@substrat-run/kernel 0.138.0 → 0.139.0

package/dist/spine-guard.d.ts

@@ -6,7 +6,61 @@ import type { ScopedSql } from './scope-host.js';
  * is a fault in the module, not in the caller's permissions, and the message names
  * the table so the author sees which line to delete.
  */
-export declare function assertNoSpineWrite(sql: string): void;
+export declare function assertNoSpineWrite(sql: string, statefulTables?: ReadonlySet<string>): void;
+/**
+ * Refuse runtime DDL that would take a stateful table's guarantees away (#119, Codex r3).
+ *
+ * #1811 made a module's own DDL through `ctx.sql` a supported path, and it stays one. But a table
+ * that carries archive/trash state is guarded by derived triggers ON THAT TABLE, and DDL can move
+ * the rows out from under them: `ALTER TABLE docs RENAME TO x; CREATE TABLE docs AS SELECT …,
+ * NULL AS _substrat_trashed_at FROM x` un-trashes everything with no move and no event. So, for a
+ * stateful table, in any spelling — quoted, any case, `main.`/`temp.`-qualified:
+ *
+ * - `ALTER TABLE <it>` that renames the table or a column, or drops a column; and `RENAME TO <it>`
+ *   from another table;
+ * - `DROP TABLE <it>`;
+ * - `CREATE [TEMP] TABLE|VIEW <it>` — a temp object of the same name SHADOWS the real table in
+ *   every unqualified reference, the kernel's own included;
+ * - `CREATE [TEMP] TRIGGER … ON <it>`.
+ *
+ * Plus, for any table, a trigger, index or view carrying the reserved prefix (the kernel's derived
+ * objects), and `ATTACH`/`DETACH` outright: nothing in module code needs a second database, and an
+ * attached one is a second place a stateful name can resolve. Ordinary runtime DDL — a module's own
+ * unrelated tables, an index on a stateful table, an added column — is untouched.
+ */
+export declare function assertNoStatefulDdl(sql: string, statefulTables: ReadonlySet<string>): void;
+/** Does this SQL change the schema — any statement in it a CREATE, ALTER or DROP? */
+export declare function changesSchema(sql: string): boolean;
+/**
+ * Refuse a statement that WRITES a `_substrat_*` column of a module's own table (#119).
+ *
+ * The kernel keeps state on module rows — `_substrat_archived_at`, `_substrat_trashed_at` —
+ * and a row's way into or out of the trash must be `ctx.trash`/`ctx.restore`, which check the
+ * declared key and emit the event. A module that could `UPDATE todo_lists SET
+ * _substrat_trashed_at = NULL` would restore without the key and without a record, which is
+ * the forgery the table rule above exists to stop, one level down.
+ *
+ * Judged by POSITION, so reading the columns stays allowed — in a `SELECT`, and in the `WHERE`
+ * of a write (`UPDATE … SET done = 1 WHERE _substrat_trashed_at IS NULL`). Refused:
+ *
+ * - an assignment target after `SET` — `UPDATE … SET`, an upsert's `DO UPDATE SET`, and a
+ *   trigger body's `UPDATE`, row-value targets `SET (a, b) = …` included;
+ * - a name in an `INSERT`/`REPLACE` column list;
+ * - any reserved name in an `ALTER TABLE` (add, rename or drop the column itself);
+ * - into a table that CARRIES the columns (`statefulTables`, lowercased names): an `INSERT`
+ *   with no column list — `VALUES (…)` and `SELECT …` fill the columns by position, the
+ *   reserved ones included, without ever naming them — and any `REPLACE` / `INSERT OR
+ *   REPLACE`, which deletes the existing row and writes a new one with the columns NULL, so
+ *   it un-archives and un-trashes without the key. An `INSERT … (columns) SELECT` and an
+ *   upsert's `DO UPDATE SET` are judged by the rules above.
+ *
+ * Below this sits a trigger on each such table that refuses a row born archived or trashed
+ * (`entityStateMigrations`), so a form this scan misses still cannot set the state.
+ *
+ * The prefix is reserved whole, not the two names: the next kernel-owned column is covered
+ * without anyone remembering to list it here.
