@teleporthq/teleport-plugin-next-data-source 0.44.15 → 0.45.0

package/dist/esm/count-fetchers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"count-fetchers.d.ts","sourceRoot":"","sources":["../../src/count-fetchers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAE3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,4BAA4B,GAC7B,CAAA;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAqF1F"}
+{"version":3,"file":"count-fetchers.d.ts","sourceRoot":"","sources":["../../src/count-fetchers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAE3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,4BAA4B,GAC7B,CAAA;AAED,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA6F1F"}

package/dist/esm/count-fetchers.js

@@ -33,7 +33,7 @@ export function generateCountFetcher(dataSource, tableName) {
         case 'csv-file':
             return generateCSVCountFetcher(config);
         default:
-            return "\nasync function getCount(req, res) {\n  try {\n    // `collectionPath` has to travel with the rest: this counts by re-running\n    // the fetch handler and measuring its result, and without the path that\n    // handler gets the wrapper object rather than the records, which is not an\n    // array \u2014 so the count below would report 0 for a list that clearly has rows.\n    const { query, queryColumns, filters, collectionPath } = req.query\n    const fakeReq = { query: { query, queryColumns, filters, collectionPath }, method: 'GET' }\n    let result = null\n    let statusCode = 200\n    \n    const fakeRes = {\n      status: (code) => {\n        statusCode = code\n        return fakeRes\n      },\n      json: (data) => {\n        result = data\n        return fakeRes\n      },\n    }\n    \n    await handler(fakeReq, fakeRes)\n    \n    if (statusCode !== 200 || !result || !result.success) {\n      return res.status(500).json({\n        success: false,\n        error: 'Failed to get data for counting',\n        timestamp: Date.now()\n      })\n    }\n    \n    const count = Array.isArray(result.data) ? result.data.length : 0\n    \n    return res.status(200).json({\n      success: true,\n      count: count,\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('Error getting count:', error)\n    return res.status(500).json({\n      success: false,\n      error: error.message || 'Failed to get count',\n      timestamp: Date.now()\n    })\n  }\n}\n";
+            return "\nasync function getCount(req, res) {\n  try {\n    // `collectionPath` has to travel with the rest: this counts by re-running\n    // the fetch handler and measuring its result, and without the path that\n    // handler gets the wrapper object rather than the records, which is not an\n    // array \u2014 so the count below would report 0 for a list that clearly has rows.\n    const { query, queryColumns, filters, collectionPath } = req.query\n    // The count route already let this request through (see\n    // external-read-guard.ts); counting re-reads every matching row as the\n    // route's own server-side call, never capped to a browser's window.\n    const fakeReq = {\n      query: { query, queryColumns, filters, collectionPath },\n      method: 'GET',\n      headers: req.headers || {},\n      __tqServerCall: true,\n    }\n    let result = null\n    let statusCode = 200\n    \n    const fakeRes = {\n      status: (code) => {\n        statusCode = code\n        return fakeRes\n      },\n      json: (data) => {\n        result = data\n        return fakeRes\n      },\n    }\n    \n    await handler(fakeReq, fakeRes)\n    \n    if (statusCode !== 200 || !result || !result.success) {\n      return res.status(500).json({\n        success: false,\n        error: 'Failed to get data for counting',\n        timestamp: Date.now()\n      })\n    }\n    \n    const count = Array.isArray(result.data) ? result.data.length : 0\n    \n    return res.status(200).json({\n      success: true,\n      count: count,\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('Error getting count:', error)\n    return res.status(500).json({\n      success: false,\n      error: 'Failed to get count',\n      timestamp: Date.now()\n    })\n  }\n}\n";
     }
 }
 //# sourceMappingURL=count-fetchers.js.map

