@suss/sql 0.32.0 → 0.33.0

package/README.md

@@ -12,7 +12,21 @@ A reader, not a pack. A pattern pack that meets a query written as SQL rather th
 import { readSqlAccess } from "@suss/sql";
 
 readSqlAccess("SELECT id, email FROM users WHERE tenant_id = $1");
-// [{ table: "users", kind: "read", fields: ["id", "email"], selector: ["tenant_id"] }]
+// [{ table: "users", qualifier: [], kind: "read", fields: ["id", "email"], selector: ["tenant_id"] }]
+```
+
+`qualifier` is the namespaces written in front of the table, outermost first. Postgres and MySQL hand the schema back separately and it never reaches the table, so those are always empty. BigQuery addresses a table as `` `project.dataset.table` `` and the parser hands back the whole quoted string, so this splits it: the table is the one a provider declares, and the dataset is the namespace to record the access under.
+
+```ts
+readSqlAccess("SELECT id FROM `analytics.core.dim_account`", { dialect: "bigquery" });
+// [{ table: "dim_account", qualifier: ["analytics", "core"], ... }]
+```
+
+A pack that reads a table off a call's argument rather than out of a statement, the way `client.get_table("analytics.core.dim_account")` states one, splits it through `splitQualifiedTable` so both spellings land on the same table and the same namespace. It gives back nothing for a table that came through as a parameter.
+
+```ts
+splitQualifiedTable("analytics.core.dim_account");
+// { table: "dim_account", qualifier: ["analytics", "core"] }
 ```
 
 The statement is parsed rather than pattern-matched, so a join contributes every table it reads:
@@ -22,8 +36,76 @@ readSqlAccess("SELECT u.email, o.total FROM users u JOIN orders o ON o.user_id =
 // [{ table: "users", fields: ["email"], ... }, { table: "orders", fields: ["total"], ... }]
 ```
 
+A query written in place of a table is read for its own tables. The alias belongs to that query's columns rather than to a base table, so a column read through the alias is dropped rather than attributed to one:
+
+```ts
+readSqlAccess("SELECT dc.account_id FROM (SELECT account_id FROM dim_contact) dc JOIN dim_account a ON a.id = dc.account_id");
+// [{ table: "dim_account", fields: [], ... }, { table: "dim_contact", fields: ["account_id"], ... }]
+```
+
+A write reads too. An insert can take its rows from a query, and an update or a delete can reach another table to pick the rows it changes:
+
+```ts
+readSqlAccess("INSERT INTO runs (id) SELECT id FROM jobs");
+// [{ table: "runs", kind: "write", fields: ["id"], ... }, { table: "jobs", kind: "read", fields: ["id"], ... }]
+```
+
+Every branch of a set operation is read, whether the statement writes it on its own, inside a `WITH` clause, or in place of a table. `SELECT id FROM orders UNION SELECT id FROM refunds` gives back a read on `orders` and one on `refunds`, each with the field `id`.
+
+Wherever a field turns up, it goes on the table the statement qualified it to, and a `WHERE` puts it in the selector rather than the fields. So the table an update reads from lists its join key the way a table a select joins to would:
+
+```ts
+readSqlAccess("UPDATE runs SET state = $1 FROM jobs WHERE runs.job_id = jobs.id");
+// [{ table: "runs", kind: "write", fields: ["state"], selector: ["job_id"] },
+//  { table: "jobs", kind: "read", fields: [], selector: ["id"] }]
+```
+
+What a `RETURNING` hands back, and what an `ON CONFLICT` matches on and then sets, are all columns of the one table the statement writes, so they go on that write rather than on a second access: a consumer pairs one access per table against the schema, and a field the statement both writes and hands back is listed once. `INSERT INTO users (email) VALUES ($1) ON CONFLICT (email) DO UPDATE SET name = EXCLUDED.name RETURNING id` writes `users` with the fields `email`, `id` and `name`.
+
+Not every grammar takes every spelling of these. `UPDATE ... FROM` is Postgres alone, and BigQuery parses the statement but drops the clause, so there it gives back the write by itself. No grammar here takes `DELETE ... USING`. `INTERSECT` and `EXCEPT` are Postgres and MySQL, `RETURNING` is Postgres and SQLite, and `ON CONFLICT` is Postgres, where the other three grammars take `ON DUPLICATE KEY UPDATE` instead.
+
+The grammar behind this turns down two spellings that say nothing about which table is touched, so a statement it refuses is tried again without them: a parameter written with the type it is read as, such as `$1::text` or `$1::int[]`, and a select that locks the rows it picks, such as `FOR UPDATE SKIP LOCKED`. Neither is rewritten inside a literal, a quoted name or a comment.
+
+The grammar also takes a `WITH` clause only in front of a select. In front of an insert, an update or a delete the clause is split off and each query read on its own, which is the most that can be read of a statement the grammar will not take whole:
+
+```ts
+readSqlAccess("WITH due AS (SELECT id FROM jobs FOR UPDATE SKIP LOCKED) INSERT INTO job_runs (job_id) SELECT id FROM due");
+// [{ table: "job_runs", kind: "write", fields: ["job_id"], ... }, { table: "jobs", kind: "read", fields: ["id"], ... }]
+```
+
 A query written as a tagged template becomes readable through `sqlFromParts`, which writes each interpolation as a parameter. What a query interpolates is a value nearly every time, and a parameter is how the statement would supply one anyway.
 
+Two things override that. A caller who knows a hole is a table passes it in `substitutions`, which is how a Drizzle query that interpolates a schema object reaches the statement as a table name. And a caller who ran the source's own evaluator over each hole passes the results in `settled`, which are used where the statement writes a name.
+
+There are two of those places. One is inside a quoted name, which is how BigQuery addresses a table:
+
+```ts
+// `SELECT id FROM \`${TABLE}\`` with TABLE = "analytics.core.dim_account"
+sqlFromParts(["SELECT id FROM `", "`"], [], ["analytics.core.dim_account"]);
+// SELECT id FROM `analytics.core.dim_account`
+```
+
+The other is straight after `FROM`, `JOIN`, `INTO`, `UPDATE` or `TABLE`, in any case. Postgres code leaves the table unquoted nearly every time, so the quote alone would miss the commonest way a project interpolates one:
+
+```ts
+// `SELECT id FROM ${TABLE} WHERE id = $1` with TABLE = "users"
+sqlFromParts(["SELECT id FROM ", " WHERE id = $1"], [], ["users"]);
+// SELECT id FROM users WHERE id = $1
+```
+
+A hole anywhere else is left alone even when the evaluator settled it. `WHERE tier = ${TIER}` with `TIER = "gold"` would parse as a column called `gold` and put it in the selector, which is worse than the parameter the reader would otherwise see. Where the statement writes a name there is no such ambiguity: whatever the hole came to is part of the name.