+ */
+export declare function assertNoReservedColumnWrite(sql: string, statefulTables?: ReadonlySet<string>): void;
 /**
  * Refuse a statement whose `REFERENCES` clause names a `_substrat_*` table (#1898), for the
  * same reason `CREATE TRIGGER … ON` is refused above: the spine's rows become the parent of a
@@ -24,5 +78,13 @@ export declare function assertNoSpineReference(sql: string, what: string): void;
  * first. `query` is guarded too: SQLite runs `INSERT … RETURNING` perfectly well
  * through a `.all()`, so guarding only `exec` would leave the door open.
  */
-export declare function guardSpine(inner: ScopedSql): ScopedSql;
+export declare function guardSpine(inner: ScopedSql, 
+/** The module tables that carry archive/trash columns (#119), lowercased — see `assertNoReservedColumnWrite`. */
+statefulTables?: ReadonlySet<string>, 
+/**
+ * Run after any statement that changed the schema passed (#119, Codex r3): the kernel's own
+ * check that every stateful table still carries what it derived. It throws to fail closed —
+ * the operation, and the DDL with it, roll back.
+ */
+afterDdl?: () => void): ScopedSql;
 //# sourceMappingURL=spine-guard.d.ts.map

package/dist/spine-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spine-guard.d.ts","sourceRoot":"","sources":["../src/spine-guard.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAsD3D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsBpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtE;AAcD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAWtD"}
+{"version":3,"file":"spine-guard.d.ts","sourceRoot":"","sources":["../src/spine-guard.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,SAAS,EAAY,MAAM,iBAAiB,CAAC;AAsD3D;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAwB1F;AAYD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CA+E1F;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAelD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAgJnG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtE;AAcD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,SAAS;AAChB,iHAAiH;AACjH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;AACpC;;;;GAIG;AACH,QAAQ,CAAC,EAAE,MAAM,IAAI,GACpB,SAAS,CAYX"}

package/dist/spine-guard.js

@@ -94,7 +94,7 @@ function spineTargetFrom(tokens, from, verb) {
  * is a fault in the module, not in the caller's permissions, and the message names
  * the table so the author sees which line to delete.
  */
-export function assertNoSpineWrite(sql) {
+export function assertNoSpineWrite(sql, statefulTables) {
     const tokens = tokenizeSql(sql);
     for (let i = 0; i < tokens.length; i += 1) {
         const token = tokens[i];
@@ -115,6 +115,332 @@ export function assertNoSpineWrite(sql) {
             'Reads are fine; writes go through ctx.emit / ctx.link / ctx.grant.', { reason: 'spine_write' });
     }
     refuseSpineReference(referencedTablesIn(tokens), 'ctx.sql');
+    assertNoReservedColumnWrite(sql, statefulTables);
+    if (statefulTables?.size)
+        assertNoStatefulDdl(sql, statefulTables);
+}
+/** Statement verbs whose execution changes the schema — what `guardSpine`'s `afterDdl` follows. */
+const DDL_VERBS = new Set(['create', 'alter', 'drop']);
+/**
+ * A statement can be DDL only if its text spells one of these words, and almost none does — so the
+ * two scans below are skipped for nearly every statement a module runs. Text, not tokens: a word
+ * inside a string makes the scan run and find nothing, which costs a scan and nothing else.
+ */
+const MAYBE_DDL = /\b(create|alter|drop|attach|detach)\b/i;
+/**
+ * Refuse runtime DDL that would take a stateful table's guarantees away (#119, Codex r3).
+ *
+ * #1811 made a module's own DDL through `ctx.sql` a supported path, and it stays one. But a table
+ * that carries archive/trash state is guarded by derived triggers ON THAT TABLE, and DDL can move
+ * the rows out from under them: `ALTER TABLE docs RENAME TO x; CREATE TABLE docs AS SELECT …,
+ * NULL AS _substrat_trashed_at FROM x` un-trashes everything with no move and no event. So, for a
+ * stateful table, in any spelling — quoted, any case, `main.`/`temp.`-qualified:
+ *
+ * - `ALTER TABLE <it>` that renames the table or a column, or drops a column; and `RENAME TO <it>`
+ *   from another table;
+ * - `DROP TABLE <it>`;
+ * - `CREATE [TEMP] TABLE|VIEW <it>` — a temp object of the same name SHADOWS the real table in
+ *   every unqualified reference, the kernel's own included;
+ * - `CREATE [TEMP] TRIGGER … ON <it>`.
