@teleporthq/teleport-plugin-next-data-source 0.44.14 → 0.44.17

package/dist/esm/fetchers/raw-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"raw-query.js","sourceRoot":"","sources":["../../../src/fetchers/raw-query.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAarD,IAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAE/F,oGAAoG;AACpG,IAAM,yBAAyB,GAAG,aAAa,CAAA;AAE/C,IAAM,kBAAkB,GAAG,UAAC,KAAa;IACvC,OAAA,KAAK,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,KAAK,CAAC;AAAjG,CAAiG,CAAA;AAEnG,uFAAuF;AACvF,IAAM,gBAAgB,GAAG,UAAC,KAAa;IACrC,IAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,IAAM,uBAAuB,GAAG,UACrC,MAA+B,EAC/B,KAAa,EACb,WAAqB;;IAErB,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACzD,IAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,UAAC,KAAK,IAAK,OAAA,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAA1B,CAA0B,CAAC,CAAA;IAE/E,IAAM,gBAAgB,GAAG;QACvB,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAW,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAgB,CAAC,CAAC,CAAC,EAAE;QACnF,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE;OACxE,UAAU,CAAC,GAAG,CACf,UAAC,KAAK;QACJ,OAAA,gBAAS,KAAK,gDAAsC,IAAI,CAAC,SAAS,CAChE,gBAAgB,CAAC,KAAK,CAAC,CACxB,MAAG;IAFJ,CAEI,CACP,QAEA,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,QAAQ,CAAC,CAAA;IAEjB,IAAM,cAAc,GAClB,UAAU,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,UAAG,qBAAqB,CAAC,wCAAwC,EAAE,wjBAiB1E;QACK,CAAC,CAAC,EAAE,CAAA;IAER,IAAM,eAAe,GACnB,WAAW,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,oBACE,WAAW,CAAC,GAAG,CAAC,UAAC,CAAC,IAAK,OAAA,WAAI,CAAC,CAAE,EAAP,CAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,sGAEhD;QACA,CAAC,CAAC,EAAE,CAAA;IAER,IAAM,UAAU,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IAEhF,IAAM,QAAQ,GACZ,QAAQ,CAAC,GAAG,KAAK,KAAK;QACpB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS;YAC7C,CAAC,CAAC,QAAQ,CAAC,SAAS;gBAClB,CAAC,CAAC,mBACF,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,cAAO,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBACpF,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAS,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBAC1F,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,eAAQ,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,6CAEzF;gBACE,CAAC,CAAC,+BAA+B;YACnC,CAAC,CAAC,OAAO,CAAA;IAEb,OAAO,UAAG,gBAAgB,4CAEC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,eAC7D,cAAc,gdAS4B,IAAI,CAAC,SAAS,CAAC,MAAA,QAAQ,CAAC,IAAI,mCAAI,IAAI,CAAC,oEAC3B,QAAQ,CAAC,IAAI,IAAI,IAAI,gEAC/B,IAAI,CAAC,SAAS,CACpD,MAAA,MAAA,QAAQ,CAAC,IAAI,mCAAI,QAAQ,CAAC,QAAQ,mCAAI,IAAI,CAC3C,kEAEC,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,WAAW;QACvD,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,MAAM,8DAEgC,IAAI,CAAC,SAAS,CAAC,MAAA,QAAQ,CAAC,QAAQ,mCAAI,IAAI,CAAC,yBAC9E,QAAQ,uTAgBb,gBAAgB,mBAChB,eAAe,mCAED,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,8UAcQ,UAAU,geAoB1D,CAAA;AACD,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,IAAM,2BAA2B,GAAG,UACzC,KAAa;IAEb,IAAM,SAAS,GAAG,8BAA8B,CAAA;IAChD,IAAM,WAAW,GAAa,EAAE,CAAA;IAEhC,6CAA6C;IAC7C,IAAM,MAAM,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChD,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,OAAO,KAAK,KAAK,IAAI,EAAE;QACrB,IAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAChC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;SACxB;QACD,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;KAC3B;IAED,qDAAqD;IACrD,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC5B,kEAAkE;QAClE,IAAM,aAAa,GAAG,0BAAmB,KAAK,QAAK,CAAA;QACnD,IAAM,eAAe,GAAG,yBAAkB,KAAK,OAAI,CAAA;QAEnD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;YAC9C,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,WAAI,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;SAC/E;aAAM;YACL,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,WAAI,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;SACjF;KACF;IAED,qDAAqD;IACrD,IAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CACrC,UAAC,CAAC,IAAK,OAAA,qBAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,EAAtD,CAAsD,CAC9D,CAAA;IAED,OAAO,EAAE,kBAAkB,oBAAA,EAAE,WAAW,EAAE,eAAe,EAAE,CAAA;AAC7D,CAAC,CAAA"}
+{"version":3,"file":"raw-query.js","sourceRoot":"","sources":["../../../src/fetchers/raw-query.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAsBrD,+EAA+E;AAC/E,IAAM,wBAAwB,GAAG,GAAG,CAAA;AAEpC,8FAA8F;AAC9F,IAAM,cAAc,GAAG,UAAC,KAAa;IACnC,IAAM,KAAK,GAAG,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzE,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC3C,CAAC,CAAA;AAaD,IAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;AAE/F,oGAAoG;AACpG,IAAM,yBAAyB,GAAG,aAAa,CAAA;AAE/C,IAAM,kBAAkB,GAAG,UAAC,KAAa;IACvC,OAAA,KAAK,CAAC,MAAM,GAAG,yBAAyB,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,KAAK,CAAC;AAAjG,CAAiG,CAAA;AAEnG,uFAAuF;AACvF,IAAM,gBAAgB,GAAG,UAAC,KAAa;IACrC,IAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,IAAM,uBAAuB,GAAG,UACrC,MAA+B,EAC/B,KAAa,EACb,WAAqB,EACrB,MAAgC;;IAAhC,uBAAA,EAAA,WAAgC;IAEhC,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IACzD,IAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,UAAC,KAAK,IAAK,OAAA,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAA1B,CAA0B,CAAC,CAAA;IAC/E,IAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAA;IAC5C,IAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,sBAAsB,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAA;IAEnF,IAAM,gBAAgB,GAAG;QACvB,aAAa,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,kBAAW,aAAa;iBACrB,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,UAAG,KAAK,qBAAW,KAAK,CAAE,EAA1B,CAA0B,CAAC;iBAC1C,IAAI,CAAC,IAAI,CAAC,iCAAuB,aAAa;iBAC9C,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,gBAAS,KAAK,mCAAyB,KAAK,MAAG,EAA/C,CAA+C,CAAC;iBAC/D,IAAI,CAAC,QAAQ,CAAC,CAAE;YACrB,CAAC,CAAC,EAAE;QACN,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE;OACxE,UAAU,CAAC,GAAG,CACf,UAAC,KAAK;QACJ,OAAA,gBAAS,KAAK,gDAAsC,IAAI,CAAC,SAAS,CAChE,gBAAgB,CAAC,KAAK,CAAC,CACxB,MAAG;IAFJ,CAEI,CACP,QAEA,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,QAAQ,CAAC,CAAA;IAEjB,6EAA6E;IAC7E,yEAAyE;IACzE,6CAA6C;IAC7C,qGAAqG;IACrG,IAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,UAAU,CAAA;IACpD,IAAM,cAAc,GAAG,UAAG,qBAAqB,CAAC,wCAAwC,CACtF,WAAW,EACX;QACE,cAAc,EAAE,MAAM,CAAC,cAAc,KAAK,KAAK;KAChD,CACF,eACD,WAAW,CAAC,6BAA6B,CAAC;QAC1C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,EAAE;QACnD,WAAW,aAAA;KACZ,CAAC,w5BAwB2C,wBAAwB,0bAQjD,IAAI,CAAC,SAAS,CAC9B,UAAU;QACR,CAAC,CAAC;YACE,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,EAAE;YAC3C,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,KAAK,IAAI;YAC9D,sBAAsB,EAAE,UAAU,CAAC,sBAAsB,IAAI,EAAE;SAChE;QACH,CAAC,CAAC,IAAI,CACT,eACD,UAAU,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC,EAAE,oCAC3E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,6BAC5C,MAAM,mLAGG,YAAY,CAAC,qBAAqB,gxCAwB1D,CAAA;IAEC,IAAM,eAAe,GACnB,WAAW,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,oBACE,WAAW,CAAC,GAAG,CAAC,UAAC,CAAC,IAAK,OAAA,WAAI,CAAC,CAAE,EAAP,CAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,sGAEhD;QACA,CAAC,CAAC,EAAE,CAAA;IAER,IAAM,UAAU,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IAEhF,IAAM,QAAQ,GACZ,QAAQ,CAAC,GAAG,KAAK,KAAK;QACpB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS;YAC7C,CAAC,CAAC,QAAQ,CAAC,SAAS;gBAClB,CAAC,CAAC,mBACF,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,cAAO,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBACpF,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAS,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBAC1F,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,eAAQ,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,6CAEzF;gBACE,CAAC,CAAC,+BAA+B;YACnC,CAAC,CAAC,OAAO,CAAA;IAEb,OAAO,UAAG,gBAAgB,4CAEC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,eAC7D,cAAc,uhBAU4B,IAAI,CAAC,SAAS,CAAC,MAAA,QAAQ,CAAC,IAAI,mCAAI,IAAI,CAAC,oEAC3B,QAAQ,CAAC,IAAI,IAAI,IAAI,gEAC/B,IAAI,CAAC,SAAS,CACpD,MAAA,MAAA,QAAQ,CAAC,IAAI,mCAAI,QAAQ,CAAC,QAAQ,mCAAI,IAAI,CAC3C,kEAEC,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,WAAW;QACvD,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,CAAC,CAAC,MAAM,8DAEgC,IAAI,CAAC,SAAS,CAAC,MAAA,QAAQ,CAAC,QAAQ,mCAAI,IAAI,CAAC,yBAC9E,QAAQ,qUAgBC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,yNAKnC,gBAAgB,mBAChB,eAAe,8UAc4B,UAAU,+5BA0B1D,CAAA;AACD,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,IAAM,2BAA2B,GAAG,UACzC,KAAa;IAEb,IAAM,SAAS,GAAG,8BAA8B,CAAA;IAChD,IAAM,WAAW,GAAa,EAAE,CAAA;IAEhC,6CAA6C;IAC7C,IAAM,MAAM,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChD,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9B,OAAO,KAAK,KAAK,IAAI,EAAE;QACrB,IAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;YAChC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;SACxB;QACD,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;KAC3B;IAED,qDAAqD;IACrD,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QAC5B,kEAAkE;QAClE,IAAM,aAAa,GAAG,0BAAmB,KAAK,QAAK,CAAA;QACnD,IAAM,eAAe,GAAG,yBAAkB,KAAK,OAAI,CAAA;QAEnD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE;YAC9C,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,WAAI,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;SAC/E;aAAM;YACL,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,WAAI,CAAC,GAAG,CAAC,CAAE,CAAC,CAAA;SACjF;KACF;IAED,qDAAqD;IACrD,IAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CACrC,UAAC,CAAC,IAAK,OAAA,qBAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,EAAtD,CAAsD,CAC9D,CAAA;IAED,OAAO,EAAE,kBAAkB,oBAAA,EAAE,WAAW,EAAE,eAAe,EAAE,CAAA;AAC7D,CAAC,CAAA"}

package/dist/esm/fetchers/redshift.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redshift.d.ts","sourceRoot":"","sources":["../../../src/fetchers/redshift.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,uBAAuB,WAC1B,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,KAChB,MA6MF,CAAA"}
+{"version":3,"file":"redshift.d.ts","sourceRoot":"","sources":["../../../src/fetchers/redshift.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,uBAAuB,WAC1B,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,KAChB,MA+MF,CAAA"}