+
+A part of a name nothing settled stays a parameter, and the qualifier is then read from the table outward and stops there. The part beside the table is the one a scope comes from, so a project read as though it were a dataset would place the access somewhere it never went:
+
+```
+analytics.core.dim_account   → dim_account, ["analytics", "core"]
+$1.core.dim_account          → dim_account, ["core"]
+analytics.$1.dim_account     → dim_account, []
+$1                           → nothing
+```
+
+A whole table nothing settled produces nothing at all.
+
 It reads Postgres, MySQL, SQLite, and BigQuery. Pass the dialect the way a pack states its store:
 
 ```ts
@@ -33,7 +115,7 @@ readSqlAccess("SELECT `id` FROM `users`", { dialect: "mysql" });
 ## What it will not tell you
 
 - **A dialect it does not read gives back nothing.** So does a statement it cannot parse. Neither produces a guess built out of whatever the text happens to spell.
-- **An unqualified field in a join is left out.** `SELECT id FROM users u JOIN orders o ON ...` says nothing about which table `id` is on, so it is dropped rather than attributed to both.
+- **An unqualified field in a join is left out.** `SELECT id FROM users u JOIN orders o ON ...` says nothing about which table `id` is on, so it is dropped rather than attributed to both. A query written in place of a table counts as one of the sides, since it could have supplied the field too.
 - **An interpolated table or clause makes a statement unreadable.** ``sql`SELECT * FROM ${table}` `` cannot be settled without running it, so it produces nothing.
 
 ## Where it fits in suss

package/dist/index.cjs

@@ -21998,6 +21998,7 @@ var require_sqlite = __commonJS({
 var index_exports = {};
 __export(index_exports, {
   readSqlAccess: () => readSqlAccess,
+  splitQualifiedTable: () => splitQualifiedTable,
   sqlFromParts: () => sqlFromParts
 });
 module.exports = __toCommonJS(index_exports);
@@ -22012,68 +22013,351 @@ var DIALECTS = {
   bigquery: { module: import_bigquery.default, database: "bigquery" }
 };
 function readSqlAccess(sql, options = {}) {
-  const dialect = DIALECTS[options.dialect ?? "postgresql"];
-  if (dialect === void 0) {
+  const grammar = DIALECTS[options.dialect ?? "postgresql"];
+  if (grammar === void 0) {
     return [];
   }
+  return accessesInSql(sql, grammar).map(qualified).filter((access) => access !== null);
+}
+function accessesInSql(sql, grammar) {
+  const written = parsedAccesses(sql, grammar);
+  if (written !== null) {
+    return written;
+  }
+  const readable = rewrittenForGrammar(sql);
+  const rewritten = readable === sql ? null : parsedAccesses(readable, grammar);
+  return rewritten ?? accessesAroundWith(readable, grammar);
+}
+function parsedAccesses(sql, grammar, defined = /* @__PURE__ */ new Set()) {
   let parsed;
   try {
-    parsed = new dialect.module.Parser().astify(sql, {
-      database: dialect.database
+    parsed = new grammar.module.Parser().astify(sql, {
+      database: grammar.database
     });
   } catch {
-    return [];
+    return null;
   }
   const statements = Array.isArray(parsed) ? parsed : [parsed];
-  return statements.flatMap((statement) => accessesIn(statement, /* @__PURE__ */ new Set()));
+  return statements.flatMap((statement) => accessesIn(statement, defined));
 }
-function sqlFromParts(parts, substitutions = []) {
-  return parts.map((part, index) => {
-    if (index === 0) {
-      return part;
+var QUALIFIER_SEPARATOR = ".";
+function splitQualifiedTable(name) {
+  const parts = name.split(QUALIFIER_SEPARATOR);
+  const table = parts[parts.length - 1] ?? name;
+  if (!isSettled(table)) {
+    return null;
+  }
+  return { table, qualifier: namespacesAround(parts.slice(0, -1)) };
+}
+function namespacesAround(namespaces) {
+  const found = [];
+  for (let index = namespaces.length - 1; index >= 0; index -= 1) {
+    const part = namespaces[index];
+    if (part === void 0 || !isSettled(part)) {
+      break;
     }
-    const settled = substitutions[index - 1];
-    return `${settled ?? `$${index}`}${part}`;
+    found.unshift(part);
+  }
+  return found;
+}
+function qualified(access) {
+  const split = splitQualifiedTable(access.table);
+  return split === null ? null : { ...access, ...split };
+}
+function isSettled(part) {
+  return part !== "" && !/^\$\d+$/.test(part);
+}
+function sqlFromParts(parts, substitutions = [], settled = []) {
+  let closing = null;
+  return parts.map((part, index) => {
+    const names = namePosition(closing, parts[index - 1] ?? "");
+    const inHole = index === 0 ? null : substitutions[index - 1] ?? (names ? settled[index - 1] ?? null : null);
+    closing = quoteAfter(closing, part);
+    return index === 0 ? part : `${inHole ?? `$${index}`}${part}`;
   }).join("");
 }
+var TABLE_KEYWORD = /\b(?:from|join|into|update|table)\s+$/i;
+function namePosition(closing, before) {
+  return closing !== null || TABLE_KEYWORD.test(before);
+}
+var NAME_QUOTES = { '"': '"', "`": "`", "[": "]" };
+function quoteAfter(open, part) {
+  let closing = open;
+  for (const character of part) {
+    if (closing === null) {
+      closing = NAME_QUOTES[character] ?? null;
+      continue;
+    }
+    if (character === closing) {
+      closing = null;
+    }
+  }
+  return closing;
+}
+var TEXT_RUNS = [
+  { open: "--", close: "\n", comment: true },
+  { open: "/*", close: "*/", comment: true },
+  { open: "'", close: "'", comment: false },
+  { open: '"', close: '"', comment: false },
+  { open: "`", close: "`", comment: false }
+];
+var DOLLAR_TAG = /\$(?:[A-Za-z_]\w*)?\$/y;
+function textRunAt(sql, index) {
+  DOLLAR_TAG.lastIndex = index;
+  const tag = DOLLAR_TAG.exec(sql)?.[0];
+  if (tag !== void 0) {
+    return { end: closingAt(sql, index + tag.length, tag), comment: false };
+  }
+  for (const run of TEXT_RUNS) {
+    if (sql.startsWith(run.open, index)) {
+      const from = index + run.open.length;
+      return { end: closingAt(sql, from, run.close), comment: run.comment };
+    }
+  }
+  return null;
+}
+function closingAt(sql, from, close) {
+  const at = sql.indexOf(close, from);