+ *
+ * Plus, for any table, a trigger, index or view carrying the reserved prefix (the kernel's derived
+ * objects), and `ATTACH`/`DETACH` outright: nothing in module code needs a second database, and an
+ * attached one is a second place a stateful name can resolve. Ordinary runtime DDL — a module's own
+ * unrelated tables, an index on a stateful table, an added column — is untouched.
+ */
+export function assertNoStatefulDdl(sql, statefulTables) {
+    if (!MAYBE_DDL.test(sql))
+        return;
+    const tokens = tokenizeSql(sql, { punctuation: true });
+    const refuse = (what) => {
+        throw substratError('forbidden', `ctx.sql cannot ${what}: its archive/trash state is guarded by the kernel's own triggers on it. ` +
+            'Change its schema in a declared migration.', { reason: 'spine_write' });
+    };
+    const bare = (t) => (t && !t.punct ? (t.text.split('.').pop() ?? '').toLowerCase() : '');
+    const stateful = (t) => statefulTables.has(bare(t));
+    const reserved = (t) => bare(t).startsWith('_substrat');
+    // One statement at a time: a `;` at the top ends it (trigger bodies hold their own `;`s, but
+    // a trigger is judged whole from its CREATE, and its body's statements are DML).
+    let start = 0;
+    while (start < tokens.length) {
+        let end = start;
+        let depth = 0;
+        let inBody = false;
+        // Only a CREATE … TRIGGER has a body. `begin` is a legal identifier elsewhere (`SELECT 1 AS
+        // begin`), and reading it as a body would swallow every statement after it into this one.
+        const head = tokens.slice(start, start + 4).map((t) => (t.quoted || t.punct ? '' : t.text.toLowerCase()));
+        const opensTrigger = head[0] === 'create' && head.slice(1).includes('trigger');
+        for (; end < tokens.length; end += 1) {
+            const t = tokens[end];
+            const kw = t.quoted || t.punct ? undefined : t.text.toLowerCase();
+            if (kw === 'begin' && opensTrigger)
+                inBody = true;
+            else if (kw === 'end' && inBody && depth === 0)
+                inBody = false;
+            else if (t.punct && t.text === '(')
+                depth += 1;
+            else if (t.punct && t.text === ')')
+                depth -= 1;
+            else if (t.punct && t.text === ';' && depth === 0 && !inBody)
+                break;
+        }
+        const st = tokens.slice(start, end);
+        start = end + 1;
+        const words = st.map((t) => (t.quoted || t.punct ? '' : t.text.toLowerCase()));
+        const verb = words[0];
+        if (verb === 'attach' || verb === 'detach')
+            refuse(`${verb.toUpperCase()} a database`);
+        if (verb === 'alter' && words[1] === 'table') {
+            const target = st[2];
+            const rest = words.slice(3);
+            if (stateful(target) && (rest.includes('rename') || rest[0] === 'drop')) {
+                refuse(`rename '${target.text}' or drop or rename its columns`);
+            }
+            const to = rest.indexOf('to');
+            if (rest[0] === 'rename' && to !== -1 && stateful(st[3 + to + 1])) {
+                refuse(`rename a table to '${st[3 + to + 1].text}'`);
+            }
+            continue;
+        }
+        if (verb === 'drop') {
+            let k = 1;
+            const kind = words[k];
+            k += 1;
+            if (words[k] === 'if' && words[k + 1] === 'exists')
+                k += 2;
+            if (kind === 'table' && stateful(st[k]))
+                refuse(`drop '${st[k].text}'`);
+            if ((kind === 'trigger' || kind === 'index' || kind === 'view') && reserved(st[k])) {
+                refuse(`drop the kernel's ${kind} '${st[k].text}'`);
+            }
+            continue;
+        }
+        if (verb === 'create') {
+            let k = 1;
+            while (['temp', 'temporary', 'unique', 'virtual'].includes(words[k] ?? ''))
+                k += 1;
+            const kind = words[k];
+            k += 1;
+            if (words[k] === 'if' && words[k + 1] === 'not' && words[k + 2] === 'exists')
+                k += 3;
+            const name = st[k];
+            if ((kind === 'table' || kind === 'view') && stateful(name))
+                refuse(`create a ${kind} named '${name.text}'`);
+            if ((kind === 'trigger' || kind === 'index' || kind === 'view') && reserved(name)) {
+                refuse(`create a ${kind} with the kernel's prefix ('${name.text}')`);
+            }
+            if (kind === 'trigger') {
+                const on = words.indexOf('on', k + 1);
+                if (on !== -1 && stateful(st[on + 1]))
+                    refuse(`create a trigger on '${st[on + 1].text}'`);
+            }
+        }
+    }
+}
+/** Does this SQL change the schema — any statement in it a CREATE, ALTER or DROP? */
+export function changesSchema(sql) {
+    if (!MAYBE_DDL.test(sql))
+        return false;
+    const tokens = tokenizeSql(sql, { punctuation: true });
+    let first = true;
+    for (const t of tokens) {
+        if (t.punct && t.text === ';') {
+            first = true;
+            continue;
+        }
+        if (first && !t.punct) {
+            if (!t.quoted && DDL_VERBS.has(t.text.toLowerCase()))
+                return true;
+            first = false;
+        }
+    }
+    return false;
+}
+/**
+ * Refuse a statement that WRITES a `_substrat_*` column of a module's own table (#119).