package/dist/esm/fetchers/redshift.js

@@ -1,4 +1,5 @@
 import { replaceSecretReference, generateDateFormatterCode, generateSafeJSONParseCode, generateFilterTreeHelpersCode, generateSearchEscapeHelpersCode, } from '../utils';
+import { DataExposure } from '@teleporthq/teleport-shared';
 import { generateSearchSqlHelpersCode, REDSHIFT_SEARCH_SQL } from '../search-relevance';
 export var generateRedshiftFetcher = function (config, tableName) {
     var _a;
@@ -11,7 +12,7 @@ export var generateRedshiftFetcher = function (config, tableName) {
     var ssl = redshiftConfig.ssl;
     var sslConfig = redshiftConfig.sslConfig;
     var schema = (_a = redshiftConfig.options) === null || _a === void 0 ? void 0 : _a.schema;
-    return "import { Client } from 'pg'\n\nconst getClient = () => {\n  return new Client({\n    host: ".concat(JSON.stringify(host), ",\n    port: ").concat(port || 5439, ",\n    user: ").concat(JSON.stringify(user), ",\n    password: ").concat(replaceSecretReference(password), ",\n    database: ").concat(JSON.stringify(database), ",\n    ssl: ").concat(ssl === false
+    return "import { Client } from 'pg'\n\n// No query waits on the database longer than this (enforced by the client).\nconst getClient = () => {\n  return new Client({\n    query_timeout: ".concat(DataExposure.READ_QUERY_TIMEOUT_MS, ",\n    host: ").concat(JSON.stringify(host), ",\n    port: ").concat(port || 5439, ",\n    user: ").concat(JSON.stringify(user), ",\n    password: ").concat(replaceSecretReference(password), ",\n    database: ").concat(JSON.stringify(database), ",\n    ssl: ").concat(ssl === false
         ? '{ rejectUnauthorized: false }'
         : sslConfig
             ? "{\n      ".concat(sslConfig.ca ? "ca: ".concat(replaceSecretReference(sslConfig.ca), ",") : '', "\n      ").concat(sslConfig.cert ? "cert: ".concat(replaceSecretReference(sslConfig.cert), ",") : '', "\n      ").concat(sslConfig.key ? "key: ".concat(replaceSecretReference(sslConfig.key), ",") : '', "\n      rejectUnauthorized: ").concat(sslConfig.rejectUnauthorized !== false, "\n    }")

package/dist/esm/fetchers/redshift.js.map

@@ -1 +1 @@
-{"version":3,"file":"redshift.js","sourceRoot":"","sources":["../../../src/fetchers/redshift.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAavF,MAAM,CAAC,IAAM,uBAAuB,GAAG,UACrC,MAA+B,EAC/B,SAAiB;;IAEjB,IAAM,cAAc,GAAG,MAAwB,CAAA;IAC/C,IAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;IAChC,IAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;IAChC,IAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;IAChC,IAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAA;IACxC,IAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAA;IACxC,IAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAA;IAC9B,IAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAA;IAC1C,IAAM,MAAM,GAAG,MAAA,cAAc,CAAC,OAAO,0CAAE,MAAM,CAAA;IAE7C,OAAO,qGAIG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BACpB,IAAI,IAAI,IAAI,0BACZ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAChB,sBAAsB,CAAC,QAAQ,CAAC,8BAChC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAElC,GAAG,KAAK,KAAK;QACX,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,mBACF,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,cAAO,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBAClE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAS,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBACxE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,eAAQ,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,yCACjD,SAAS,CAAC,kBAAkB,KAAK,KAAK,YAC5D;YACE,CAAC,CAAC,+BAA+B,CAAC,wDAAwD;8BAKhG,yBAAyB,EAAE,iBAE3B,6BAA6B,EAAE,iBAE/B,+BAA+B,EAAE,eACjC,4BAA4B,CAAC,mBAAmB,CAAC,iBAEjD,yBAAyB,EAAE,+IAOvB,MAAM,CAAC,CAAC,CAAC,iDAA0C,MAAM,OAAI,CAAC,CAAC,CAAC,EAAE,2oBAmB1D,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,2FAG5C,MAAM;QACJ,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAG;QAC7D,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAG,i7EAiEhB,SAAS,wvEAkExC,CAAA;AACD,CAAC,CAAA"}
+{"version":3,"file":"redshift.js","sourceRoot":"","sources":["../../../src/fetchers/redshift.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAavF,MAAM,CAAC,IAAM,uBAAuB,GAAG,UACrC,MAA+B,EAC/B,SAAiB;;IAEjB,IAAM,cAAc,GAAG,MAAwB,CAAA;IAC/C,IAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;IAChC,IAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;IAChC,IAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAA;IAChC,IAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAA;IACxC,IAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAA;IACxC,IAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAA;IAC9B,IAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAA;IAC1C,IAAM,MAAM,GAAG,MAAA,cAAc,CAAC,OAAO,0CAAE,MAAM,CAAA;IAE7C,OAAO,4LAKY,YAAY,CAAC,qBAAqB,0BAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0BACpB,IAAI,IAAI,IAAI,0BACZ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAChB,sBAAsB,CAAC,QAAQ,CAAC,8BAChC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAElC,GAAG,KAAK,KAAK;QACX,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,mBACF,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,cAAO,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBAClE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAS,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBACxE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,eAAQ,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,yCACjD,SAAS,CAAC,kBAAkB,KAAK,KAAK,YAC5D;YACE,CAAC,CAAC,+BAA+B,CAAC,wDAAwD;8BAKhG,yBAAyB,EAAE,iBAE3B,6BAA6B,EAAE,iBAE/B,+BAA+B,EAAE,eACjC,4BAA4B,CAAC,mBAAmB,CAAC,iBAEjD,yBAAyB,EAAE,+IAOvB,MAAM,CAAC,CAAC,CAAC,iDAA0C,MAAM,OAAI,CAAC,CAAC,CAAC,EAAE,2oBAmB1D,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,2FAG5C,MAAM;QACJ,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAG;QAC7D,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAG,i7EAiEhB,SAAS,wvEAkExC,CAAA;AACD,CAAC,CAAA"}

package/dist/esm/fetchers/teleport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"teleport.d.ts","sourceRoot":"","sources":["../../../src/fetchers/teleport.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAA;AA2C3B,eAAO,MAAM,sBAAsB,WACzB,OAAO,MAAM,EAAE,OAAO,CAAC,KAC9B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAMpC,CAAA;AAED,eAAO,MAAM,uBAAuB,WAC1B,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,qBACC,sBAAsB,KACvC,MAycF,CAAA;AAED,eAAO,MAAM,4BAA4B,WAC/B,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,KAChB,MA0FF,CAAA"}
+{"version":3,"file":"teleport.d.ts","sourceRoot":"","sources":["../../../src/fetchers/teleport.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAA;AAgD3B,eAAO,MAAM,sBAAsB,WACzB,OAAO,MAAM,EAAE,OAAO,CAAC,KAC9B;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAMpC,CAAA;AAED,eAAO,MAAM,uBAAuB,WAC1B,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,qBACC,sBAAsB,KACvC,MAwdF,CAAA;AAED,eAAO,MAAM,4BAA4B,WAC/B,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,KAChB,MA2FF,CAAA"}