+  return at === -1 ? sql.length : at + close.length;
+}
+function codeMask(sql) {
+  const mask = new Array(sql.length).fill(true);
+  let index = 0;
+  while (index < sql.length) {
+    const run = textRunAt(sql, index);
+    if (run === null) {
+      index += 1;
+      continue;
+    }
+    for (let at = index; at < run.end; at += 1) {
+      mask[at] = false;
+    }
+    index = run.end;
+  }
+  return mask;
+}
+function replaceInCode(sql, pattern, rewrite) {
+  const mask = codeMask(sql);
+  let rewritten = "";
+  let from = 0;
+  for (const match of sql.matchAll(pattern)) {
+    const at = match.index;
+    if (at === void 0 || mask[at] === false) {
+      continue;
+    }
+    rewritten += sql.slice(from, at) + rewrite(match);
+    from = at + match[0].length;
+  }
+  return rewritten + sql.slice(from);
+}
+var TYPE_WORD = String.raw`(?:"[^"]*"|\w+)`;
+var TYPE_SIZE = String.raw`(?:\s*\(\s*\d+\s*(?:,\s*\d+\s*)?\))?`;
+var TYPE_TAIL = String.raw`(?:\s+(?:precision|varying|with(?:out)?\s+time\s+zone))?`;
+var CAST_TYPE = `${TYPE_WORD}(?:\\s*\\.\\s*${TYPE_WORD})?${TYPE_SIZE}${TYPE_TAIL}${TYPE_SIZE}(?:\\s*\\[\\s*\\])*`;
+var PARAMETER_CAST = new RegExp(
+  String.raw`(\$\d+)(?:\s*::\s*${CAST_TYPE})+`,
+  "gi"
+);
+var LOCKING_CLAUSE = new RegExp(
+  String.raw`\bfor\s+(?:no\s+key\s+update|key\s+share|update|share)` + String.raw`(?:\s+of\s+${TYPE_WORD}(?:\s*,\s*${TYPE_WORD})*)?` + String.raw`(?:\s+(?:nowait|skip\s+locked))?`,
+  "gi"
+);
+function rewrittenForGrammar(sql) {
+  const uncast = replaceInCode(sql, PARAMETER_CAST, castAwayFrom);
+  return replaceInCode(uncast, LOCKING_CLAUSE, nothing);
+}
+function castAwayFrom(match) {
+  return match[1] ?? "";
+}
+function nothing() {
+  return "";
+}
+function accessesAroundWith(sql, grammar) {
+  const split = splitWith(sql);
+  if (split === null) {
+    return [];
+  }
+  const names = /* @__PURE__ */ new Set();
+  const inside = [];
+  for (const table of split.tables) {
+    inside.push(...parsedAccesses(table.body, grammar, names) ?? []);
+    names.add(table.name);
+  }
+  const own = parsedAccesses(split.main, grammar, names) ?? [];
+  return [...own, ...inside];
+}
+function splitWith(sql) {
+  const mask = codeMask(sql);
+  let index = nextToken(sql, 0);
+  if (!wordAt(sql, index, "with")) {
+    return null;
+  }
+  index = pastWord(sql, index, "with");
+  if (wordAt(sql, index, "recursive")) {
+    index = pastWord(sql, index, "recursive");
+  }
+  const tables = [];
+  for (; ; ) {
+    const named = nameAt(sql, index);
+    if (named === null) {
+      return null;
+    }
+    index = afterColumnList(sql, mask, nextToken(sql, named.end));
+    if (index === -1 || !wordAt(sql, index, "as")) {
+      return null;
+    }
+    index = pastMaterialized(sql, pastWord(sql, index, "as"));
+    const end = afterGroup(sql, mask, index);
+    if (end === null) {
+      return null;
+    }
+    tables.push({ name: named.name, body: sql.slice(index + 1, end - 1) });
+    index = nextToken(sql, end);
+    if (sql[index] !== ",") {
+      return { tables, main: sql.slice(index) };
+    }
+    index = nextToken(sql, index + 1);
+  }
+}
+function afterColumnList(sql, mask, index) {
+  if (sql[index] !== "(") {
+    return index;
+  }
+  const end = afterGroup(sql, mask, index);
+  return end === null ? -1 : nextToken(sql, end);
+}
+function pastMaterialized(sql, index) {
+  const past = wordAt(sql, index, "not") ? pastWord(sql, index, "not") : index;
+  return wordAt(sql, past, "materialized") ? pastWord(sql, past, "materialized") : past;
+}
+function nextToken(sql, from) {
+  let index = from;
+  while (index < sql.length) {
+    if (/\s/.test(sql[index] ?? "")) {
+      index += 1;
+      continue;
+    }
+    const run = textRunAt(sql, index);
+    if (run === null || !run.comment) {
+      return index;
+    }
+    index = run.end;
+  }
+  return index;
+}
+function wordAt(sql, index, word) {
+  const written = sql.slice(index, index + word.length).toLowerCase();
+  return written === word && !/\w/.test(sql[index + word.length] ?? "");
+}
+function pastWord(sql, index, word) {
+  return nextToken(sql, index + word.length);
+}
+function nameAt(sql, index) {
+  if (sql[index] === '"') {
+    const close = sql.indexOf('"', index + 1);
+    return close === -1 ? null : { name: sql.slice(index + 1, close), end: close + 1 };
+  }
+  const word = /^\w+/.exec(sql.slice(index))?.[0];
+  return word === void 0 ? null : { name: word, end: index + word.length };
+}
+function afterGroup(sql, mask, index) {
+  if (sql[index] !== "(" || mask[index] === false) {
+    return null;
+  }
+  let depth = 0;
+  for (let at = index; at < sql.length; at += 1) {
+    if (mask[at] === false) {
+      continue;
+    }
+    if (sql[at] === "(") {
+      depth += 1;
+      continue;
+    }
+    if (sql[at] !== ")") {
+      continue;
+    }
+    depth -= 1;
+    if (depth === 0) {
+      return at + 1;
+    }
+  }
+  return null;
+}
 function accessesIn(statement, defined) {
   const node = asNode(statement);
   if (node === null) {
     return [];
   }
+  const clause = commonTables(node, defined);
+  return [...ownAccesses(node, clause.names), ...clause.inside];
+}
+function ownAccesses(node, defined) {
   if (node.type === "select") {
-    return selectAccesses(node, defined);
+    return [
+      ...selectAccesses(node, defined),
+      ...accessesIn(node._next, defined)
+    ];
   }
   if (node.type === "insert") {
-    return oneAccess(firstTable(node.table), {
-      kind: "write",
-      fields: namesOf(node.columns),
-      selector: []
-    });
+    return insertAccesses(node, defined);
   }
   if (node.type === "update") {
-    return oneAccess(firstTable(node.table), {
-      kind: "write",
-      fields: refsIn(node.set).map((ref) => ref.field),
-      selector: selectorFields(node.where)
-    });
+    return updateAccesses(node, defined);
   }
   if (node.type === "delete") {
-    return oneAccess(firstTable(node.from) ?? firstTable(node.table), {
-      kind: "write",
-      fields: [],
-      selector: selectorFields(node.where)
-    });
+    return deleteAccesses(node, defined);
   }
   return [];