+ *
+ * The kernel keeps state on module rows — `_substrat_archived_at`, `_substrat_trashed_at` —
+ * and a row's way into or out of the trash must be `ctx.trash`/`ctx.restore`, which check the
+ * declared key and emit the event. A module that could `UPDATE todo_lists SET
+ * _substrat_trashed_at = NULL` would restore without the key and without a record, which is
+ * the forgery the table rule above exists to stop, one level down.
+ *
+ * Judged by POSITION, so reading the columns stays allowed — in a `SELECT`, and in the `WHERE`
+ * of a write (`UPDATE … SET done = 1 WHERE _substrat_trashed_at IS NULL`). Refused:
+ *
+ * - an assignment target after `SET` — `UPDATE … SET`, an upsert's `DO UPDATE SET`, and a
+ *   trigger body's `UPDATE`, row-value targets `SET (a, b) = …` included;
+ * - a name in an `INSERT`/`REPLACE` column list;
+ * - any reserved name in an `ALTER TABLE` (add, rename or drop the column itself);
+ * - into a table that CARRIES the columns (`statefulTables`, lowercased names): an `INSERT`
+ *   with no column list — `VALUES (…)` and `SELECT …` fill the columns by position, the
+ *   reserved ones included, without ever naming them — and any `REPLACE` / `INSERT OR
+ *   REPLACE`, which deletes the existing row and writes a new one with the columns NULL, so
+ *   it un-archives and un-trashes without the key. An `INSERT … (columns) SELECT` and an
+ *   upsert's `DO UPDATE SET` are judged by the rules above.
+ *
+ * Below this sits a trigger on each such table that refuses a row born archived or trashed
+ * (`entityStateMigrations`), so a form this scan misses still cannot set the state.
+ *
+ * The prefix is reserved whole, not the two names: the next kernel-owned column is covered
+ * without anyone remembering to list it here.
+ */
+export function assertNoReservedColumnWrite(sql, statefulTables) {
+    // Every token is a substring of the text, so a statement that never spells the prefix names
+    // no reserved column — and that is nearly every statement, which then skips the second scan.
+    // A positional write names no column at all, so it is looked for whenever a stateful table
+    // exists and the statement could be one.
+    const positional = statefulTables !== undefined && statefulTables.size > 0 && /\b(insert|replace)\b/i.test(sql);
+    if (!positional && !/_substrat/i.test(sql))
+        return;
+    const tokens = tokenizeSql(sql, { punctuation: true });
+    const refuse = (column, how) => {
+        throw substratError('forbidden', `ctx.sql cannot write the platform's column '${column}' (${how}). ` +
+            'Reads are fine; archive and trash go through ctx.archive / ctx.trash / ctx.restore.', { reason: 'spine_write' });
+    };
+    const refuseRow = (table, why) => {
+        throw substratError('forbidden', `ctx.sql cannot write '${table}' this way: ${why}. Name the columns you write; ` +
+            'archive and trash go through ctx.archive / ctx.trash / ctx.restore.', { reason: 'spine_write' });
+    };
+    const word = (k) => {
+        const t = tokens[k];
+        return t && !t.quoted && !t.punct ? t.text.toLowerCase() : undefined;
+    };
+    const isPunct = (k, c) => tokens[k]?.punct === true && tokens[k].text === c;
+    // Names inside one parenthesised group starting at `open`; returns the index after `)`.