package/dist/esm/fetchers/teleport.js

@@ -6,7 +6,8 @@ import { generateRowOrderTiebreakHelper, rowIdentityColumn } from '../row-order'
 import { generateProductFilterClauseHelper } from '../product-filter-fields';
 import { collectLocalizedColumns, generateLocalizedColumnsHelper } from '../localized-columns';
 import { REQUEST_LOCALE_PARAM } from '../request-locale';
-import { generateReadGuardCall, generateTableAccessPreamble } from './utils/table-access-guard';
+import { DataExposure } from '@teleporthq/teleport-shared';
+import { generateReadGuardCall, generateTableAccessPreamble, sqlRouteFieldPolicy, } from './utils/table-access-guard';
 import { generateRequestSqlGuardsCode } from './utils/request-sql-guards';
 import { generateArrayOverlapSqlCode } from '../array-overlap-sql';
 import { generateSearchSqlHelpersCode, PG_SEARCH_SQL } from '../search-relevance';
@@ -56,9 +57,10 @@ export var generateTeleportFetcher = function (config, tableName, transformOptio
                 ? "key: ".concat(resolveEnvReference(dbConfig.sslConfig.key, 'TELEPORT_DB_SSL_KEY'), ",")
                 : '', "\n      rejectUnauthorized: false\n    }")
             : "(process.env.".concat(DEFAULT_ENV_KEYS.ssl, " === 'false' ? false : process.env.").concat(DEFAULT_ENV_KEYS.ssl, " === 'true' ? { rejectUnauthorized: false } : undefined)");
-    return "".concat(PG_CLIENT_IMPORT, "\n\n").concat(generateTableAccessPreamble(transformOptions.trustedReaderRoles || []), "\nfunction normalizePostgresConnectionString(connectionString) {\n  if (!connectionString || typeof connectionString !== 'string') return connectionString;\n  if (/^postgresql:\\/(?!\\/)/i.test(connectionString)) {\n    return connectionString.replace(/^postgresql:\\//i, 'postgresql://');\n  }\n  return connectionString;\n}\n\nfunction stripSslQueryParamsFromConnectionString(connectionString) {\n  if (!connectionString || typeof connectionString !== 'string') return connectionString;\n  try {\n    var u = new URL(connectionString.replace(/^postgresql:/i, 'postgres:'));\n    u.searchParams.delete('sslmode');\n    u.searchParams.delete('ssl');\n    u.searchParams.delete('sslrootcert');\n    u.searchParams.delete('sslcert');\n    u.searchParams.delete('sslkey');\n    return u.toString().replace(/^postgres:/i, 'postgresql:');\n  } catch (e) {\n    return connectionString;\n  }\n}\n\nconst getClient = () => {\n  var ssl = ").concat(sslCode, ";\n  var connStr = process.env.TELEPORT_DB_CONNECTION_STRING;\n  if (connStr) {\n    connStr = normalizePostgresConnectionString(connStr);\n  }\n  if (ssl === false && connStr) {\n    connStr = stripSslQueryParamsFromConnectionString(connStr);\n  }\n  if (connStr) {\n    return new Client(Object.assign(\n      { connectionString: connStr },\n      ssl !== undefined ? { ssl: ssl } : {}\n    ));\n  }\n  return new Client(Object.assign(\n    {\n      host: ").concat(hostRef, ",\n      port: parseInt(").concat(portRef, " || '5432', 10),\n      user: ").concat(userRef, ",\n      password: ").concat(passwordRef, ",\n      database: ").concat(databaseRef, ",\n    },\n    ssl !== undefined ? { ssl: ssl } : {}\n  ));\n}\n\n").concat(generateSafeJSONParseCode(), "\n\n").concat(generateFilterTreeHelpersCode(), "\n\n").concat(generateSearchEscapeHelpersCode(), "\n").concat(generateSearchSqlHelpersCode(PG_SEARCH_SQL), "\n").concat(generateArrayOverlapSqlCode(), "\n").concat(getTransformationCode(tableName, transformOptions), "\n").concat(getTransformWrapperCode(tableName, transformOptions), "\n").concat(generateRequestSqlGuardsCode(), "\nconst processFilters = (filters, conditions, queryParams, paramIndex) => {\n  if (!filters) return paramIndex\n  \n  const filterTree = normalizeFilterTree(safeJSONParse(filters))\n  if (!filterTree) return paramIndex\n  \n  const buildCondition = (condition) => {\n    const field = condition.source\n    const normalizedCondition = normalizeInOperand(condition.operand, condition.destination)\n    if (normalizedCondition === null) return null\n    const value = normalizedCondition.value\n    const operand = normalizedCondition.operand\n    \n    // The products table's virtual fields (effective price, rating bucket,\n    // on-sale flag, variant axes) are whole clauses, not columns - so they are\n    // answered before any branch below can interpolate the field name raw.\n    const productClause = productFilterClause(field, operand, value, (param) => {\n      queryParams.push(param)\n      return '$' + paramIndex++\n    })\n    if (productClause !== null) return productClause\n\n    // A translatable column is compared against the value in every language,\n    // so a localized slug resolves under any locale - see localized-columns.ts.\n    const localizedClause = localizedEqualityClause(field, operand, value, (param) => {\n      queryParams.push(param)\n      return '$' + paramIndex++\n    })\n    if (localizedClause !== null) return localizedClause\n    assertRequestColumn(field, 'filter field')\n    \n    if (Array.isArray(value)) {\n      if (value.length === 0) return null\n      if (operand === 'array_overlap') {\n        // The row's list (see array-overlap-sql.ts) shares any value with the set.\n        const clause = arrayOverlapSql((localizedColumnList(field) || [field]), '$' + paramIndex)\n        queryParams.push(value.map((entry) => String(entry)))\n        paramIndex++\n        return clause\n      }\n      const placeholders = value.map(() => `$${paramIndex++}`)\n      queryParams.push(...value)\n      return operand === '!='\n        ? `${field} NOT IN (${placeholders.join(', ')})`\n        : `${field} IN (${placeholders.join(', ')})`\n    }\n    \n    if (operand === 'array_overlap') {\n      if (value === '' || value === null || value === undefined) return null\n      // A single comma-joined string (the multi-select Category Filter's\n      // ?categoryFilter=a,b,c) expands to multiple ids; one id stays one.\n      const overlapValues = String(value).split(',').map((entry) => entry.trim()).filter(Boolean)\n      if (overlapValues.length === 0) return null\n      const clause = arrayOverlapSql((localizedColumnList(field) || [field]), '$' + paramIndex)\n      queryParams.push(overlapValues)\n      paramIndex++\n      return clause\n    }\n    \n    if (value === null) {\n      if (operand === '=') return `${field} IS NULL`\n      if (operand === '!=') return `${field} IS NOT NULL`\n      return null\n    }\n    \n    const validOps = ['=', '!=', '>', '<', '>=', '<=']\n    const sqlOperator = validOps.includes(operand) ? operand : '='\n    const clause = `${field} ${sqlOperator} $${paramIndex}`\n    queryParams.push(value)\n    paramIndex++\n    return clause\n  }\n  \n  const clause = buildFilterTreeClause(filterTree, buildCondition)\n  if (clause) conditions.push(clause)\n  \n  return paramIndex\n}\n\n").concat(generateDateFormatterCode(), "\n\n").concat(generateSortFieldSqlHelper(tableName), "\n\n").concat(generateSortFallbackFieldHelper(tableName), "\n\n").concat(generateRowOrderTiebreakHelper(rowIdentityColumn(config, tableName)), "\n\n").concat(generateProductFilterClauseHelper(tableName), "\n\n").concat(generateLocalizedColumnsHelper(localizedColumns), "\n\n// Matches DDL / dangerous statements the raw-query branch should refuse.\n// Keep this list conservative \u2014 anything destructive or schema-changing is\n// out of scope for a client-triggered fetch. SELECT and CTEs (WITH ...) are\n// the only shapes consumers legitimately need.\nconst BLOCKED_RAW_QUERY_PATTERNS = [\n  /\\bcreate\\s+(?:temporary\\s+|temp\\s+|unlogged\\s+|global\\s+|local\\s+)?table\\b/i,\n  /\\bcreate\\s+(?:unique\\s+)?index\\b/i,\n  /\\bcreate\\s+(?:or\\s+replace\\s+)?(?:materialized\\s+)?view\\b/i,\n  /\\bcreate\\s+(?:or\\s+replace\\s+)?trigger\\b/i,\n  /\\bcreate\\s+(?:or\\s+replace\\s+)?(?:aggregate\\s+)?function\\b/i,\n  /\\bcreate\\s+(?:or\\s+replace\\s+)?procedure\\b/i,\n  /\\bcreate\\s+(?:database|schema|sequence|extension|type|role|user)\\b/i,\n  /\\bdrop\\s+(?:table|view|index|schema|database|sequence|trigger|function|procedure|role|user|extension|type|materialized)\\b/i,\n  /\\balter\\s+(?:table|view|index|schema|database|sequence|role|user|system)\\b/i,\n  /\\btruncate\\b/i,\n  /\\bgrant\\b/i,\n  /\\brevoke\\b/i,\n  /\\binsert\\b/i,\n  /\\bupdate\\b/i,\n  /\\bdelete\\b/i,\n  /\\bcopy\\b/i,\n  /\\bvacuum\\b/i,\n  /\\breindex\\b/i,\n  /\\bcluster\\b/i,\n]\n\nfunction assertRawQuerySafe(rawQuery) {\n  if (typeof rawQuery !== 'string' || rawQuery.length === 0) {\n    throw new Error('rawQuery must be a non-empty string')\n  }\n  // Reject multi-statement payloads \u2014 only single SELECT / WITH statements.\n  // A trailing semicolon is tolerated but any content after it fails.\n  var trimmed = rawQuery.trim().replace(/;\\s*$/, '')\n  if (trimmed.indexOf(';') !== -1) {\n    throw new Error('rawQuery must contain exactly one statement')\n  }\n  for (var i = 0; i < BLOCKED_RAW_QUERY_PATTERNS.length; i++) {\n    if (BLOCKED_RAW_QUERY_PATTERNS[i].test(trimmed)) {\n      throw new Error('rawQuery contains a blocked statement')\n    }\n  }\n}\n\nexport default async function handler(req, res) {\n").concat(generateReadGuardCall(tableName, 'req.query && req.query.rawQuery'), "\n  const client = getClient()\n\n  try {\n    await client.connect()\n    ").concat(schema ? "await client.query('SET search_path TO ".concat(schema, "')") : '', "\n\n    // If the caller supplied a rawQuery, run it verbatim (after a safety\n    // guard). The schema-driven branch below builds `SELECT * FROM ").concat(tableName, "`\n    // with optional filters \u2014 it's the default read path and ignores\n    // rawQuery. Page-load workflows and other consumers that need a JOIN\n    // or a user-scoped filter pass their fully-rendered SQL here via\n    // `fetchData({ rawQuery })` and expect it to execute verbatim.\n    if (req.query && typeof req.query.rawQuery === 'string' && req.query.rawQuery.length > 0) {\n      assertRawQuerySafe(req.query.rawQuery)\n      // A page's own statement, read for a visitor, runs over the rows a\n      // visitor is served of every narrowed table it names.\n      const rawSql = __rowAccess.narrowRaw ? __brpNarrowRawQuery(req.query.rawQuery) : req.query.rawQuery\n      const rawResult = await client.query(rawSql)\n      const rawRows = Array.isArray(rawResult?.rows) ? rawResult.rows : []\n      const rawPlain = rawRows.map((row) =>\n        row && typeof row.toJSON === 'function' ? row.toJSON() : row\n      )\n      const rawSafe = JSON.parse(JSON.stringify(rawPlain, dateReplacer))\n      return res.status(200).json({\n        success: true,\n        // Every row here ends up in a browser (a page's props or a client\n        // refetch), so no credential column survives, whatever joined it.\n        data: __taWithoutCredentials(\n          __rowAccess.narrowRaw ? __brpStripHiddenOfRaw(req.query.rawQuery, rawSafe) : rawSafe,\n          null\n        ),\n        timestamp: Date.now()\n      })\n    }\n\n    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query\n    // A visitor never filters, sorts or searches by a column it is not served.\n    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)\n    // The language the page is in - what a translatable sort orders by.\n    const requestLocale = typeof req.query.").concat(REQUEST_LOCALE_PARAM, " === 'string' ? req.query.").concat(REQUEST_LOCALE_PARAM, " : null\n    \n    const conditions = []\n    const queryParams = []\n    let paramIndex = 1\n    let searchRank = ''\n    let searchFrom = ''\n    \n    if (query) {\n      let columns = []\n      \n      if (queryColumns) {\n        const parsed = safeJSONParse(queryColumns)\n        columns = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])\n      } else {\n        try {\n          const schemaQuery = `\n            SELECT column_name \n            FROM information_schema.columns \n            WHERE table_name = $1\n            ").concat(schema ? "AND table_schema = $2" : '', "\n            ORDER BY ordinal_position\n          `\n          const schemaParams = ").concat(schema
+    return "".concat(PG_CLIENT_IMPORT, "\n\n").concat(generateTableAccessPreamble(transformOptions.trustedReaderRoles || [], transformOptions.routeExposure ||