 }
-function oneAccess(table, rest) {
-  return table === null ? [] : [{ table, ...rest }];
+function insertAccesses(node, defined) {
+  const conflict = conflictClauses(node);
+  const stated = {
+    fields: [
+      ...unqualified(namesOf(node.columns)),
+      ...refsIn(node.returning),
+      ...conflict.fields
+    ],
+    selector: conflict.selector
+  };
+  const sources = sourcesIn(node.table, defined);
+  return [
+    ...accessesAcross(sources, firstTable(node.table), stated, defined),
+    ...accessesIn(node.values, defined)
+  ];
+}
+function updateAccesses(node, defined) {
+  const sources = sourcesAcross([node.table, node.from], defined);
+  const stated = {
+    fields: [...setTargets(node.set), ...refsIn(node.returning)],
+    selector: refsIn(node.where)
+  };
+  return accessesAcross(sources, firstTable(node.table), stated, defined);
+}
+function deleteAccesses(node, defined) {
+  const written = deletedTable(node);
+  const stated = {
+    fields: refsIn(node.returning),
+    selector: refsIn(node.where)
+  };
+  const sources = withTable(sourcesIn(node.from, defined), written);
+  return accessesAcross(sources, written, stated, defined);
 }
-function selectAccesses(statement, outer) {
+function conflictClauses(node) {
+  const conflict = asNode(node.conflict);
+  const action = asNode(asNode(conflict?.action)?.expr);
+  return {
+    fields: [
+      ...refsIn(conflict?.target),
+      ...setTargets(action?.set),
+      ...setTargets(asNode(node.on_duplicate_update)?.set)
+    ],
+    selector: refsIn(action?.where)
+  };
+}
+function commonTables(node, outer) {
   const names = new Set(outer);
   const inside = [];
-  for (const entry of Array.isArray(statement.with) ? statement.with : []) {
+  for (const entry of Array.isArray(node.with) ? node.with : []) {
     const cte = asNode(entry);
     if (cte === null) {
       continue;
@@ -22082,52 +22366,69 @@ function selectAccesses(statement, outer) {
     if (name === null) {
       continue;
     }
-    inside.push(...accessesIn(cte.stmt, names));
+    inside.push(...accessesIn(statementOf(cte.stmt), names));
     names.add(name);
   }
-  const tables = tablesIn(statement.from);
-  if (tables.size === 0) {
-    return inside;
+  return { names, inside };
+}
+function deletedTable(node) {
+  const first = asNode(Array.isArray(node.table) ? node.table[0] : null);
+  const aliased = first === null ? null : stringOf(first.as);
+  if (first !== null && stringOf(first.table) === "FROM" && aliased !== null) {
+    return aliased;
   }
-  const named = [...new Set(tables.values())];
-  const only = named.length === 1 ? named[0] ?? null : null;
-  const fields = /* @__PURE__ */ new Map();
-  const selectors = /* @__PURE__ */ new Map();
-  const record = (into, alias, field) => {
-    const table = alias === void 0 ? only : tables.get(alias) ?? null;
-    if (table === null) {
-      return;
-    }
-    const found = into.get(table) ?? /* @__PURE__ */ new Set();
-    found.add(field);
-    into.set(table, found);
+  return firstTable(node.from) ?? firstTable(node.table);
+}
+function selectAccesses(statement, names) {
+  const stated = {
+    fields: refsIn(statement.columns),
+    selector: refsIn(statement.where)
   };
-  for (const ref of refsIn(statement.columns)) {
-    record(fields, ref.table, ref.field);
-  }
-  for (const ref of refsIn(statement.where)) {
-    record(selectors, ref.table, ref.field);
-  }
-  const own = named.filter((table) => !names.has(table)).map((table) => ({
+  return accessesAcross(sourcesIn(statement.from, names), null, stated, names);
+}
+function accessesAcross(sources, written, stated, defined) {
+  const named = [...new Set(sources.tables.values())];
+  const only = named.length === 1 && !sources.derived ? named[0] ?? null : null;
+  const fields = byTable(stated.fields, sources.tables, written ?? only);
+  const selector = byTable(stated.selector, sources.tables, only);
+  const own = named.filter((table) => !defined.has(table)).map((table) => ({
     table,
-    kind: "read",
-    fields: [...fields.get(table) ?? []],
-    selector: [...selectors.get(table) ?? []]
+    qualifier: [],
+    kind: table === written ? "write" : "read",
+    fields: fields.get(table) ?? [],
+    selector: selector.get(table) ?? []
   }));
-  return [...own, ...inside];
+  return [...own, ...sources.inside];
 }
-function tablesIn(from) {
-  const tables = /* @__PURE__ */ new Map();
-  if (!Array.isArray(from)) {
-    return tables;
+function byTable(refs, tables, only) {
+  const found = /* @__PURE__ */ new Map();
+  for (const ref of refs) {
+    const table = ref.table === void 0 ? only : tables.get(ref.table) ?? null;
+    if (table === null) {
+      continue;
+    }
+    const already = found.get(table) ?? [];
+    if (!already.includes(ref.field)) {
+      already.push(ref.field);
+    }
+    found.set(table, already);
   }
-  for (const entry of from) {
+  return found;
+}
+function sourcesIn(from, defined) {
+  const tables = /* @__PURE__ */ new Map();
+  const inside = [];
+  let derived = false;
+  for (const entry of Array.isArray(from) ? from : []) {
     const node = asNode(entry);
     if (node === null) {
       continue;
     }
     const table = stringOf(node.table);
     if (table === null) {
+      const query = statementOf(node.expr);
+      derived = derived || query !== null;
+      inside.push(...accessesIn(query, defined));
       continue;
     }
     tables.set(table, table);
@@ -22136,10 +22437,37 @@ function tablesIn(from) {
       tables.set(alias, table);
     }
   }
-  return tables;
+  return { tables, inside, derived };
+}
+function statementOf(value) {
+  const node = asNode(value);
+  if (node === null) {
+    return null;
+  }
+  return node.ast ?? node;
+}
+function sourcesAcross(clauses, defined) {
+  const tables = /* @__PURE__ */ new Map();
+  const inside = [];
+  let derived = false;
+  for (const clause of clauses) {
+    const found = sourcesIn(clause, defined);
+    for (const [name, table] of found.tables) {
+      tables.set(name, table);
+    }
+    inside.push(...found.inside);