+    const namesInParens = (open, onName) => {
+        let depth = 0;
+        let k = open;
+        for (; k < tokens.length; k += 1) {
+            const t = tokens[k];
+            if (t.punct && t.text === '(')
+                depth += 1;
+            else if (t.punct && t.text === ')') {
+                depth -= 1;
+                if (depth === 0)
+                    return k + 1;
+            }
+            else if (!t.punct && depth === 1)
+                onName(t.text);
+        }
+        return k;
+    };
+    /**
+     * Keywords that end an assignment list when they stand at its own depth. All reserved: none can
+     * be an unquoted identifier, so none can be mistaken for one. `END` is deliberately NOT here — it
+     * is a legal identifier (`SET end = 1, …`), and a trigger body's statements end at their own `;`.
+     */
+    const SET_ENDS = new Set(['where', 'from', 'returning', 'order', 'limit']);
+    /**
+     * The assignment targets of the `SET` list starting after `start`, judged by STRUCTURE.
+     *
+     * Everything that can hold a comma, a keyword or another `SET` is nested: a parenthesised
+     * expression or subquery, and a `CASE … END`, each pushed on one stack, so an `END` closes a
+     * `CASE` that is open and ends the list only when none is (the trigger body's `END`). Strings,
+     * comments and quoted identifiers never reach here as keywords — `tokenizeSql` keeps a quoted
+     * token apart. A target is the first token of the list and the first after each comma at the
+     * list's own depth; a `(a, b)` there is a row-value target, every name in it a target.
+     */
+    const setTargets = (start, onTarget) => {
+        const nesting = [];
+        let expectTarget = true;
+        for (let k = start; k < tokens.length; k += 1) {
+            const t = tokens[k];
+            const kw = t.quoted || t.punct ? undefined : t.text.toLowerCase();
+            if (nesting.length === 0) {
+                if (t.punct && (t.text === ';' || t.text === ')'))
+                    return;
+                if (kw !== undefined && SET_ENDS.has(kw))
+                    return;
+                if (t.punct && t.text === ',') {
+                    expectTarget = true;
+                    continue;
+                }
+                if (expectTarget) {
+                    expectTarget = false;
+                    if (t.punct && t.text === '(') {
+                        k = namesInParens(k, onTarget) - 1;
+                        continue;
+                    }
+                    if (!t.punct) {
+                        onTarget(t.text);
+                        continue;
+                    }
+                }
+            }
+            if (t.punct && t.text === '(')
+                nesting.push('paren');
+            else if (kw === 'case')
+                nesting.push('case');
+            else if (t.punct && t.text === ')') {
+                while (nesting.length && nesting.pop() !== 'paren')
+                    ;
+            }
+            else if (kw === 'end' && nesting[nesting.length - 1] === 'case')
+                nesting.pop();
+        }
+    };
+    for (let i = 0; i < tokens.length; i += 1) {
+        const verb = word(i);
+        if (verb === 'set') {
+            setTargets(i + 1, (name) => {
+                if (namesSpineTable(name))
+                    refuse(name, 'SET target');
+            });
+            continue;
+        }
+        if (verb === 'insert' || verb === 'replace') {
+            // `replace(` is SQLite's string function, not the statement — which always reads
+            // `REPLACE INTO`. Read as a statement, its argument list became a "column list".
+            if (verb === 'replace' && word(i + 1) !== 'into')
+                continue;
+            // By the grammar, not by a word list: `INSERT [OR <resolution>] INTO <table>` and
+            // `REPLACE INTO <table>`. A table may be NAMED `replace` or `ignore` — both are legal
+            // identifiers — and a loop skipping modifier words would skip it too.