+        DataExposure.readExposureFor(transformOptions.dataExposure, { tableName: tableName }), sqlRouteFieldPolicy(config, tableName), tableName, transformOptions), "\nfunction normalizePostgresConnectionString(connectionString) {\n  if (!connectionString || typeof connectionString !== 'string') return connectionString;\n  if (/^postgresql:\\/(?!\\/)/i.test(connectionString)) {\n    return connectionString.replace(/^postgresql:\\//i, 'postgresql://');\n  }\n  return connectionString;\n}\n\nfunction stripSslQueryParamsFromConnectionString(connectionString) {\n  if (!connectionString || typeof connectionString !== 'string') return connectionString;\n  try {\n    var u = new URL(connectionString.replace(/^postgresql:/i, 'postgres:'));\n    u.searchParams.delete('sslmode');\n    u.searchParams.delete('ssl');\n    u.searchParams.delete('sslrootcert');\n    u.searchParams.delete('sslcert');\n    u.searchParams.delete('sslkey');\n    return u.toString().replace(/^postgres:/i, 'postgresql:');\n  } catch (e) {\n    return connectionString;\n  }\n}\n\nconst getClient = () => {\n  var ssl = ").concat(sslCode, ";\n  var connStr = process.env.TELEPORT_DB_CONNECTION_STRING;\n  if (connStr) {\n    connStr = normalizePostgresConnectionString(connStr);\n  }\n  if (ssl === false && connStr) {\n    connStr = stripSslQueryParamsFromConnectionString(connStr);\n  }\n  // No query waits on the database longer than this (enforced by the client:\n  // a server-side statement_timeout does not survive a pooler).\n  if (connStr) {\n    return new Client(Object.assign(\n      { connectionString: connStr, query_timeout: ").concat(DataExposure.READ_QUERY_TIMEOUT_MS, " },\n      ssl !== undefined ? { ssl: ssl } : {}\n    ));\n  }\n  return new Client(Object.assign(\n    {\n      host: ").concat(hostRef, ",\n      port: parseInt(").concat(portRef, " || '5432', 10),\n      user: ").concat(userRef, ",\n      password: ").concat(passwordRef, ",\n      database: ").concat(databaseRef, ",\n      query_timeout: ").concat(DataExposure.READ_QUERY_TIMEOUT_MS, ",\n    },\n    ssl !== undefined ? { ssl: ssl } : {}\n  ));\n}\n\n").concat(generateSafeJSONParseCode(), "\n\n").concat(generateFilterTreeHelpersCode(), "\n\n").concat(generateSearchEscapeHelpersCode(), "\n").concat(generateSearchSqlHelpersCode(PG_SEARCH_SQL), "\n").concat(generateArrayOverlapSqlCode(), "\n").concat(getTransformationCode(tableName, transformOptions), "\n").concat(getTransformWrapperCode(tableName, transformOptions), "\n").concat(generateRequestSqlGuardsCode(), "\nconst processFilters = (filters, conditions, queryParams, paramIndex) => {\n  if (!filters) return paramIndex\n  \n  const filterTree = normalizeFilterTree(safeJSONParse(filters))\n  if (!filterTree) return paramIndex\n  \n  const buildCondition = (condition) => {\n    const field = condition.source\n    const normalizedCondition = normalizeInOperand(condition.operand, condition.destination)\n    if (normalizedCondition === null) return null\n    const value = normalizedCondition.value\n    const operand = normalizedCondition.operand\n    \n    // The products table's virtual fields (effective price, rating bucket,\n    // on-sale flag, variant axes) are whole clauses, not columns - so they are\n    // answered before any branch below can interpolate the field name raw.\n    const productClause = productFilterClause(field, operand, value, (param) => {\n      queryParams.push(param)\n      return '$' + paramIndex++\n    })\n    if (productClause !== null) return productClause\n\n    // A translatable column is compared against the value in every language,\n    // so a localized slug resolves under any locale - see localized-columns.ts.\n    const localizedClause = localizedEqualityClause(field, operand, value, (param) => {\n      queryParams.push(param)\n      return '$' + paramIndex++\n    })\n    if (localizedClause !== null) return localizedClause\n    assertRequestColumn(field, 'filter field')\n    \n    if (Array.isArray(value)) {\n      if (value.length === 0) return null\n      if (operand === 'array_overlap') {\n        // The row's list (see array-overlap-sql.ts) shares any value with the set.\n        const clause = arrayOverlapSql((localizedColumnList(field) || [field]), '$' + paramIndex)\n        queryParams.push(value.map((entry) => String(entry)))\n        paramIndex++\n        return clause\n      }\n      const placeholders = value.map(() => `$${paramIndex++}`)\n      queryParams.push(...value)\n      return operand === '!='\n        ? `${field} NOT IN (${placeholders.join(', ')})`\n        : `${field} IN (${placeholders.join(', ')})`\n    }\n    \n    if (operand === 'array_overlap') {\n      if (value === '' || value === null || value === undefined) return null\n      // A single comma-joined string (the multi-select Category Filter's\n      // ?categoryFilter=a,b,c) expands to multiple ids; one id stays one.\n      const overlapValues = String(value).split(',').map((entry) => entry.trim()).filter(Boolean)\n      if (overlapValues.length === 0) return null\n      const clause = arrayOverlapSql((localizedColumnList(field) || [field]), '$' + paramIndex)\n      queryParams.push(overlapValues)\n      paramIndex++\n      return clause\n    }\n    \n    if (value === null) {\n      if (operand === '=') return `${field} IS NULL`\n      if (operand === '!=') return `${field} IS NOT NULL`\n      return null\n    }\n    \n    // 'like' reads a JSON-list cell for one member (a post's former slugs); the\n    // value is a bound parameter, so a pattern never reaches the SQL text.\n    const validOps = ['=', '!=', '>', '<', '>=', '<=', 'like']\n    const sqlOperator = validOps.includes(operand) ? operand : '='\n    const clause = `${field} ${sqlOperator} $${paramIndex}`\n    queryParams.push(value)\n    paramIndex++\n    return clause\n  }\n  \n  const clause = buildFilterTreeClause(filterTree, buildCondition)\n  if (clause) conditions.push(clause)\n  \n  return paramIndex\n}\n\n").concat(generateDateFormatterCode(), "\n\n").concat(generateSortFieldSqlHelper(tableName), "\n\n").concat(generateSortFallbackFieldHelper(tableName), "\n\n").concat(generateRowOrderTiebreakHelper(rowIdentityColumn(config, tableName)), "\n\n").concat(generateProductFilterClauseHelper(tableName), "\n\n").concat(generateLocalizedColumnsHelper(localizedColumns), "\n\n// Matches DDL / dangerous statements the raw-query branch should refuse.\n// Keep this list conservative \u2014 anything destructive or schema-changing is\n// out of scope for a client-triggered fetch. SELECT and CTEs (WITH ...) are\n// the only shapes consumers legitimately need.\nconst BLOCKED_RAW_QUERY_PATTERNS = [\n  /\\bcreate\\s+(?:temporary\\s+|temp\\s+|unlogged\\s+|global\\s+|local\\s+)?table\\b/i,\n  /\\bcreate\\s+(?:unique\\s+)?index\\b/i,\n  /\\bcreate\\s+(?:or\\s+replace\\s+)?(?:materialized\\s+)?view\\b/i,\n  /\\bcreate\\s+(?:or\\s+replace\\s+)?trigger\\b/i,\n  /\\bcreate\\s+(?:or\\s+replace\\s+)?(?:aggregate\\s+)?function\\b/i,\n  /\\bcreate\\s+(?:or\\s+replace\\s+)?procedure\\b/i,\n  /\\bcreate\\s+(?:database|schema|sequence|extension|type|role|user)\\b/i,\n  /\\bdrop\\s+(?:table|view|index|schema|database|sequence|trigger|function|procedure|role|user|extension|type|materialized)\\b/i,\n  /\\balter\\s+(?:table|view|index|schema|database|sequence|role|user|system)\\b/i,\n  /\\btruncate\\b/i,\n  /\\bgrant\\b/i,\n  /\\brevoke\\b/i,\n  /\\binsert\\b/i,\n  /\\bupdate\\b/i,\n  /\\bdelete\\b/i,\n  /\\bcopy\\b/i,\n  /\\bvacuum\\b/i,\n  /\\breindex\\b/i,\n  /\\bcluster\\b/i,\n]\n\nfunction assertRawQuerySafe(rawQuery) {\n  if (typeof rawQuery !== 'string' || rawQuery.length === 0) {\n    throw new Error('rawQuery must be a non-empty string')\n  }\n  // Reject multi-statement payloads \u2014 only single SELECT / WITH statements.\n  // A trailing semicolon is tolerated but any content after it fails.\n  var trimmed = rawQuery.trim().replace(/;\\s*$/, '')\n  if (trimmed.indexOf(';') !== -1) {\n    throw new Error('rawQuery must contain exactly one statement')\n  }\n  for (var i = 0; i < BLOCKED_RAW_QUERY_PATTERNS.length; i++) {\n    if (BLOCKED_RAW_QUERY_PATTERNS[i].test(trimmed)) {\n      throw new Error('rawQuery contains a blocked statement')\n    }\n  }\n}\n\nexport default async function handler(req, res) {\n").concat(generateReadGuardCall(tableName, 'req.query && req.query.rawQuery'), "\n  const client = getClient()\n\n  try {\n    await client.connect()\n    ").concat(schema ? "await client.query('SET search_path TO ".concat(schema, "')") : '', "\n\n    // If the caller supplied a rawQuery, run it verbatim (after a safety\n    // guard). The schema-driven branch below builds `SELECT * FROM ").concat(tableName, "`\n    // with optional filters \u2014 it's the default read path and ignores\n    // rawQuery. Page-load workflows and other consumers that need a JOIN\n    // or a user-scoped filter pass their fully-rendered SQL here via\n    // `fetchData({ rawQuery })` and expect it to execute verbatim.\n    if (req.query && typeof req.query.rawQuery === 'string' && req.query.rawQuery.length > 0) {\n      assertRawQuerySafe(req.query.rawQuery)\n      // A page's own statement, read for a visitor, runs over the rows a\n      // visitor is served of every narrowed table it names.\n      const rawSql = __rowAccess.narrowRaw ? __brpNarrowRawQuery(req.query.rawQuery) : req.query.rawQuery\n      const rawResult = await client.query(rawSql)\n      const rawRows = Array.isArray(rawResult?.rows) ? rawResult.rows : []\n      const rawPlain = rawRows.map((row) =>\n        row && typeof row.toJSON === 'function' ? row.toJSON() : row\n      )\n      const rawSafe = JSON.parse(JSON.stringify(rawPlain, dateReplacer))\n      return res.status(200).json({\n        success: true,\n        // Every row here ends up in a browser (a page's props or a client\n        // refetch), so no credential column survives, whatever joined it.\n        data: __taWithoutCredentials(\n          __rowAccess.narrowRaw ? __brpStripHiddenOfRaw(req.query.rawQuery, rawSafe) : rawSafe,\n          null\n        ),\n        timestamp: Date.now()\n      })\n    }\n\n    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query\n    // A visitor never filters, sorts or searches by a column it is not served.\n    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)\n    // The language the page is in - what a translatable sort orders by.\n    const requestLocale = typeof req.query.").concat(REQUEST_LOCALE_PARAM, " === 'string' ? req.query.").concat(REQUEST_LOCALE_PARAM, " : null\n    \n    const conditions = []\n    const queryParams = []\n    let paramIndex = 1\n    let searchRank = ''\n    let searchFrom = ''\n    \n    if (query) {\n      let columns = []\n      \n      if (queryColumns) {\n        const parsed = safeJSONParse(queryColumns)\n        columns = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])\n      } else {\n        try {\n          const schemaQuery = `\n            SELECT column_name \n            FROM information_schema.columns \n            WHERE table_name = $1\n            ").concat(schema ? "AND table_schema = $2" : '', "\n            ORDER BY ordinal_position\n          `\n          const schemaParams = ").concat(schema
         ? "[".concat(JSON.stringify(tableName), ", ").concat(JSON.stringify(schema), "]")
-        : "[".concat(JSON.stringify(tableName), "]"), "\n          \n          const schemaResult = await client.query(schemaQuery, schemaParams)\n          columns = schemaResult.rows.map(row => row.column_name)\n        } catch (schemaError) {\n          console.warn('Failed to fetch column names from information_schema:', schemaError.message)\n        }\n      }\n      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)\n      \n      const search = buildSearchSql(query, columns, paramIndex)\n      if (search) {\n        conditions.push(search.where)\n        queryParams.push(...search.params)\n        paramIndex = search.nextIndex\n        searchRank = search.rank\n        searchFrom = search.from\n      }\n    }\n    \n    paramIndex = processFilters(filters, conditions, queryParams, paramIndex)\n    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')\n    \n    // A search's worked-out texts stay out of the rows: only the table's own columns.\n    let sql = `SELECT ${searchFrom ? '").concat(tableName, ".*' : '*'} FROM ").concat(tableName, "${searchFrom}`\n    \n    if (conditions.length > 0) {\n      sql += ` WHERE ${conditions.join(' AND ')}`\n    }\n    \n    // Handle sorts - new array format. Two ORDER BY clauses are built: the one\n    // actually used (a translatable column in the request's language, the\n    // products table's price rewrites, rows without a value last), and a\n    // plain-column twin kept only as the fallback below.\n    // A search orders its matches by where the words are first; the sort\n    // orders the rows within each of those groups.\n    let orderBySql = ''\n    let plainOrderBySql = ''\n    const searchOrder = searchRank ? searchRank + ', ' : ''\n    if (sorts) {\n      const parsedSorts = safeJSONParse(sorts)\n      if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {\n        const valid = parsedSorts.filter((sort) => sort && sort.field)\n        valid.forEach((sort) => assertRequestColumn(sort.field, 'sort field'))\n        const orderOf = (sort) => (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'\n        const orderClauses = valid.map((sort) => `${localizedSortFieldSql(sort.field, requestLocale) || sortFieldSql(sort.field)} ${orderOf(sort)}").concat(SORT_NULLS_LAST_SQL, "`)\n        const plainClauses = valid.map((sort) => `${sortFallbackField(sort.field)} ${orderOf(sort)}`)\n\n        if (orderClauses.length > 0) {\n          // The row's own key last, so equal rows can't repeat across pages\n          // or vanish between them.\n          const tiebreak = rowOrderTiebreak(valid.map((sort) => sort.field), orderOf(valid[valid.length - 1]))\n          orderBySql = ` ORDER BY ${searchOrder}${orderClauses.join(', ')}${tiebreak}`\n          plainOrderBySql = ` ORDER BY ${searchOrder}${plainClauses.join(', ')}${tiebreak}`\n        }\n      }\n    } else if (sortBy) {\n      assertRequestColumn(sortBy, 'sort field')\n      const sortByDirection = (sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'\n      const tiebreak = rowOrderTiebreak([sortBy], sortByDirection)\n      orderBySql = ` ORDER BY ${searchOrder}${localizedSortFieldSql(sortBy, requestLocale) || sortBy} ${sortByDirection}").concat(SORT_NULLS_LAST_SQL, "${tiebreak}`\n      plainOrderBySql = ` ORDER BY ${searchOrder}${sortBy} ${sortByDirection}${tiebreak}`\n    }\n    if (!orderBySql && searchRank) {\n      orderBySql = plainOrderBySql = ' ORDER BY ' + searchRank + rowOrderTiebreak([], 'ASC')\n    }\n    const usedRewrittenSort = orderBySql !== plainOrderBySql\n\n    const limitValue = requestRowCount(limit || perPage)\n    const offsetValue = offset !== undefined ? parseInt(offset) : (page && perPage ? (parseInt(page) - 1) * parseInt(perPage) : undefined)\n\n    let sqlTail = ''\n    if (limitValue !== undefined) {\n      sqlTail += ` LIMIT ${limitValue}`\n    }\n    \n    if (offsetValue !== undefined) {\n      sqlTail += ` OFFSET ${offsetValue}`\n    }\n\n    const baseSql = sql\n    sql = baseSql + orderBySql + sqlTail\n\n    // The discount-aware price ordering is an inline sub-select over a JSON\n    // column. It is written to be unraisable, but it runs inside ORDER BY for\n    // the whole table - so if a database ever rejects it, fall back to ordering\n    // by the stored list price rather than serving an empty products page. The\n    // translatable-column ordering takes the same exit: a per-language column\n    // the schema had at generation time may have been dropped since. So does\n    // the empty-values-last ordering.\n    let result\n    try {\n      result = await client.query(sql, queryParams)\n    } catch (sortError) {\n      if (!usedRewrittenSort) throw sortError\n      console.warn(\n        'Rewritten sort failed; falling back to the plain column:',\n        sortError && sortError.message\n      )\n      result = await client.query(baseSql + plainOrderBySql + sqlTail, queryParams)\n    }\n    const rows = Array.isArray(result?.rows) ? result.rows : []\n    const plainRows = rows.map((row) =>\n      row && typeof row.toJSON === 'function' ? row.toJSON() : row\n    )\n    const safeData = JSON.parse(JSON.stringify(plainRows, dateReplacer))\n    ").concat(getTransformExpression(tableName)