+    derived = derived || found.derived;
+  }
+  return { tables, inside, derived };
+}
+function withTable(sources, table) {
+  if (table === null || sources.tables.has(table)) {
+    return sources;
+  }
+  return { ...sources, tables: new Map([[table, table], ...sources.tables]) };
 }
 function firstTable(value) {
-  return [...tablesIn(value).values()][0] ?? null;
+  return [...sourcesIn(value, /* @__PURE__ */ new Set()).tables.values()][0] ?? null;
 }
 function refsIn(value) {
   const found = [];
@@ -22168,11 +22496,19 @@ function refsIn(value) {
   walk(value);
   return found;
 }
-function selectorFields(where) {
+function unqualified(names) {
+  return names.map((field) => ({ table: void 0, field }));
+}
+function setTargets(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
   const found = [];
-  for (const ref of refsIn(where)) {
-    if (!found.includes(ref.field)) {
-      found.push(ref.field);
+  for (const entry of value) {
+    const node = asNode(entry);
+    const field = node === null ? null : columnName(node.column);
+    if (node !== null && field !== null) {
+      found.push({ table: stringOf(node.table) ?? void 0, field });
     }
   }
   return found;
@@ -22207,5 +22543,6 @@ function asNode(value) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   readSqlAccess,
+  splitQualifiedTable,
   sqlFromParts
 });

package/dist/index.d.cts

@@ -10,11 +10,20 @@
  *
  * A statement this cannot parse gives back nothing, which is what a
  * reader that cannot settle something says everywhere else. The README
- * says which dialects it reads and what it leaves out.
+ * says which dialects it reads and what it leaves out. A spelling the
+ * grammar turns down is rewritten and tried again rather than given up.
  */
 /** One table a statement touches, and what it does to it. */
 interface SqlAccess {
     table: string;
+    /**
+     * The namespaces the statement put in front of the table, outermost
+     * first. BigQuery writes `project.dataset.table`, so a reader that
+     * kept the whole string would record a container no provider spells.
+     * A part the caller could not settle is left out rather than carried
+     * through as a parameter.
+     */
+    qualifier: string[];
     kind: "read" | "write";
     /** The fields the statement states, or `["*"]` for a whole row. */
     fields: string[];
@@ -27,6 +36,19 @@ interface SqlReadOptions {
 }
 /** Every table a statement touches, or nothing when it cannot be read. */
 declare function readSqlAccess(sql: string, options?: SqlReadOptions): SqlAccess[];
+/** A table name, split from the namespaces written in front of it. */
+interface QualifiedTable {
+    table: string;
+    /** The namespaces in front of the table, outermost first. */
+    qualifier: string[];
+}
+/**
+ * A table split from the namespaces written in front of it, or nothing
+ * when the table itself came through as a parameter. A pack that reads
+ * a table off an argument splits it through here too, so it agrees with
+ * a table read out of a statement. The README says more.
+ */
+declare function splitQualifiedTable(name: string): QualifiedTable | null;
 /**
  * The SQL a tagged template states, with each interpolation written as
  * a parameter. What a query interpolates is a value nearly every time,
@@ -39,6 +61,6 @@ declare function readSqlAccess(sql: string, options?: SqlReadOptions): SqlAccess
  * settle stays a parameter, and a statement that needed one somewhere a
  * parameter cannot go reads as nothing.
  */
-declare function sqlFromParts(parts: readonly string[], substitutions?: ReadonlyArray<string | null>): string;
+declare function sqlFromParts(parts: readonly string[], substitutions?: ReadonlyArray<string | null>, settled?: ReadonlyArray<string | null>): string;
 
-export { type SqlAccess, type SqlReadOptions, readSqlAccess, sqlFromParts };
+export { type QualifiedTable, type SqlAccess, type SqlReadOptions, readSqlAccess, splitQualifiedTable, sqlFromParts };

package/dist/index.d.ts

@@ -10,11 +10,20 @@
  *
  * A statement this cannot parse gives back nothing, which is what a
  * reader that cannot settle something says everywhere else. The README
- * says which dialects it reads and what it leaves out.
+ * says which dialects it reads and what it leaves out. A spelling the
+ * grammar turns down is rewritten and tried again rather than given up.
  */
 /** One table a statement touches, and what it does to it. */
 interface SqlAccess {
     table: string;
+    /**
+     * The namespaces the statement put in front of the table, outermost
+     * first. BigQuery writes `project.dataset.table`, so a reader that
+     * kept the whole string would record a container no provider spells.
+     * A part the caller could not settle is left out rather than carried
+     * through as a parameter.
+     */
+    qualifier: string[];
     kind: "read" | "write";
     /** The fields the statement states, or `["*"]` for a whole row. */
     fields: string[];
@@ -27,6 +36,19 @@ interface SqlReadOptions {
 }
 /** Every table a statement touches, or nothing when it cannot be read. */
 declare function readSqlAccess(sql: string, options?: SqlReadOptions): SqlAccess[];
+/** A table name, split from the namespaces written in front of it. */
+interface QualifiedTable {
+    table: string;
+    /** The namespaces in front of the table, outermost first. */
+    qualifier: string[];
+}
+/**
+ * A table split from the namespaces written in front of it, or nothing
+ * when the table itself came through as a parameter. A pack that reads
+ * a table off an argument splits it through here too, so it agrees with
+ * a table read out of a statement. The README says more.
+ */
+declare function splitQualifiedTable(name: string): QualifiedTable | null;
 /**
  * The SQL a tagged template states, with each interpolation written as
  * a parameter. What a query interpolates is a value nearly every time,
@@ -39,6 +61,6 @@ declare function readSqlAccess(sql: string, options?: SqlReadOptions): SqlAccess
  * settle stays a parameter, and a statement that needed one somewhere a
  * parameter cannot go reads as nothing.