+            let k = i + 1;
+            let replaces = verb === 'replace';
+            if (verb === 'insert' && word(k) === 'or') {
+                if (word(k + 1) === 'replace')
+                    replaces = true;
+                k += 2;
+            }
+            if (word(k) !== 'into')
+                continue;
+            k += 1;
+            const target = tokens[k];
+            if (!target || target.punct)
+                continue;
+            k += 1; // past the target table
+            if (word(k) === 'as')
+                k += 2; // an alias
+            const table = target && !target.punct ? (target.text.split('.').pop() ?? '').toLowerCase() : '';
+            if (statefulTables?.has(table)) {
+                if (replaces)
+                    refuseRow(target.text, 'REPLACE deletes the row and writes it back with no archive or trash state');
+                if (!isPunct(k, '(') && word(k) !== 'default') {
+                    refuseRow(target.text, 'an INSERT with no column list fills the archive/trash columns by position');
+                }
+            }
+            if (isPunct(k, '(')) {
+                namesInParens(k, (name) => {
+                    if (namesSpineTable(name))
+                        refuse(name, 'INSERT column');
+                });
+            }
+            continue;
+        }
+        if (verb === 'alter') {
+            // ALTER TABLE <t> …: the table is judged above; here, every other name in the statement.
+            let k = i + 1;
+            while (word(k) !== undefined && MODIFIERS.alter.has(word(k)))
+                k += 1;
+            for (k += 1; k < tokens.length && !isPunct(k, ';'); k += 1) {
+                const t = tokens[k];
+                if (!t.punct && namesSpineTable(t.text))
+                    refuse(t.text, 'ALTER TABLE');
+            }
+        }
+    }
 }
 /**
  * Refuse a statement whose `REFERENCES` clause names a `_substrat_*` table (#1898), for the
@@ -143,16 +469,25 @@ function refuseSpineReference(referenced, what) {
  * first. `query` is guarded too: SQLite runs `INSERT … RETURNING` perfectly well
  * through a `.all()`, so guarding only `exec` would leave the door open.
  */
-export function guardSpine(inner) {
+export function guardSpine(inner, 
+/** The module tables that carry archive/trash columns (#119), lowercased — see `assertNoReservedColumnWrite`. */
+statefulTables, 
+/**
+ * Run after any statement that changed the schema passed (#119, Codex r3): the kernel's own
+ * check that every stateful table still carries what it derived. It throws to fail closed —
+ * the operation, and the DDL with it, roll back.
+ */
+afterDdl) {
+    const follow = (sql, run) => {
+        assertNoSpineWrite(sql, statefulTables);
+        const result = run();
+        if (afterDdl && changesSchema(sql))
+            afterDdl();
+        return result;
+    };
     return {
-        query: (sql, params) => {
-            assertNoSpineWrite(sql);
-            return inner.query(sql, params);
-        },
-        exec: (sql, params) => {
-            assertNoSpineWrite(sql);
-            return inner.exec(sql, params);
-        },
+        query: (sql, params) => follow(sql, () => inner.query(sql, params)),
+        exec: (sql, params) => follow(sql, () => inner.exec(sql, params)),
     };
 }
 //# sourceMappingURL=spine-guard.js.map

package/dist/spine-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"spine-guard.js","sourceRoot":"","sources":["../src/spine-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAiB,MAAM,yBAAyB,CAAC;AAGzH;;;GAGG;AACH,MAAM,SAAS,GAAkD;IAC/D,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,MAAM;QACN,WAAW;QACX,QAAQ;QACR,SAAS;QACT,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,IAAI;QACJ,KAAK;QACL,QAAQ;KACT,CAAC;CACH,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAqC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAEtF,8FAA8F;AAC9F,SAAS,eAAe,CAAC,MAAkB,EAAE,IAAY,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO;YAAE,SAAS;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,OAAO,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/F,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,aAAa,CACjB,WAAW,EACX,4CAA4C,IAAI,CAAC,WAAW,EAAE,QAAQ,MAAM,CAAC,IAAI,KAAK;YACpF,oEAAoE,EACtE,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,oBAAoB,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,IAAY;IAC9D,oBAAoB,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,mEAAmE;AACnE,SAAS,oBAAoB,CAAC,UAA6B,EAAE,IAAY;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,oEAAoE,MAAM,KAAK;QACpF,4GAA4G,EAC9G,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,OAAO;QACL,KAAK,EAAE,CAA+B,GAAW,EAAE,MAA4B,EAAO,EAAE;YACtF,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,EAAE,CAAC,GAAW,EAAE,MAA4B,EAAE,EAAE;YAClD,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"spine-guard.js","sourceRoot":"","sources":["../src/spine-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,aAAa,EAAE,WAAW,EAAiB,MAAM,yBAAyB,CAAC;AAGzH;;;GAGG;AACH,MAAM,SAAS,GAAkD;IAC/D,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjF,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,EAAE,IAAI,GAAG,CAAC;QACd,MAAM;QACN,WAAW;QACX,QAAQ;QACR,SAAS;QACT,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,IAAI;QACJ,KAAK;QACL,QAAQ;KACT,CAAC;CACH,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAqC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAEtF,8FAA8F;AAC9F,SAAS,eAAe,CAAC,MAAkB,EAAE,IAAY,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO;YAAE,SAAS;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,OAAO,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,cAAoC;IAClF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/F,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,aAAa,CACjB,WAAW,EACX,4CAA4C,IAAI,CAAC,WAAW,EAAE,QAAQ,MAAM,CAAC,IAAI,KAAK;YACpF,oEAAoE,EACtE,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC;IACD,oBAAoB,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAC5D,2BAA2B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,cAAc,EAAE,IAAI;QAAE,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AACrE,CAAC;AAED,mGAAmG;AACnG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD;;;;GAIG;AACH,MAAM,SAAS,GAAG,wCAAwC,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,cAAmC;IAClF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO;IACjC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAS,EAAE;QACrC,MAAM,aAAa,CACjB,WAAW,EACX,kBAAkB,IAAI,2EAA2E;YAC/F,4CAA4C,EAC9C,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,CAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC9E,6FAA6F;IAC7F,iFAAiF;IACjF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,4FAA4F;QAC5F,0FAA0F;QAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1G,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/E,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClE,IAAI,EAAE,KAAK,OAAO,IAAI,YAAY;gBAAE,MAAM,GAAG,IAAI,CAAC;iBAC7C,IAAI,EAAE,KAAK,KAAK,IAAI,MAAM,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM,GAAG,KAAK,CAAC;iBAC1D,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;iBAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;iBAC1C,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM;QACtE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxE,MAAM,CAAC,WAAW,MAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAE,CAAC,IAAI,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ;gBAAE,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,GAAG,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,MAAM,CAAC,qBAAqB,IAAI,KAAK,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,GAAG,CAAC,CAAC;YACvD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ;gBAAE,CAAC,IAAI,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,YAAY,IAAI,WAAW,IAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YAC9G,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,YAAY,IAAI,+BAA+B,IAAK,CAAC,IAAI,IAAI,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,wBAAwB,EAAE,CAAC,EAAE,GAAG,CAAC,CAAE,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YAC9B,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClE,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAE,cAAoC;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,yCAAyC;IACzC,MAAM,UAAU,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChH,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO;IACnD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAW,EAAS,EAAE;QACpD,MAAM,aAAa,CACjB,WAAW,EACX,+CAA+C,MAAM,MAAM,GAAG,KAAK;YACjE,qFAAqF,EACvF,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,GAAW,EAAS,EAAE;QACtD,MAAM,aAAa,CACjB,WAAW,EACX,yBAAyB,KAAK,eAAe,GAAG,gCAAgC;YAC9E,qEAAqE,EACvE,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,CAAC,CAAC;IAC7F,wFAAwF;IACxF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAA8B,EAAU,EAAE;QAC7E,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,IAAI,CAAC;QACb,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAC;iBACrC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBACnC,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,KAAK,CAAC;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF;;;;OAIG;IACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3E;;;;;;;;;OASG;IACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,QAAgC,EAAQ,EAAE;QAC3E,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,IAAI,YAAY,GAAG,IAAI,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACrB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;oBAAE,OAAO;gBAC1D,IAAI,EAAE,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,OAAO;gBACjD,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC9B,YAAY,GAAG,IAAI,CAAC;oBACpB,SAAS;gBACX,CAAC;gBACD,IAAI,YAAY,EAAE,CAAC;oBACjB,YAAY,GAAG,KAAK,CAAC;oBACrB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;wBAC9B,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;wBACnC,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;wBACb,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;wBACjB,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAChD,IAAI,EAAE,KAAK,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;iBACxC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;gBACnC,OAAO,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,OAAO;oBAAC,CAAC;YACtD,CAAC;iBAAM,IAAI,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM;gBAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACnF,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,IAAI,eAAe,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,iFAAiF;YACjF,iFAAiF;YACjF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM;gBAAE,SAAS;YAC3D,kFAAkF;YAClF,sFAAsF;YACtF,sEAAsE;YACtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,QAAQ,GAAG,IAAI,KAAK,SAAS,CAAC;YAClC,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS;oBAAE,QAAQ,GAAG,IAAI,CAAC;gBAC/C,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;gBAAE,SAAS;YACjC,CAAC,IAAI,CAAC,CAAC;YACP,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK;gBAAE,SAAS;YACtC,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB;YAChC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW;YACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,IAAI,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/B,IAAI,QAAQ;oBAAE,SAAS,CAAC,MAAO,CAAC,IAAI,EAAE,2EAA2E,CAAC,CAAC;gBACnH,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC9C,SAAS,CAAC,MAAO,CAAC,IAAI,EAAE,2EAA2E,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpB,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE;oBACxB,IAAI,eAAe,CAAC,IAAI,CAAC;wBAAE,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;gBAC3D,CAAC,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,yFAAyF;YACzF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,KAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,IAAY;IAC9D,oBAAoB,CAAC,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,mEAAmE;AACnE,SAAS,oBAAoB,CAAC,UAA6B,EAAE,IAAY;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,aAAa,CACjB,WAAW,EACX,GAAG,IAAI,oEAAoE,MAAM,KAAK;QACpF,4GAA4G,EAC9G,EAAE,MAAM,EAAE,aAAa,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,KAAgB;AAChB,iHAAiH;AACjH,cAAoC;AACpC;;;;GAIG;AACH,QAAqB;IAErB,MAAM,MAAM,GAAG,CAAI,GAAW,EAAE,GAAY,EAAK,EAAE;QACjD,kBAAkB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;QACrB,IAAI,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,QAAQ,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,CAA+B,GAAW,EAAE,MAA4B,EAAO,EAAE,CACtF,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,EAAE,CAAC,GAAW,EAAE,MAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;KAChG,CAAC;AACJ,CAAC"}

package/dist/sql-identifier.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The check every kernel-derived DDL runs on a name before interpolating it (#827, #811, #119).
+ *
+ * SQL identifiers reach the DDL by interpolation — there is no parameter form for a table or
+ * column name — so every one is checked first. The inputs are declarations rather than user
+ * input, but a declaration is still a string somebody typed, and "it came from the manifest"
+ * is exactly the reasoning that makes an injection a surprise.
+ */
+export declare const SQL_IDENTIFIER: RegExp;
+/** `value`, or a throw naming the declaration (`where`) and the role it plays (`kind`). */
+export declare function assertSqlIdentifier(area: string, kind: string, value: string, where: string): string;
+//# sourceMappingURL=sql-identifier.d.ts.map

package/dist/sql-identifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-identifier.d.ts","sourceRoot":"","sources":["../src/sql-identifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAA6B,CAAC;AAEzD,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpG"}

package/dist/sql-identifier.js

@@ -0,0 +1,17 @@
+/**
+ * The check every kernel-derived DDL runs on a name before interpolating it (#827, #811, #119).
+ *
+ * SQL identifiers reach the DDL by interpolation — there is no parameter form for a table or
+ * column name — so every one is checked first. The inputs are declarations rather than user
+ * input, but a declaration is still a string somebody typed, and "it came from the manifest"
+ * is exactly the reasoning that makes an injection a surprise.
+ */
+export const SQL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** `value`, or a throw naming the declaration (`where`) and the role it plays (`kind`). */
+export function assertSqlIdentifier(area, kind, value, where) {
+    if (!SQL_IDENTIFIER.test(value)) {
+        throw new Error(`${area}: ${where} names ${kind} '${value}', which is not a plain SQL identifier`);
+    }
+    return value;
+}
+//# sourceMappingURL=sql-identifier.js.map

package/dist/sql-identifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-identifier.js","sourceRoot":"","sources":["../src/sql-identifier.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa,EAAE,KAAa;IAC1F,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,wCAAwC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@substrat-run/kernel",
-  "version": "0.138.0",
+  "version": "0.139.0",
   "description": "Substrat kernel contracts and services — pure TypeScript, no platform imports (D-14)",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -22,7 +22,7 @@
     "dist"
   ],
   "dependencies": {
-    "@substrat-run/contracts": "^0.138.0"
+    "@substrat-run/contracts": "^0.139.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.5",