+        : "[".concat(JSON.stringify(tableName), "]"), "\n          \n          const schemaResult = await client.query(schemaQuery, schemaParams)\n          // A credential column is never searched: a search is an oracle for it.\n          columns = schemaResult.rows.map(row => row.column_name).filter((column) => !__taIsCredentialColumn(column))\n        } catch (schemaError) {\n          console.warn('Failed to fetch column names from information_schema:', schemaError.message)\n        }\n      }\n      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)\n      \n      const search = buildSearchSql(query, columns, paramIndex)\n      if (search) {\n        conditions.push(search.where)\n        queryParams.push(...search.params)\n        paramIndex = search.nextIndex\n        searchRank = search.rank\n        searchFrom = search.from\n      }\n    }\n    \n    paramIndex = processFilters(filters, conditions, queryParams, paramIndex)\n    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')\n    \n    // A search's worked-out texts stay out of the rows: only the table's own columns.\n    let sql = `SELECT ${searchFrom ? '").concat(tableName, ".*' : '*'} FROM ").concat(tableName, "${searchFrom}`\n    \n    if (conditions.length > 0) {\n      sql += ` WHERE ${conditions.join(' AND ')}`\n    }\n    \n    // Handle sorts - new array format. Two ORDER BY clauses are built: the one\n    // actually used (a translatable column in the request's language, the\n    // products table's price rewrites, rows without a value last), and a\n    // plain-column twin kept only as the fallback below.\n    // A search orders its matches by where the words are first; the sort\n    // orders the rows within each of those groups.\n    let orderBySql = ''\n    let plainOrderBySql = ''\n    const searchOrder = searchRank ? searchRank + ', ' : ''\n    if (sorts) {\n      const parsedSorts = safeJSONParse(sorts)\n      if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {\n        const valid = parsedSorts.filter((sort) => sort && sort.field)\n        valid.forEach((sort) => assertRequestColumn(sort.field, 'sort field'))\n        const orderOf = (sort) => (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'\n        const orderClauses = valid.map((sort) => `${localizedSortFieldSql(sort.field, requestLocale) || sortFieldSql(sort.field)} ${orderOf(sort)}").concat(SORT_NULLS_LAST_SQL, "`)\n        const plainClauses = valid.map((sort) => `${sortFallbackField(sort.field)} ${orderOf(sort)}`)\n\n        if (orderClauses.length > 0) {\n          // The row's own key last, so equal rows can't repeat across pages\n          // or vanish between them.\n          const tiebreak = rowOrderTiebreak(valid.map((sort) => sort.field), orderOf(valid[valid.length - 1]))\n          orderBySql = ` ORDER BY ${searchOrder}${orderClauses.join(', ')}${tiebreak}`\n          plainOrderBySql = ` ORDER BY ${searchOrder}${plainClauses.join(', ')}${tiebreak}`\n        }\n      }\n    } else if (sortBy) {\n      assertRequestColumn(sortBy, 'sort field')\n      const sortByDirection = (sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'\n      const tiebreak = rowOrderTiebreak([sortBy], sortByDirection)\n      orderBySql = ` ORDER BY ${searchOrder}${localizedSortFieldSql(sortBy, requestLocale) || sortBy} ${sortByDirection}").concat(SORT_NULLS_LAST_SQL, "${tiebreak}`\n      plainOrderBySql = ` ORDER BY ${searchOrder}${sortBy} ${sortByDirection}${tiebreak}`\n    }\n    if (!orderBySql && searchRank) {\n      orderBySql = plainOrderBySql = ' ORDER BY ' + searchRank + rowOrderTiebreak([], 'ASC')\n    }\n    const usedRewrittenSort = orderBySql !== plainOrderBySql\n\n    // Whole numbers only, and a browser's read capped - see __taReadWindow.\n    const __window = __taReadWindow(req)\n    const limitValue = __window.limit || __window.perPage\n    const offsetValue = __window.offset !== undefined ? __window.offset : (__window.page && __window.perPage ? (__window.page - 1) * __window.perPage : undefined)\n\n    let sqlTail = ''\n    if (limitValue !== undefined) {\n      sqlTail += ` LIMIT ${limitValue}`\n    }\n    \n    if (offsetValue !== undefined) {\n      sqlTail += ` OFFSET ${offsetValue}`\n    }\n\n    const baseSql = sql\n    sql = baseSql + orderBySql + sqlTail\n\n    // The discount-aware price ordering is an inline sub-select over a JSON\n    // column. It is written to be unraisable, but it runs inside ORDER BY for\n    // the whole table - so if a database ever rejects it, fall back to ordering\n    // by the stored list price rather than serving an empty products page. The\n    // translatable-column ordering takes the same exit: a per-language column\n    // the schema had at generation time may have been dropped since. So does\n    // the empty-values-last ordering.\n    let result\n    try {\n      result = await client.query(sql, queryParams)\n    } catch (sortError) {\n      if (!usedRewrittenSort) throw sortError\n      console.warn(\n        'Rewritten sort failed; falling back to the plain column:',\n        sortError && sortError.message\n      )\n      result = await client.query(baseSql + plainOrderBySql + sqlTail, queryParams)\n    }\n    const rows = Array.isArray(result?.rows) ? result.rows : []\n    const plainRows = rows.map((row) =>\n      row && typeof row.toJSON === 'function' ? row.toJSON() : row\n    )\n    const safeData = JSON.parse(JSON.stringify(plainRows, dateReplacer))\n    ").concat(getTransformExpression(tableName)
         ? "const transformedData = ".concat(getTransformExpression(tableName))
         : '', "\n\n    // Stamp each row with a globally-correct 1-based `__rowNumber` (the page\n    // offset is applied server-side above), so list index columns keep counting\n    // across pages instead of restarting at 1. Renderer-internal field \u2014 it is\n    // filtered from ordinary field bindings and only read by the index column.\n    const __finalData = ").concat(getTransformExpression(tableName) ? 'transformedData' : 'safeData', "\n    const __rowNumberStart = (typeof offsetValue === 'number' && !isNaN(offsetValue)) ? offsetValue : 0\n    const __numberedData = Array.isArray(__finalData)\n      ? __finalData.map((__row, __i) =>\n          __row && typeof __row === 'object' && !Array.isArray(__row)\n            ? Object.assign({}, __row, { __rowNumber: __rowNumberStart + __i + 1 })\n            : __row)\n      : __finalData\n\n    return res.status(200).json({\n      success: true,\n      data: __taWithoutCredentials(\n        __rowPolicy ? __brpStripHidden(__rowPolicy, __numberedData) : __numberedData,\n        ").concat(JSON.stringify(tableName), "\n      ),\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('Teleport DB fetch error:', error)\n    // A database error names tables, columns and values: it stays in the server\n    // log. Only an error this route raised for the caller (it carries a status)\n    // is repeated to it.\n    return res.status(error.status || 500).json({\n      success: false,\n      error: error.status ? error.message : 'Failed to fetch data',\n      timestamp: Date.now()\n    })\n  } finally {\n    if (client) {\n      try {\n        await client.end()\n      } catch (error) {\n        console.error('Error closing database client:', error)\n      }\n    }\n  }\n}\n");
 };
@@ -68,6 +70,6 @@ export var generateTeleportCountFetcher = function (config, tableName) {
     var hasSchema = !!((_a = dbConfig.options) === null || _a === void 0 ? void 0 : _a.schema);
     return "\nasync function getCount(req, res) {\n".concat(generateReadGuardCall(tableName, null), "\n  const client = getClient()\n\n  try {\n    await client.connect()\n    const { query, queryColumns, filters } = req.query\n    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)\n    const conditions = []\n    const queryParams = []\n    let paramIndex = 1\n    let searchFrom = ''\n\n    if (query) {\n      let columns = []\n      \n      if (queryColumns) {\n        const parsed = safeJSONParse(queryColumns)\n        columns = Array.isArray(parsed) ? parsed : [parsed]\n      } else {\n        try {\n          const schemaQuery = `\n            SELECT column_name \n            FROM information_schema.columns \n            WHERE table_name = $1\n            ").concat(hasSchema ? "AND table_schema = $2" : '', "\n            ORDER BY ordinal_position\n          `\n          const schemaParams = ").concat(hasSchema
         ? "[".concat(JSON.stringify(tableName), ", ").concat(JSON.stringify(dbConfig.options.schema), "]")
-        : "[".concat(JSON.stringify(tableName), "]"), "\n          \n          const schemaResult = await client.query(schemaQuery, schemaParams)\n          columns = schemaResult.rows.map(row => row.column_name)\n        } catch (schemaError) {\n          console.warn('Failed to fetch column names from information_schema:', schemaError.message)\n        }\n      }\n      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)\n      \n      const search = buildSearchSql(query, columns, paramIndex)\n      if (search) {\n        conditions.push(search.where)\n        queryParams.push(...search.params)\n        paramIndex = search.nextIndex\n        searchFrom = search.from\n      }\n    }\n\n    paramIndex = processFilters(filters, conditions, queryParams, paramIndex)\n    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')\n\n    let countSql = `SELECT COUNT(*) FROM ").concat(tableName, "${searchFrom}`\n    if (conditions.length > 0) {\n      countSql += ` WHERE ${conditions.join(' AND ')}`\n    }\n\n    const result = await client.query(countSql, queryParams)\n    const count = parseInt(result.rows[0].count, 10)\n\n    return res.status(200).json({\n      success: true,\n      count: count,\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('Error getting count:', error)\n    return res.status(error.status || 500).json({\n      success: false,\n      error: error.status ? error.message : 'Failed to get count',\n      timestamp: Date.now()\n    })\n  } finally {\n    if (client) {\n      try {\n        await client.end()\n      } catch (error) {\n        console.error('Error closing database client:', error)\n      }\n    }\n  }\n}\n");
+        : "[".concat(JSON.stringify(tableName), "]"), "\n          \n          const schemaResult = await client.query(schemaQuery, schemaParams)\n          // A credential column is never searched: a search is an oracle for it.\n          columns = schemaResult.rows.map(row => row.column_name).filter((column) => !__taIsCredentialColumn(column))\n        } catch (schemaError) {\n          console.warn('Failed to fetch column names from information_schema:', schemaError.message)\n        }\n      }\n      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)\n      \n      const search = buildSearchSql(query, columns, paramIndex)\n      if (search) {\n        conditions.push(search.where)\n        queryParams.push(...search.params)\n        paramIndex = search.nextIndex\n        searchFrom = search.from\n      }\n    }\n\n    paramIndex = processFilters(filters, conditions, queryParams, paramIndex)\n    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')\n\n    let countSql = `SELECT COUNT(*) FROM ").concat(tableName, "${searchFrom}`\n    if (conditions.length > 0) {\n      countSql += ` WHERE ${conditions.join(' AND ')}`\n    }\n\n    const result = await client.query(countSql, queryParams)\n    const count = parseInt(result.rows[0].count, 10)\n\n    return res.status(200).json({\n      success: true,\n      count: count,\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('Error getting count:', error)\n    return res.status(error.status || 500).json({\n      success: false,\n      error: error.status ? error.message : 'Failed to get count',\n      timestamp: Date.now()\n    })\n  } finally {\n    if (client) {\n      try {\n        await client.end()\n      } catch (error) {\n        console.error('Error closing database client:', error)\n      }\n    }\n  }\n}\n");
 };
 //# sourceMappingURL=teleport.js.map