  */
-declare function sqlFromParts(parts: readonly string[], substitutions?: ReadonlyArray<string | null>): string;
+declare function sqlFromParts(parts: readonly string[], substitutions?: ReadonlyArray<string | null>, settled?: ReadonlyArray<string | null>): string;
 
-export { type SqlAccess, type SqlReadOptions, readSqlAccess, sqlFromParts };
+export { type QualifiedTable, type SqlAccess, type SqlReadOptions, readSqlAccess, splitQualifiedTable, sqlFromParts };

package/dist/index.js

@@ -22000,68 +22000,351 @@ var DIALECTS = {
   bigquery: { module: import_bigquery.default, database: "bigquery" }
 };
 function readSqlAccess(sql, options = {}) {
-  const dialect = DIALECTS[options.dialect ?? "postgresql"];
-  if (dialect === void 0) {
+  const grammar = DIALECTS[options.dialect ?? "postgresql"];
+  if (grammar === void 0) {
     return [];
   }
+  return accessesInSql(sql, grammar).map(qualified).filter((access) => access !== null);
+}
+function accessesInSql(sql, grammar) {
+  const written = parsedAccesses(sql, grammar);
+  if (written !== null) {
+    return written;
+  }
+  const readable = rewrittenForGrammar(sql);
+  const rewritten = readable === sql ? null : parsedAccesses(readable, grammar);
+  return rewritten ?? accessesAroundWith(readable, grammar);
+}
+function parsedAccesses(sql, grammar, defined = /* @__PURE__ */ new Set()) {
   let parsed;
   try {
-    parsed = new dialect.module.Parser().astify(sql, {
-      database: dialect.database
+    parsed = new grammar.module.Parser().astify(sql, {
+      database: grammar.database
     });
   } catch {
-    return [];
+    return null;
   }
   const statements = Array.isArray(parsed) ? parsed : [parsed];
-  return statements.flatMap((statement) => accessesIn(statement, /* @__PURE__ */ new Set()));
+  return statements.flatMap((statement) => accessesIn(statement, defined));
 }
-function sqlFromParts(parts, substitutions = []) {
-  return parts.map((part, index) => {
-    if (index === 0) {
-      return part;
+var QUALIFIER_SEPARATOR = ".";
+function splitQualifiedTable(name) {
+  const parts = name.split(QUALIFIER_SEPARATOR);
+  const table = parts[parts.length - 1] ?? name;
+  if (!isSettled(table)) {
+    return null;
+  }
+  return { table, qualifier: namespacesAround(parts.slice(0, -1)) };
+}
+function namespacesAround(namespaces) {
+  const found = [];
+  for (let index = namespaces.length - 1; index >= 0; index -= 1) {
+    const part = namespaces[index];
+    if (part === void 0 || !isSettled(part)) {
+      break;
     }
-    const settled = substitutions[index - 1];
-    return `${settled ?? `$${index}`}${part}`;
+    found.unshift(part);
+  }
+  return found;
+}
+function qualified(access) {
+  const split = splitQualifiedTable(access.table);
+  return split === null ? null : { ...access, ...split };
+}
+function isSettled(part) {
+  return part !== "" && !/^\$\d+$/.test(part);
+}
+function sqlFromParts(parts, substitutions = [], settled = []) {
+  let closing = null;
+  return parts.map((part, index) => {
+    const names = namePosition(closing, parts[index - 1] ?? "");
+    const inHole = index === 0 ? null : substitutions[index - 1] ?? (names ? settled[index - 1] ?? null : null);
+    closing = quoteAfter(closing, part);
+    return index === 0 ? part : `${inHole ?? `$${index}`}${part}`;
   }).join("");
 }
+var TABLE_KEYWORD = /\b(?:from|join|into|update|table)\s+$/i;
+function namePosition(closing, before) {
+  return closing !== null || TABLE_KEYWORD.test(before);
+}
+var NAME_QUOTES = { '"': '"', "`": "`", "[": "]" };
+function quoteAfter(open, part) {
+  let closing = open;
+  for (const character of part) {
+    if (closing === null) {
+      closing = NAME_QUOTES[character] ?? null;
+      continue;
+    }
+    if (character === closing) {
+      closing = null;
+    }
+  }
+  return closing;
+}
+var TEXT_RUNS = [
+  { open: "--", close: "\n", comment: true },
+  { open: "/*", close: "*/", comment: true },
+  { open: "'", close: "'", comment: false },
+  { open: '"', close: '"', comment: false },
+  { open: "`", close: "`", comment: false }
+];
+var DOLLAR_TAG = /\$(?:[A-Za-z_]\w*)?\$/y;
+function textRunAt(sql, index) {
+  DOLLAR_TAG.lastIndex = index;
+  const tag = DOLLAR_TAG.exec(sql)?.[0];
+  if (tag !== void 0) {
+    return { end: closingAt(sql, index + tag.length, tag), comment: false };
+  }
+  for (const run of TEXT_RUNS) {
+    if (sql.startsWith(run.open, index)) {
+      const from = index + run.open.length;
+      return { end: closingAt(sql, from, run.close), comment: run.comment };
+    }
+  }
+  return null;
+}
+function closingAt(sql, from, close) {
+  const at = sql.indexOf(close, from);
+  return at === -1 ? sql.length : at + close.length;
+}
+function codeMask(sql) {
+  const mask = new Array(sql.length).fill(true);
+  let index = 0;
+  while (index < sql.length) {
+    const run = textRunAt(sql, index);
+    if (run === null) {
+      index += 1;
+      continue;
+    }
+    for (let at = index; at < run.end; at += 1) {
+      mask[at] = false;
+    }
+    index = run.end;
+  }
+  return mask;
+}
+function replaceInCode(sql, pattern, rewrite) {
+  const mask = codeMask(sql);
+  let rewritten = "";
+  let from = 0;
+  for (const match of sql.matchAll(pattern)) {
+    const at = match.index;
+    if (at === void 0 || mask[at] === false) {
+      continue;
+    }
+    rewritten += sql.slice(from, at) + rewrite(match);
+    from = at + match[0].length;
+  }
+  return rewritten + sql.slice(from);
+}
+var TYPE_WORD = String.raw`(?:"[^"]*"|\w+)`;
+var TYPE_SIZE = String.raw`(?:\s*\(\s*\d+\s*(?:,\s*\d+\s*)?\))?`;
+var TYPE_TAIL = String.raw`(?:\s+(?:precision|varying|with(?:out)?\s+time\s+zone))?`;
+var CAST_TYPE = `${TYPE_WORD}(?:\\s*\\.\\s*${TYPE_WORD})?${TYPE_SIZE}${TYPE_TAIL}${TYPE_SIZE}(?:\\s*\\[\\s*\\])*`;
+var PARAMETER_CAST = new RegExp(
+  String.raw`(\$\d+)(?:\s*::\s*${CAST_TYPE})+`,
+  "gi"
+);
+var LOCKING_CLAUSE = new RegExp(
+  String.raw`\bfor\s+(?:no\s+key\s+update|key\s+share|update|share)` + String.raw`(?:\s+of\s+${TYPE_WORD}(?:\s*,\s*${TYPE_WORD})*)?` + String.raw`(?:\s+(?:nowait|skip\s+locked))?`,
+  "gi"
+);
+function rewrittenForGrammar(sql) {
