync databases",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@sqlite-sync/core": "^0.5.0",
+    "@sqlite-sync/core": "^0.6.0",
     "ai": "^6.0.0"
   },
   "devDependencies": {
@@ -39,7 +39,7 @@
     "tsup": "^8.3.5",
     "typescript": "~6.0.3",
     "vitest": "^4.1.8",
-    "@sqlite-sync/core": "0.5.0"
+    "@sqlite-sync/core": "0.6.0"
   },
   "scripts": {
     "build": "tsup",