package/dist/esm/fetchers/teleport.js.map

@@ -1 +1 @@
-{"version":3,"file":"teleport.js","sourceRoot":"","sources":["../../../src/fetchers/teleport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAA;AAC5E,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAgBrD,IAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,sBAAsB;IAChC,QAAQ,EAAE,kBAAkB;IAC5B,GAAG,EAAE,iBAAiB;CACvB,CAAA;AAED,IAAM,mBAAmB,GAAG,UAAC,KAAc,EAAE,aAAqB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE;QACxE,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;KACrC;IACD,OAAO,sBAAe,aAAa,CAAE,CAAA;AACvC,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,sBAAsB,GAAG,UACpC,MAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;KAClE;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,uBAAuB,GAAG,UACrC,MAA+B,EAC/B,SAAiB,EACjB,gBAA6C;;IAA7C,iCAAA,EAAA,qBAA6C;IAE7C,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,MAAM,GAAG,MAAA,QAAQ,CAAC,OAAO,0CAAE,MAAM,CAAA;IACvC,IAAM,WAAW,GAAG,CAAC,CAAA,MAAA,MAAA,QAAQ,CAAC,cAAc,0CAAG,SAAS,CAAC,0CAAE,OAAO,KAAI,EAAE,CAAC;SACtE,GAAG,CAAC,UAAC,MAAM,IAAK,OAAA,MAAM,CAAC,IAAI,EAAX,CAAW,CAAC;SAC5B,MAAM,CAAC,UAAC,IAAI,IAAqB,OAAA,OAAO,IAAI,KAAK,QAAQ,EAAxB,CAAwB,CAAC,CAAA;IAC7D,IAAM,gBAAgB,GAAG,uBAAuB,CAAC,WAAW,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;IAE5F,IAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACzE,IAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACzE,IAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC9F,IAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACrF,IAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAErF,IAAM,OAAO,GACX,QAAQ,CAAC,GAAG,KAAK,KAAK;QACpB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC,SAAS;YACpB,CAAC,CAAC,mBAEA,QAAQ,CAAC,SAAS,CAAC,EAAE;gBACnB,CAAC,CAAC,cAAO,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,oBAAoB,CAAC,MAAG;gBAC5E,CAAC,CAAC,EAAE,qBAGN,QAAQ,CAAC,SAAS,CAAC,IAAI;gBACrB,CAAC,CAAC,gBAAS,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC,MAAG;gBAClF,CAAC,CAAC,EAAE,qBAGN,QAAQ,CAAC,SAAS,CAAC,GAAG;gBACpB,CAAC,CAAC,eAAQ,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,MAAG;gBAC/E,CAAC,CAAC,EAAE,6CAGR;YACA,CAAC,CAAC,uBAAgB,gBAAgB,CAAC,GAAG,gDAAsC,gBAAgB,CAAC,GAAG,6DAA0D,CAAA;IAE9J,OAAO,UAAG,gBAAgB,iBAE1B,2BAA2B,CAAC,gBAAgB,CAAC,kBAAkB,IAAI,EAAE,CAAC,g7BAyB1D,OAAO,udAgBP,OAAO,qCACE,OAAO,2CAChB,OAAO,gCACH,WAAW,gCACX,WAAW,+EAM3B,yBAAyB,EAAE,iBAE3B,6BAA6B,EAAE,iBAE/B,+BAA+B,EAAE,eACjC,4BAA4B,CAAC,aAAa,CAAC,eAC3C,2BAA2B,EAAE,eAC7B,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,CAAC,eAClD,uBAAuB,CAAC,SAAS,EAAE,gBAAgB,CAAC,eACpD,4BAA4B,EAAE,6tGAgF9B,yBAAyB,EAAE,iBAE3B,0BAA0B,CAAC,SAAS,CAAC,iBAErC,+BAA+B,CAAC,SAAS,CAAC,iBAE1C,8BAA8B,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,iBAEpE,iCAAiC,CAAC,SAAS,CAAC,iBAE5C,8BAA8B,CAAC,gBAAgB,CAAC,g7DA8ChD,qBAAqB,CAAC,SAAS,EAAE,iCAAiC,CAAC,wFAK/D,MAAM,CAAC,CAAC,CAAC,iDAA0C,MAAM,OAAI,CAAC,CAAC,CAAC,EAAE,gKAGD,SAAS,oyDAgCnC,oBAAoB,uCAA6B,oBAAoB,+iBAoBpG,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,kGAIvC,MAAM;QACJ,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAG;QAC7D,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAG,i+BAyBN,SAAS,6BAAmB,SAAS,mrCAqBwE,mBAAmB,y7BAe5C,mBAAmB,46DA+C3I,sBAAsB,CAAC,SAAS,CAAC;QAC/B,CAAC,CAAC,kCAA2B,sBAAsB,CAAC,SAAS,CAAC,CAAE;QAChE,CAAC,CAAC,EAAE,iXAOc,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,8lBAalF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,grBAwBlC,CAAA;AACD,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,4BAA4B,GAAG,UAC1C,MAA+B,EAC/B,SAAiB;;IAEjB,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,SAAS,GAAG,CAAC,CAAC,CAAA,MAAA,QAAQ,CAAC,OAAO,0CAAE,MAAM,CAAA,CAAA;IAE5C,OAAO,iDAEP,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,yrBAwB1B,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,kGAI1C,SAAS;QACP,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAQ,CAAC,MAAM,CAAC,MAAG;QAC/E,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAG,k2BAuBJ,SAAS,uxBA8BpD,CAAA;AACD,CAAC,CAAA"}
+{"version":3,"file":"teleport.js","sourceRoot":"","sources":["../../../src/fetchers/teleport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,UAAU,CAAA;AACjB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAA;AAC5E,OAAO,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AAC9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAgBrD,IAAM,gBAAgB,GAAG;IACvB,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,sBAAsB;IAChC,QAAQ,EAAE,kBAAkB;IAC5B,GAAG,EAAE,iBAAiB;CACvB,CAAA;AAED,IAAM,mBAAmB,GAAG,UAAC,KAAc,EAAE,aAAqB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE;QACxE,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAA;KACrC;IACD,OAAO,sBAAe,aAAa,CAAE,CAAA;AACvC,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,sBAAsB,GAAG,UACpC,MAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;KAClE;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,uBAAuB,GAAG,UACrC,MAA+B,EAC/B,SAAiB,EACjB,gBAA6C;;IAA7C,iCAAA,EAAA,qBAA6C;IAE7C,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,MAAM,GAAG,MAAA,QAAQ,CAAC,OAAO,0CAAE,MAAM,CAAA;IACvC,IAAM,WAAW,GAAG,CAAC,CAAA,MAAA,MAAA,QAAQ,CAAC,cAAc,0CAAG,SAAS,CAAC,0CAAE,OAAO,KAAI,EAAE,CAAC;SACtE,GAAG,CAAC,UAAC,MAAM,IAAK,OAAA,MAAM,CAAC,IAAI,EAAX,CAAW,CAAC;SAC5B,MAAM,CAAC,UAAC,IAAI,IAAqB,OAAA,OAAO,IAAI,KAAK,QAAQ,EAAxB,CAAwB,CAAC,CAAA;IAC7D,IAAM,gBAAgB,GAAG,uBAAuB,CAAC,WAAW,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAA;IAE5F,IAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACzE,IAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACzE,IAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC9F,IAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IACrF,IAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAErF,IAAM,OAAO,GACX,QAAQ,CAAC,GAAG,KAAK,KAAK;QACpB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC,SAAS;YACpB,CAAC,CAAC,mBAEA,QAAQ,CAAC,SAAS,CAAC,EAAE;gBACnB,CAAC,CAAC,cAAO,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,oBAAoB,CAAC,MAAG;gBAC5E,CAAC,CAAC,EAAE,qBAGN,QAAQ,CAAC,SAAS,CAAC,IAAI;gBACrB,CAAC,CAAC,gBAAS,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC,MAAG;gBAClF,CAAC,CAAC,EAAE,qBAGN,QAAQ,CAAC,SAAS,CAAC,GAAG;gBACpB,CAAC,CAAC,eAAQ,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,qBAAqB,CAAC,MAAG;gBAC/E,CAAC,CAAC,EAAE,6CAGR;YACA,CAAC,CAAC,uBAAgB,gBAAgB,CAAC,GAAG,gDAAsC,gBAAgB,CAAC,GAAG,6DAA0D,CAAA;IAE9J,OAAO,UAAG,gBAAgB,iBAE1B,2BAA2B,CAC3B,gBAAgB,CAAC,kBAAkB,IAAI,EAAE,EACzC,gBAAgB,CAAC,aAAa;QAC5B,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,YAAY,EAAE,EAAE,SAAS,WAAA,EAAE,CAAC,EAC5E,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,EACtC,SAAS,EACT,gBAAgB,CACjB,g7BAyBa,OAAO,kgBAY+B,YAAY,CAAC,qBAAqB,oIAMxE,OAAO,qCACE,OAAO,2CAChB,OAAO,gCACH,WAAW,gCACX,WAAW,qCACN,YAAY,CAAC,qBAAqB,+EAMvD,yBAAyB,EAAE,iBAE3B,6BAA6B,EAAE,iBAE/B,+BAA+B,EAAE,eACjC,4BAA4B,CAAC,aAAa,CAAC,eAC3C,2BAA2B,EAAE,eAC7B,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,CAAC,eAClD,uBAAuB,CAAC,SAAS,EAAE,gBAAgB,CAAC,eACpD,4BAA4B,EAAE,o4GAkF9B,yBAAyB,EAAE,iBAE3B,0BAA0B,CAAC,SAAS,CAAC,iBAErC,+BAA+B,CAAC,SAAS,CAAC,iBAE1C,8BAA8B,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,iBAEpE,iCAAiC,CAAC,SAAS,CAAC,iBAE5C,8BAA8B,CAAC,gBAAgB,CAAC,g7DA8ChD,qBAAqB,CAAC,SAAS,EAAE,iCAAiC,CAAC,wFAK/D,MAAM,CAAC,CAAC,CAAC,iDAA0C,MAAM,OAAI,CAAC,CAAC,CAAC,EAAE,gKAGD,SAAS,oyDAgCnC,oBAAoB,uCAA6B,oBAAoB,+iBAoBpG,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,kGAIvC,MAAM;QACJ,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAG;QAC7D,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAG,wmCA0BN,SAAS,6BAAmB,SAAS,mrCAqBwE,mBAAmB,y7BAe5C,mBAAmB,6jEAiD3I,sBAAsB,CAAC,SAAS,CAAC;QAC/B,CAAC,CAAC,kCAA2B,sBAAsB,CAAC,SAAS,CAAC,CAAE;QAChE,CAAC,CAAC,EAAE,iXAOc,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,8lBAalF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,grBAwBlC,CAAA;AACD,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,4BAA4B,GAAG,UAC1C,MAA+B,EAC/B,SAAiB;;IAEjB,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,SAAS,GAAG,CAAC,CAAC,CAAA,MAAA,QAAQ,CAAC,OAAO,0CAAE,MAAM,CAAA,CAAA;IAE5C,OAAO,iDAEP,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,yrBAwB1B,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,kGAI1C,SAAS;QACP,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAQ,CAAC,MAAM,CAAC,MAAG;QAC/E,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAG,y+BAwBJ,SAAS,uxBA8BpD,CAAA;AACD,CAAC,CAAA"}

package/dist/esm/fetchers/utils/external-read-guard.d.ts

@@ -0,0 +1,53 @@
+import type { DataReadExposure } from '@teleporthq/teleport-types';
+import { RequestFieldPolicy, SchemaColumn, SessionReaderPlacement } from './table-access-guard';
+/**
+ * The same guard for a read route over an EXTERNAL source (MySQL, MariaDB,
+ * Redshift, ClickHouse, Turso, Supabase, MongoDB, Firestore, Airtable, Redis,
+ * REST, Google Sheets, CSV, JavaScript) as the TeleportHQ / Postgres routes
+ * carry inline: the table's exposure, the protected-table net, a row window of
+ * whole numbers (a browser's capped), request fields of a safe shape, no
+ * credential column in a row, and a generic error to the client.
+ *
+ * The drivers differ in everything else, so the guard wraps the driver's
+ * handler rather than living inside fourteen of them: the driver runs only for
+ * a request the guard let through, with `limit` / `perPage` / `page` /
+ * `offset` replaced by the whole numbers the guard settled on — a driver that
+ * splices them into its SQL text splices digits — and its answer passes back
+ * through the guard, which strips credentials and replaces any error text.
+ */
+/** How a request may name a field for a driver. */
+export type RequestFieldRule = 'identifier' | 'label' | 'any';
+/** SQL drivers splice the field into their statement; document stores read it as a path or an operator. */
+export declare const requestFieldRuleOf: (dataSourceType: string) => RequestFieldRule;
+/**
+ * What a request may name for a driver (see `RequestFieldPolicy`): the
+ * export's schema of the table — required for a SQL driver, so a table without
+ * one answers every named field 400 — and the driver's own shape rule.
+ */
+export declare const driverFieldPolicy: (dataSourceType: string, schemaColumns: string[] | null) => RequestFieldPolicy;
+/**
+ * The columns a browser's search runs over when it names none (N3): the
+ * table's schema — for Supabase, whose PostgREST `ilike` refuses any other
+ * type, its text columns — else, for a source without one, the fields the
+ * project's own bindings read. Never a credential column: what a search
+ * matches, it lets the searcher test character by character.
+ */
+export declare const defaultSearchColumns: (dataSourceType: string, schema: SchemaColumn[] | null, bindingFields: string[]) => string[];
+/**
+ * The driver's fetcher module with the guard around its handler: same
+ * imports, the preamble, the driver renamed, and a guarded `handler` exported
+ * in its place.
+ */
+export declare const guardExternalDriverModule: (driverCode: string, params: {
+    tableName: string;
+    dataSourceType: string;
+    exposure: DataReadExposure;
+    trustedReaderRoles: ReadonlyArray<string>;
+    /** The table's columns as the data source config lists them (null: no schema). */
+    schema?: SchemaColumn[] | null;
+    /** Where the route sits and whether its session reader checks revocation. */
+    reader?: SessionReaderPlacement;
+}) => string;
+/** The driver's count handler behind the same guard (the guard code comes with the handler module). */
+export declare const guardExternalDriverCount: (countCode: string) => string;
+//# sourceMappingURL=external-read-guard.d.ts.map