+  const uncast = replaceInCode(sql, PARAMETER_CAST, castAwayFrom);
+  return replaceInCode(uncast, LOCKING_CLAUSE, nothing);
+}
+function castAwayFrom(match) {
+  return match[1] ?? "";
+}
+function nothing() {
+  return "";
+}
+function accessesAroundWith(sql, grammar) {
+  const split = splitWith(sql);
+  if (split === null) {
+    return [];
+  }
+  const names = /* @__PURE__ */ new Set();
+  const inside = [];
+  for (const table of split.tables) {
+    inside.push(...parsedAccesses(table.body, grammar, names) ?? []);
+    names.add(table.name);
+  }
+  const own = parsedAccesses(split.main, grammar, names) ?? [];
+  return [...own, ...inside];
+}
+function splitWith(sql) {
+  const mask = codeMask(sql);
+  let index = nextToken(sql, 0);
+  if (!wordAt(sql, index, "with")) {
+    return null;
+  }
+  index = pastWord(sql, index, "with");
+  if (wordAt(sql, index, "recursive")) {
+    index = pastWord(sql, index, "recursive");
+  }
+  const tables = [];
+  for (; ; ) {
+    const named = nameAt(sql, index);
+    if (named === null) {
+      return null;
+    }
+    index = afterColumnList(sql, mask, nextToken(sql, named.end));
+    if (index === -1 || !wordAt(sql, index, "as")) {
+      return null;
+    }
+    index = pastMaterialized(sql, pastWord(sql, index, "as"));
+    const end = afterGroup(sql, mask, index);
+    if (end === null) {
+      return null;
+    }
+    tables.push({ name: named.name, body: sql.slice(index + 1, end - 1) });
+    index = nextToken(sql, end);
+    if (sql[index] !== ",") {
+      return { tables, main: sql.slice(index) };
+    }
+    index = nextToken(sql, index + 1);
+  }
+}
+function afterColumnList(sql, mask, index) {
+  if (sql[index] !== "(") {
+    return index;
+  }
+  const end = afterGroup(sql, mask, index);
+  return end === null ? -1 : nextToken(sql, end);
+}
+function pastMaterialized(sql, index) {
+  const past = wordAt(sql, index, "not") ? pastWord(sql, index, "not") : index;
+  return wordAt(sql, past, "materialized") ? pastWord(sql, past, "materialized") : past;
+}
+function nextToken(sql, from) {
+  let index = from;
+  while (index < sql.length) {
+    if (/\s/.test(sql[index] ?? "")) {
+      index += 1;
+      continue;
+    }
+    const run = textRunAt(sql, index);
+    if (run === null || !run.comment) {
+      return index;
+    }
+    index = run.end;
+  }
+  return index;
+}
+function wordAt(sql, index, word) {
+  const written = sql.slice(index, index + word.length).toLowerCase();
+  return written === word && !/\w/.test(sql[index + word.length] ?? "");
+}
+function pastWord(sql, index, word) {
+  return nextToken(sql, index + word.length);
+}
+function nameAt(sql, index) {
+  if (sql[index] === '"') {
+    const close = sql.indexOf('"', index + 1);
+    return close === -1 ? null : { name: sql.slice(index + 1, close), end: close + 1 };
+  }
+  const word = /^\w+/.exec(sql.slice(index))?.[0];
+  return word === void 0 ? null : { name: word, end: index + word.length };
+}
+function afterGroup(sql, mask, index) {
+  if (sql[index] !== "(" || mask[index] === false) {
+    return null;
+  }
+  let depth = 0;
+  for (let at = index; at < sql.length; at += 1) {
+    if (mask[at] === false) {
+      continue;
+    }
+    if (sql[at] === "(") {
+      depth += 1;
+      continue;
+    }
+    if (sql[at] !== ")") {
+      continue;
+    }
+    depth -= 1;
+    if (depth === 0) {
+      return at + 1;
+    }
+  }
+  return null;
+}
 function accessesIn(statement, defined) {
   const node = asNode(statement);
   if (node === null) {
     return [];
   }
+  const clause = commonTables(node, defined);
+  return [...ownAccesses(node, clause.names), ...clause.inside];
+}
+function ownAccesses(node, defined) {
   if (node.type === "select") {
-    return selectAccesses(node, defined);
+    return [
+      ...selectAccesses(node, defined),
+      ...accessesIn(node._next, defined)
+    ];
   }
   if (node.type === "insert") {
-    return oneAccess(firstTable(node.table), {
-      kind: "write",
-      fields: namesOf(node.columns),
-      selector: []
-    });
+    return insertAccesses(node, defined);
   }
   if (node.type === "update") {
-    return oneAccess(firstTable(node.table), {
-      kind: "write",
-      fields: refsIn(node.set).map((ref) => ref.field),
-      selector: selectorFields(node.where)
-    });
+    return updateAccesses(node, defined);
   }
   if (node.type === "delete") {
-    return oneAccess(firstTable(node.from) ?? firstTable(node.table), {
-      kind: "write",
-      fields: [],
-      selector: selectorFields(node.where)
-    });
+    return deleteAccesses(node, defined);
   }
   return [];
 }
-function oneAccess(table, rest) {
-  return table === null ? [] : [{ table, ...rest }];
+function insertAccesses(node, defined) {
+  const conflict = conflictClauses(node);
+  const stated = {
+    fields: [
+      ...unqualified(namesOf(node.columns)),
+      ...refsIn(node.returning),
+      ...conflict.fields
+    ],
+    selector: conflict.selector
+  };
+  const sources = sourcesIn(node.table, defined);
+  return [
+    ...accessesAcross(sources, firstTable(node.table), stated, defined),
+    ...accessesIn(node.values, defined)
+  ];
+}
+function updateAccesses(node, defined) {
+  const sources = sourcesAcross([node.table, node.from], defined);
+  const stated = {
+    fields: [...setTargets(node.set), ...refsIn(node.returning)],
+    selector: refsIn(node.where)
+  };
+  return accessesAcross(sources, firstTable(node.table), stated, defined);
+}
+function deleteAccesses(node, defined) {
+  const written = deletedTable(node);
+  const stated = {
+    fields: refsIn(node.returning),
+    selector: refsIn(node.where)
+  };
+  const sources = withTable(sourcesIn(node.from, defined), written);
+  return accessesAcross(sources, written, stated, defined);
 }
-function selectAccesses(statement, outer) {
+function conflictClauses(node) {
+  const conflict = asNode(node.conflict);
+  const action = asNode(asNode(conflict?.action)?.expr);
+  return {
+    fields: [
+      ...refsIn(conflict?.target),
+      ...setTargets(action?.set),
+      ...setTargets(asNode(node.on_duplicate_update)?.set)
+    ],
+    selector: refsIn(action?.where)
+  };
+}
+function commonTables(node, outer) {
   const names = new Set(outer);
   const inside = [];
-  for (const entry of Array.isArray(statement.with) ? statement.with : []) {
+  for (const entry of Array.isArray(node.with) ? node.with : []) {
     const cte = asNode(entry);
     if (cte === null) {
       continue;
@@ -22070,52 +22353,69 @@ function selectAccesses(statement, outer) {
     if (name === null) {
       continue;
     }
-    inside.push(...accessesIn(cte.stmt, names));
+    inside.push(...accessesIn(statementOf(cte.stmt), names));
     names.add(name);
   }
-  const tables = tablesIn(statement.from);
-  if (tables.size === 0) {
-    return inside;
+  return { names, inside };
+}
+function deletedTable(node) {
+  const first = asNode(Array.isArray(node.table) ? node.table[0] : null);
+  const aliased = first === null ? null : stringOf(first.as);
+  if (first !== null && stringOf(first.table) === "FROM" && aliased !== null) {
+    return aliased;
   }
-  const named = [...new Set(tables.values())];
-  const only = named.length === 1 ? named[0] ?? null : null;
-  const fields = /* @__PURE__ */ new Map();
-  const selectors = /* @__PURE__ */ new Map();
-  const record = (into, alias, field) => {
-    const table = alias === void 0 ? only : tables.get(alias) ?? null;
-    if (table === null) {
-      return;
-    }
-    const found = into.get(table) ?? /* @__PURE__ */ new Set();
-    found.add(field);
-    into.set(table, found);
+  return firstTable(node.from) ?? firstTable(node.table);
+}
+function selectAccesses(statement, names) {
+  const stated = {
+    fields: refsIn(statement.columns),
+    selector: refsIn(statement.where)
   };
-  for (const ref of refsIn(statement.columns)) {
-    record(fields, ref.table, ref.field);
-  }
-  for (const ref of refsIn(statement.where)) {
-    record(selectors, ref.table, ref.field);
-  }
-  const own = named.filter((table) => !names.has(table)).map((table) => ({
+  return accessesAcross(sourcesIn(statement.from, names), null, stated, names);
+}
+function accessesAcross(sources, written, stated, defined) {
+  const named = [...new Set(sources.tables.values())];
+  const only = named.length === 1 && !sources.derived ? named[0] ?? null : null;
+  const fields = byTable(stated.fields, sources.tables, written ?? only);
+  const selector = byTable(stated.selector, sources.tables, only);
+  const own = named.filter((table) => !defined.has(table)).map((table) => ({
     table,
-    kind: "read",
-    fields: [...fields.get(table) ?? []],
-    selector: [...selectors.get(table) ?? []]
+    qualifier: [],
+    kind: table === written ? "write" : "read",
+    fields: fields.get(table) ?? [],
+    selector: selector.get(table) ?? []
   }));
-  return [...own, ...inside];
+  return [...own, ...sources.inside];
 }
-function tablesIn(from) {
-  const tables = /* @__PURE__ */ new Map();
-  if (!Array.isArray(from)) {
-    return tables;
+function byTable(refs, tables, only) {
+  const found = /* @__PURE__ */ new Map();
+  for (const ref of refs) {
+    const table = ref.table === void 0 ? only : tables.get(ref.table) ?? null;
+    if (table === null) {
+      continue;
+    }
+    const already = found.get(table) ?? [];
+    if (!already.includes(ref.field)) {
+      already.push(ref.field);
+    }
+    found.set(table, already);
   }
-  for (const entry of from) {
+  return found;
+}
+function sourcesIn(from, defined) {
+  const tables = /* @__PURE__ */ new Map();
+  const inside = [];
+  let derived = false;
+  for (const entry of Array.isArray(from) ? from : []) {
     const node = asNode(entry);
     if (node === null) {
       continue;
     }
     const table = stringOf(node.table);
     if (table === null) {
+      const query = statementOf(node.expr);
+      derived = derived || query !== null;
+      inside.push(...accessesIn(query, defined));
       continue;
     }
     tables.set(table, table);
@@ -22124,10 +22424,37 @@ function tablesIn(from) {
       tables.set(alias, table);
     }
   }
-  return tables;
+  return { tables, inside, derived };
+}
+function statementOf(value) {
+  const node = asNode(value);
+  if (node === null) {
+    return null;
+  }
+  return node.ast ?? node;
+}
+function sourcesAcross(clauses, defined) {
+  const tables = /* @__PURE__ */ new Map();
+  const inside = [];
+  let derived = false;
+  for (const clause of clauses) {
+    const found = sourcesIn(clause, defined);
+    for (const [name, table] of found.tables) {
+      tables.set(name, table);
+    }
+    inside.push(...found.inside);
+    derived = derived || found.derived;
+  }
+  return { tables, inside, derived };
+}
+function withTable(sources, table) {
+  if (table === null || sources.tables.has(table)) {
+    return sources;
+  }
+  return { ...sources, tables: new Map([[table, table], ...sources.tables]) };
 }
 function firstTable(value) {
-  return [...tablesIn(value).values()][0] ?? null;
+  return [...sourcesIn(value, /* @__PURE__ */ new Set()).tables.values()][0] ?? null;
 }
 function refsIn(value) {
   const found = [];
@@ -22156,11 +22483,19 @@ function refsIn(value) {
   walk(value);
   return found;
 }
-function selectorFields(where) {
+function unqualified(names) {
+  return names.map((field) => ({ table: void 0, field }));
+}
+function setTargets(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
   const found = [];
-  for (const ref of refsIn(where)) {
-    if (!found.includes(ref.field)) {
-      found.push(ref.field);
+  for (const entry of value) {
+    const node = asNode(entry);
+    const field = node === null ? null : columnName(node.column);
+    if (node !== null && field !== null) {
+      found.push({ table: stringOf(node.table) ?? void 0, field });
     }
   }
   return found;
@@ -22194,5 +22529,6 @@ function asNode(value) {
 }
 export {
   readSqlAccess,
+  splitQualifiedTable,
   sqlFromParts
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suss/sql",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "type": "module",
   "description": "Read which tables and fields a SQL statement touches, so suss can check the query against the schema it runs on.",
   "keywords": [