package/dist/esm/fetchers/utils/external-read-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-read-guard.d.ts","sourceRoot":"","sources":["../../../../src/fetchers/utils/external-read-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAElE,OAAO,EAEL,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACvB,MAAM,sBAAsB,CAAA;AAE7B;;;;;;;;;;;;;;GAcG;AAEH,mDAAmD;AACnD,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,OAAO,GAAG,KAAK,CAAA;AAgB7D,2GAA2G;AAC3G,eAAO,MAAM,kBAAkB,mBAAoB,MAAM,KAAG,gBAkB3D,CAAA;AAKD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,mBACZ,MAAM,iBACP,MAAM,EAAE,GAAG,IAAI,KAC7B,kBAQF,CAAA;AAaD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,mBACf,MAAM,UACd,YAAY,EAAE,GAAG,IAAI,iBACd,MAAM,EAAE,KACtB,MAAM,EAQR,CAAA;AA+GD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eACxB,MAAM;eAEL,MAAM;oBACD,MAAM;cACZ,gBAAgB;wBACN,cAAc,MAAM,CAAC;IACzC,kFAAkF;aACzE,YAAY,EAAE,GAAG,IAAI;IAC9B,6EAA6E;aACpE,sBAAsB;MAEhC,MAiCF,CAAA;AAED,uGAAuG;AACvG,eAAO,MAAM,wBAAwB,cAAe,MAAM,KAAG,MAU5D,CAAA"}

package/dist/esm/fetchers/utils/external-read-guard.js

@@ -0,0 +1,118 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+import { DataExposure, TableAccess } from '@teleporthq/teleport-shared';
+import { generateTableAccessPreamble, } from './table-access-guard';
+/**
+ * A SQL column: plain, quoted or table-qualified — what the Postgres routes
+ * accept (`request-sql-guards.ts`).
+ */
+var IDENTIFIER_FIELD_RE = /^"?[A-Za-z_][A-Za-z0-9_]*"?(?:\."?[A-Za-z_][A-Za-z0-9_]*"?)?$/;
+/**
+ * A field of a document store or a base whose names are labels: anything but
+ * the characters its query language gives a meaning (`{}` closes an Airtable
+ * field reference, `$` opens a MongoDB operator, quotes and parentheses open
+ * literals and calls).
+ */
+var LABEL_FIELD_RE = /^[^{}'"`\\(),;$]{1,128}$/;
+/** SQL drivers splice the field into their statement; document stores read it as a path or an operator. */
+export var requestFieldRuleOf = function (dataSourceType) {
+    switch (dataSourceType) {
+        case 'mysql':
+        case 'tidb':
+        case 'mariadb':
+        case 'amazon-redshift':
+        case 'clickhouse':
+        case 'turso':
+        case 'supabase':
+            return 'identifier';
+        case 'mongodb':
+        case 'firestore':
+        case 'airtable':
+            return 'label';
+        default:
+            // REST, JavaScript, CSV, Google Sheets, Redis filter the rows in memory.
+            return 'any';
+    }
+};
+/** The stores that read a `$`-key as an operator or a dotted key as a path. */
+var DOCUMENT_STORES = new Set(['mongodb', 'firestore', 'redis']);
+/**
+ * What a request may name for a driver (see `RequestFieldPolicy`): the
+ * export's schema of the table — required for a SQL driver, so a table without
+ * one answers every named field 400 — and the driver's own shape rule.
+ */
+export var driverFieldPolicy = function (dataSourceType, schemaColumns) {
+    var rule = requestFieldRuleOf(dataSourceType);
+    return __assign(__assign({ columns: rule === 'identifier' ? schemaColumns || [] : schemaColumns, documentStore: DOCUMENT_STORES.has(dataSourceType) }, (rule === 'identifier' && { pattern: IDENTIFIER_FIELD_RE })), (rule === 'label' && { pattern: LABEL_FIELD_RE }));
+};
+/**
+ * The stores whose search turns the text into a pattern of their own query
+ * language (MongoDB's `$regex`): the text is escaped first, so it is matched
+ * as text — never an anchored, character-by-character probe, never a pattern
+ * that takes the server's time.
+ */
+var PATTERN_SEARCH_STORES = new Set(['mongodb']);
+/** A text type, as the sources name theirs (`text`, `varchar(255)`, `character varying`, `string`). */
+var TEXT_COLUMN_TYPE = /char|text|string|clob|enum/i;
+/**
+ * The columns a browser's search runs over when it names none (N3): the
+ * table's schema — for Supabase, whose PostgREST `ilike` refuses any other
+ * type, its text columns — else, for a source without one, the fields the
+ * project's own bindings read. Never a credential column: what a search
+ * matches, it lets the searcher test character by character.
+ */
+export var defaultSearchColumns = function (dataSourceType, schema, bindingFields) {
+    var textOnly = dataSourceType === 'supabase';
+    var candidates = schema
+        ? schema
+            .filter(function (column) { return !textOnly || !column.type || TEXT_COLUMN_TYPE.test(column.type); })
+            .map(function (column) { return column.name; })
+        : bindingFields;
+    return Array.from(new Set(candidates)).filter(function (name) { return !TableAccess.isCredentialColumnName(name); });
+};
+/** The guard's own code, after the shared preamble. */
+var generateDriverGuardCode = function (tableName, dataSourceType, searchColumns) { return "\n// GENERATED \u2014 see external-read-guard.ts in teleport-plugin-next-data-source.\nvar __TQ_DRIVER_TABLE = ".concat(JSON.stringify(tableName), ";\nvar __TQ_DRIVER_WINDOW_KEYS = ['limit', 'perPage', 'page', 'offset'];\nvar __TQ_DRIVER_TIMEOUT_MS = ").concat(DataExposure.READ_QUERY_TIMEOUT_MS, ";\n// What a browser's search runs over when it names no columns (the driver's own\n// fallback reads every column, credentials included).\nvar __TQ_DRIVER_SEARCH_COLUMNS = ").concat(JSON.stringify(searchColumns), ";\nvar __TQ_DRIVER_PATTERN_SEARCH = ").concat(PATTERN_SEARCH_STORES.has(dataSourceType) ? 'true' : 'false', ";\n\nasync function __taGuardedDriverRead(req, res, run, kind) {\n  var failure = kind === 'count' ? 'Failed to get count' : 'Failed to fetch data';\n  var exposure = await __taGuardExposure(req);\n  if (exposure) {\n    return res.status(exposure.status).json({ success: false, error: exposure.message, timestamp: Date.now() });\n  }\n  var access = await __taGuardRead(req, __TQ_DRIVER_TABLE, null);\n  if (access) {\n    return res.status(access.status).json({ success: false, error: access.message, timestamp: Date.now() });\n  }\n  var window;\n  try {\n    window = __taReadWindow(req);\n    __taAssertReadRequest(req);\n  } catch (error) {\n    return res.status(400).json({ success: false, error: error && error.status ? error.message : 'Invalid request', timestamp: Date.now() });\n  }\n  var internal = __taIsInternalRequest(req);\n  var query = Object.assign({}, (req && req.query) || {});\n  __TQ_DRIVER_WINDOW_KEYS.forEach(function(key) {\n    if (window[key] === undefined) delete query[key];\n    else query[key] = String(window[key]);\n  });\n  var searching = query.query !== undefined && query.query !== null && String(query.query) !== '';\n  if (searching && !internal && (query.queryColumns === undefined || query.queryColumns === null || query.queryColumns === '')) {\n    if (__TQ_DRIVER_SEARCH_COLUMNS.length === 0) {\n      return res.status(400).json({ success: false, error: 'Invalid search', timestamp: Date.now() });\n    }\n    query.queryColumns = JSON.stringify(__TQ_DRIVER_SEARCH_COLUMNS);\n  }\n  if (searching && __TQ_DRIVER_PATTERN_SEARCH) {\n    query.query = String(Array.isArray(query.query) ? query.query[0] : query.query).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n  }\n  var forwarded = {\n    method: req && req.method,\n    headers: (req && req.headers) || {},\n    cookies: req && req.cookies,\n    // A browser's body never reaches the driver: a REST source configured for\n    // POST would send it upstream, under the site's credentials, in place of\n    // the configured one. The app's own server code may still supply one.\n    body: internal ? req && req.body : undefined,\n    query: query,\n    __tqServerCall: !!(req && req.__tqServerCall === true),\n    __tqOwnerScope: req && req.__tqOwnerScope,\n  };\n  // A row-owned page's read: the owner condition joins the request's filters.\n  __taApplyOwnerScope(forwarded);\n  var status = 200;\n  var payload = null;\n  var proxy = {\n    status: function(code) { status = code; return proxy; },\n    json: function(data) { payload = data; return proxy; },\n    setHeader: function(name, value) {\n      if (res && typeof res.setHeader === 'function') res.setHeader(name, value);\n      return proxy;\n    },\n  };\n  // No read waits on the source longer than __TQ_DRIVER_TIMEOUT_MS: a driver\n  // without a query timeout of its own is answered for when it overruns.\n  var timer = null;\n  try {\n    await Promise.race([\n      run(forwarded, proxy),\n      new Promise(function(_resolve, reject) {\n        timer = setTimeout(function() { reject(new Error('the read timed out')); }, __TQ_DRIVER_TIMEOUT_MS);\n      }),\n    ]);\n  } catch (error) {\n    status = 500;\n    payload = { success: false, error: error };\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n  if (status !== 200 || !payload || payload.success === false) {\n    // The driver's error names tables, columns and values: server log only.\n    var id = __taErrorId();\n    console.error('[data-source] reading ' + __TQ_DRIVER_TABLE + ' failed (' + id + '):', payload && payload.error);\n    return res.status(status >= 400 && status < 500 ? status : 500).json({ success: false, error: failure, id: id, timestamp: Date.now() });\n  }\n  if (Array.isArray(payload.data)) {\n    payload = Object.assign({}, payload, { data: __taWithoutCredentials(payload.data, __TQ_DRIVER_TABLE) });\n  }\n  return res.status(200).json(payload);\n}\n"); };
+var UNGUARDED_HANDLER = '__tqUnguardedHandler';
+var UNGUARDED_COUNT = '__tqUnguardedGetCount';
+var DRIVER_HANDLER_DECLARATION = 'export default async function handler(';
+var COUNT_DECLARATION = 'async function getCount(req, res)';
+/** The driver module's single-line imports, which must stay at the top of an ES module. */
+var IMPORT_LINE = /^import\s.*$/gm;
+/**
+ * The driver's fetcher module with the guard around its handler: same
+ * imports, the preamble, the driver renamed, and a guarded `handler` exported
+ * in its place.
+ */
+export var guardExternalDriverModule = function (driverCode, params) {
+    var _a;
+    var schema = (_a = params.schema) !== null && _a !== void 0 ? _a : null;
+    var schemaColumns = schema ? schema.map(function (column) { return column.name; }) : null;
+    if (driverCode.split(DRIVER_HANDLER_DECLARATION).length !== 2) {
+        // A driver that is not one handler cannot be wrapped; refusing to generate
+        // it is the only answer that does not serve it unguarded.
+        throw new Error('a data source read route must declare exactly one handler');
+    }
+    var imports = driverCode.match(IMPORT_LINE) || [];
+    var body = driverCode
+        .replace(IMPORT_LINE, '')
+        .trim()
+        .replace(DRIVER_HANDLER_DECLARATION, "async function ".concat(UNGUARDED_HANDLER, "("));
+    return "".concat(imports.join('\n'), "\n\n").concat(generateTableAccessPreamble(params.trustedReaderRoles, params.exposure, driverFieldPolicy(params.dataSourceType, schemaColumns), params.tableName, params.reader)).concat(generateDriverGuardCode(params.tableName, params.dataSourceType, defaultSearchColumns(params.dataSourceType, schema, params.exposure.fields || [])), "\n").concat(body, "\n\nexport default async function handler(req, res) {\n  return __taGuardedDriverRead(req, res, ").concat(UNGUARDED_HANDLER, ", 'data')\n}\n");
+};
+/** The driver's count handler behind the same guard (the guard code comes with the handler module). */
+export var guardExternalDriverCount = function (countCode) {
+    if (countCode.split(COUNT_DECLARATION).length !== 2) {
+        throw new Error('a data source count route must declare exactly one getCount');
+    }
+    return "".concat(countCode.replace(COUNT_DECLARATION, "async function ".concat(UNGUARDED_COUNT, "(req, res)")), "\n\nasync function getCount(req, res) {\n  return __taGuardedDriverRead(req, res, ").concat(UNGUARDED_COUNT, ", 'count')\n}\n");
+};
+//# sourceMappingURL=external-read-guard.js.map

package/dist/esm/fetchers/utils/external-read-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-read-guard.js","sourceRoot":"","sources":["../../../../src/fetchers/utils/external-read-guard.ts"],"names":[],"mappings":";;;;;;;;;;;AACA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EACL,2BAA2B,GAI5B,MAAM,sBAAsB,CAAA;AAqB7B;;;GAGG;AACH,IAAM,mBAAmB,GAAG,+DAA+D,CAAA;AAE3F;;;;;GAKG;AACH,IAAM,cAAc,GAAG,0BAA0B,CAAA;AAEjD,2GAA2G;AAC3G,MAAM,CAAC,IAAM,kBAAkB,GAAG,UAAC,cAAsB;IACvD,QAAQ,cAAc,EAAE;QACtB,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,iBAAiB,CAAC;QACvB,KAAK,YAAY,CAAC;QAClB,KAAK,OAAO,CAAC;QACb,KAAK,UAAU;YACb,OAAO,YAAY,CAAA;QACrB,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,OAAO,CAAA;QAChB;YACE,yEAAyE;YACzE,OAAO,KAAK,CAAA;KACf;AACH,CAAC,CAAA;AAED,+EAA+E;AAC/E,IAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAElE;;;;GAIG;AACH,MAAM,CAAC,IAAM,iBAAiB,GAAG,UAC/B,cAAsB,EACtB,aAA8B;IAE9B,IAAM,IAAI,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAC/C,2BACE,OAAO,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa,EACpE,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,IAC/C,CAAC,IAAI,KAAK,YAAY,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,GAC3D,CAAC,IAAI,KAAK,OAAO,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EACrD;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,IAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AAElD,uGAAuG;AACvG,IAAM,gBAAgB,GAAG,6BAA6B,CAAA;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,IAAM,oBAAoB,GAAG,UAClC,cAAsB,EACtB,MAA6B,EAC7B,aAAuB;IAEvB,IAAM,QAAQ,GAAG,cAAc,KAAK,UAAU,CAAA;IAC9C,IAAM,UAAU,GAAG,MAAM;QACvB,CAAC,CAAC,MAAM;aACH,MAAM,CAAC,UAAC,MAAM,IAAK,OAAA,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAA/D,CAA+D,CAAC;aACnF,GAAG,CAAC,UAAC,MAAM,IAAK,OAAA,MAAM,CAAC,IAAI,EAAX,CAAW,CAAC;QACjC,CAAC,CAAC,aAAa,CAAA;IACjB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,CAAC,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAzC,CAAyC,CAAC,CAAA;AACpG,CAAC,CAAA;AAED,uDAAuD;AACvD,IAAM,uBAAuB,GAAG,UAC9B,SAAiB,EACjB,cAAsB,EACtB,aAAuB,IACZ,OAAA,yHAEa,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,oHAEpB,YAAY,CAAC,qBAAqB,0LAG9B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,iDAC7B,qBAAqB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,m1HAsF9F,EA9FY,CA8FZ,CAAA;AAED,IAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAChD,IAAM,eAAe,GAAG,uBAAuB,CAAA;AAC/C,IAAM,0BAA0B,GAAG,wCAAwC,CAAA;AAC3E,IAAM,iBAAiB,GAAG,mCAAmC,CAAA;AAE7D,2FAA2F;AAC3F,IAAM,WAAW,GAAG,gBAAgB,CAAA;AAEpC;;;;GAIG;AACH,MAAM,CAAC,IAAM,yBAAyB,GAAG,UACvC,UAAkB,EAClB,MASC;;IAED,IAAM,MAAM,GAAG,MAAA,MAAM,CAAC,MAAM,mCAAI,IAAI,CAAA;IACpC,IAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,UAAC,MAAM,IAAK,OAAA,MAAM,CAAC,IAAI,EAAX,CAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,IAAI,UAAU,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;QAC7D,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;KAC7E;IACD,IAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IACnD,IAAM,IAAI,GAAG,UAAU;SACpB,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,IAAI,EAAE;SACN,OAAO,CAAC,0BAA0B,EAAE,yBAAkB,iBAAiB,MAAG,CAAC,CAAA;IAE9E,OAAO,UAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAE5B,2BAA2B,CAC3B,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,QAAQ,EACf,iBAAiB,CAAC,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,EACvD,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,MAAM,CACd,SAAG,uBAAuB,CACvB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,oBAAoB,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAClF,eACD,IAAI,6GAGqC,iBAAiB,mBAE3D,CAAA;AACD,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,IAAM,wBAAwB,GAAG,UAAC,SAAiB;IACxD,IAAI,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;QACnD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;KAC/E;IACD,OAAO,UAAG,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,yBAAkB,eAAe,eAAY,CAAC,+FAGpD,eAAe,oBAEzD,CAAA;AACD,CAAC,CAAA"}

package/dist/esm/fetchers/utils/table-access-guard.d.ts

@@ -1,19 +1,83 @@
+import type { DataReadExposure } from '@teleporthq/teleport-types';
 /**
- * The money-table guard for a generated per-table read route
+ * The guard of a generated per-table read route
  * (`/api/teleport-<table>-<source>` and its `-count` twin).
  *
- * Every table a page binds gets such a route, and the route serves the whole
- * table — plus any single SELECT through `?rawQuery=` — to whoever asks. For a
- * catalogue that is the product; for gift cards and voucher codes it is theft.
- * The guard refuses a protected table (see `TableAccess.PROTECTED_TABLES`)
- * unless the caller is a server segment presenting the app secret or a
- * signed-in member of a trusted role — the generated admin, whose list pages
- * are the one browser reader these tables have. It is followed by the
- * browser row policy (see `browser-row-policy.ts`): unpublished rows and
- * private columns of the public tables, and the admin-only tables.
+ * Every table a page binds gets such a route, and the route is a URL anyone
+ * can call. Three nets, in this order:
+ *  1. the table's EXPOSURE, decided at export time from the pages that bind it
+ *     (`DataExposure.resolveDataExposure`): a table a public page shows is read
+ *     by anyone; one only protected pages bind needs a session one of them
+ *     admits; one no page binds is the app's own server code's;
+ *  2. the protected tables (see `TableAccess.PROTECTED_TABLES`): money and
+ *     customer records, read only by a server segment presenting the app
+ *     secret or a signed-in member of a trusted role (the generated admin);
+ *  3. the browser row policy (see `browser-row-policy.ts`): unpublished rows
+ *     and private columns of the public tables.
+ * A server-side caller (the app secret, or the module's own in-process
+ * `fetchData`) passes all three.
+ *
+ * Every row count a request names is a whole number, and a browser's read is
+ * capped (`__taReadWindow`): a missing count gets the table's default, a large
+ * one the table's maximum.
+ */
+/** No route reads more than this many rows past the first, from a browser. */
+export declare const BROWSER_READ_MAX_OFFSET = 1000000;
+/**
+ * What a request may name as a field of the route's table (C1):
+ *  - `columns`: the columns the export knows the table has (its schema in the
+ *    data source config, plus every field the project's own bindings of the
+ *    table name), or null for a source that has none to know (REST,
+ *    JavaScript, CSV, Google Sheets, Redis: they filter in memory);
+ *  - `virtualFields` / `virtualPrefixes`: the names the route itself answers
+ *    with an expression (the products' effective price, rating, variant axes);
+ *  - `documentStore`: a store that reads a `$`-key as an operator or a dotted
+ *    key as a path (MongoDB, Firestore, Redis).
+ * A table with a schema but no known column answers every named field 400.
+ */
+export interface RequestFieldPolicy {
+    columns: string[] | null;
+    virtualFields?: string[];
+    virtualPrefixes?: string[];
+    documentStore?: boolean;
+    /** The shape every named field must also have (a driver's identifier or label rule). */
+    pattern?: RegExp;
+}
+/** A column of `config.selectedTables[tableName]`: its name, and its type when the config gives one. */
+export interface SchemaColumn {
+    name: string;
+    type?: string;
+}
+/** The columns `config.selectedTables[tableName]` lists, with their types, or null when the config holds no schema for it. */
+export declare const schemaOf: (config: unknown, tableName: string) => SchemaColumn[] | null;
+/** The columns `config.selectedTables[tableName]` lists, or null when the config holds no schema for it. */
+export declare const schemaColumnsOf: (config: unknown, tableName: string) => string[] | null;
+/**
+ * The exposure check, the row window and the request-field check, for a
+ * module whose table is `exposure`'s. Uses `__taIsInternalRequest`,
+ * `__taRoleOf` and `__tqSessionToken` from the preamble.
+ */
+export declare const generateRouteExposureCode: (exposure: DataReadExposure | null | undefined, fieldPolicy?: RequestFieldPolicy, tableName?: string) => string;
+/**
+ * Where a read route sits and what its session reader checks (see
+ * `EntityTransformOptions.routeProjectRoot` / `.sessionRevocation`).
+ */
+export interface SessionReaderPlacement {
+    /** The route's path back to the project root; absent, two folders. */
+    routeProjectRoot?: string;
+    /** The project has authentication; absent, the reader checks revocation. */
+    sessionRevocation?: boolean;
+}
+/**
+ * Declares the session resolver, the `__ta*` guard and the route's exposure
+ * once per module.
  */
-/** Declares the session resolver and the `__ta*` guard once per module. */
-export declare const generateTableAccessPreamble: (trustedReaderRoles: ReadonlyArray<string>) => string;
+export declare const generateTableAccessPreamble: (trustedReaderRoles: ReadonlyArray<string>, exposure?: DataReadExposure | null, fieldPolicy?: RequestFieldPolicy, tableName?: string, reader?: SessionReaderPlacement) => string;
+/** The products table's virtual filter and sort fields (`product-filter-fields.ts`, `product-price-sort.ts`). */
+export declare const PRODUCT_VIRTUAL_FIELDS: string[];
+export declare const PRODUCT_VIRTUAL_PREFIXES: string[];
+/** What a TeleportHQ / Postgres route's request may name: its schema, plus the products' virtual fields. */
+export declare const sqlRouteFieldPolicy: (config: unknown, tableName: string) => RequestFieldPolicy;
 /**
  * The early return at the top of a handler, before the client connects:
  * `tableName` is the module's table, `rawQueryExpr` the request's raw statement

package/dist/esm/fetchers/utils/table-access-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table-access-guard.d.ts","sourceRoot":"","sources":["../../../../src/fetchers/utils/table-access-guard.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,uBAAwB,cAAc,MAAM,CAAC,KAAG,MAIvF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,cAAe,MAAM,gBAAgB,MAAM,GAAG,IAAI,KAAG,MAQtF,CAAA"}
+{"version":3,"file":"table-access-guard.d.ts","sourceRoot":"","sources":["../../../../src/fetchers/utils/table-access-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAIlE;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,UAAU,CAAA;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,8HAA8H;AAC9H,eAAO,MAAM,QAAQ,WAAY,OAAO,aAAa,MAAM,KAAG,YAAY,EAAE,GAAG,IAwB9E,CAAA;AAED,4GAA4G;AAC5G,eAAO,MAAM,eAAe,WAAY,OAAO,aAAa,MAAM,KAAG,MAAM,EAAE,GAAG,IAG/E,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,aAC1B,gBAAgB,GAAG,IAAI,GAAG,SAAS,gBAChC,kBAAkB,cACpB,MAAM,KAChB,MAuTF,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,uBAClB,cAAc,MAAM,CAAC,aAC9B,gBAAgB,GAAG,IAAI,gBACpB,kBAAkB,cACpB,MAAM,WACV,sBAAsB,KAC7B,MAUF,CAAA;AAED,iHAAiH;AACjH,eAAO,MAAM,sBAAsB,UAA8C,CAAA;AACjF,eAAO,MAAM,wBAAwB,UAAuB,CAAA;AAE5D,4GAA4G;AAC5G,eAAO,MAAM,mBAAmB,WAAY,OAAO,aAAa,MAAM,KAAG,kBASxE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,cAAe,MAAM,gBAAgB,MAAM,GAAG,IAAI,KAAG,MAqBtF,CAAA"}