package/dist/esm/count-fetchers.js.map

@@ -1 +1 @@
-{"version":3,"file":"count-fetchers.js","sourceRoot":"","sources":["../../src/count-fetchers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAA;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,4BAA4B,GAC7B,CAAA;AAED,MAAM,UAAU,oBAAoB,CAAC,UAA0B,EAAE,SAAiB;IACxE,IAAA,IAAI,GAAa,UAAU,KAAvB,EAAE,MAAM,GAAK,UAAU,OAAf,CAAe;IAEnC,QAAQ,IAAI,EAAE;QACZ,KAAK,UAAU;YACb,OAAO,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAExD,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,8BAA8B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAE1D,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAO,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAErD,KAAK,SAAS;YACZ,OAAO,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAEvD,KAAK,SAAS;YACZ,OAAO,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAEvD,KAAK,UAAU;YACb,IAAI,kCAAkC,CAAC,MAAM,CAAC,EAAE;gBAC9C,OAAO,8BAA8B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACzD;YACD,OAAO,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAExD,KAAK,YAAY;YACf,OAAO,8BAA8B,CAAC,MAAM,CAAC,CAAA;QAE/C,KAAK,UAAU;YACb,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAA;QAExC;YACE,OAAO,09CAiDZ,CAAA;KACE;AACH,CAAC"}
+{"version":3,"file":"count-fetchers.js","sourceRoot":"","sources":["../../src/count-fetchers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAA;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAA;AAElE,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,8BAA8B,EAC9B,uBAAuB,EACvB,4BAA4B,GAC7B,CAAA;AAED,MAAM,UAAU,oBAAoB,CAAC,UAA0B,EAAE,SAAiB;IACxE,IAAA,IAAI,GAAa,UAAU,KAAvB,EAAE,MAAM,GAAK,UAAU,OAAf,CAAe;IAEnC,QAAQ,IAAI,EAAE;QACZ,KAAK,UAAU;YACb,OAAO,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAExD,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,8BAA8B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAE1D,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAO,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAErD,KAAK,SAAS;YACZ,OAAO,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAEvD,KAAK,SAAS;YACZ,OAAO,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAEvD,KAAK,UAAU;YACb,IAAI,kCAAkC,CAAC,MAAM,CAAC,EAAE;gBAC9C,OAAO,8BAA8B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACzD;YACD,OAAO,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAExD,KAAK,YAAY;YACf,OAAO,8BAA8B,CAAC,MAAM,CAAC,CAAA;QAE/C,KAAK,UAAU;YACb,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAA;QAExC;YACE,OAAO,kvDAyDZ,CAAA;KACE;AACH,CAAC"}

package/dist/esm/data-source-fetchers.d.ts

@@ -9,6 +9,10 @@ interface DataSourceFetcherDependencies {
 }
 export declare const isSupabaseConnectionStringFallback: (config: Record<string, unknown>) => boolean;
 export declare const getDataSourceDependencies: (type: DataSourceType, config?: Record<string, unknown>) => DataSourceFetcherDependencies;
+/**
+ * The read route of `tableName` over `dataSource`: its driver's fetcher, behind
+ * the read guard (see `fetchers/utils/table-access-guard.ts`).
+ */
 export declare function generateDataSourceFetcher(dataSource: UIDLDataSource, tableName: string, transformOptions?: EntityTransformOptions): string;
 /**
  * Generates a fetcher with both a core fetchData function (for server-side use in getStaticProps)

package/dist/esm/data-source-fetchers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-source-fetchers.d.ts","sourceRoot":"","sources":["../../src/data-source-fetchers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3E,OAAO,EA6BL,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAA;AAajE,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,CAAA;AAE/D,UAAU,6BAA6B;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,eAAO,MAAM,kCAAkC,WAAY,OAAO,MAAM,EAAE,OAAO,CAAC,KAAG,OAEpF,CAAA;AAED,eAAO,MAAM,yBAAyB,SAC9B,cAAc,WACX,OAAO,MAAM,EAAE,OAAO,CAAC,KAC/B,6BA4BF,CAAA;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,EACjB,gBAAgB,GAAE,sBAA2B,GAC5C,MAAM,CAsKR;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,OAAe,EAC3B,gBAAgB,GAAE,sBAA2B,EAC7C,YAAY,CAAC,EAAE,4BAA4B,GAC1C,MAAM,CAiMR"}
+{"version":3,"file":"data-source-fetchers.d.ts","sourceRoot":"","sources":["../../src/data-source-fetchers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3E,OAAO,EA6BL,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE/D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAA;AAkBjE,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,CAAA;AAE/D,UAAU,6BAA6B;IACrC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,eAAO,MAAM,kCAAkC,WAAY,OAAO,MAAM,EAAE,OAAO,CAAC,KAAG,OAEpF,CAAA;AAED,eAAO,MAAM,yBAAyB,SAC9B,cAAc,WACX,OAAO,MAAM,EAAE,OAAO,CAAC,KAC/B,6BA4BF,CAAA;AAaD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,EACjB,gBAAgB,GAAE,sBAA2B,GAC5C,MAAM,CAiBR;AAyMD;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,cAAc,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,OAAe,EAC3B,gBAAgB,GAAE,sBAA2B,EAC7C,YAAY,CAAC,EAAE,4BAA4B,GAC1C,MAAM,CAoPR"}

package/dist/esm/data-source-fetchers.js

@@ -1,3 +1,14 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
     if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
         if (ar || !(i in from)) {
@@ -10,8 +21,10 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
 import { generatePostgreSQLFetcher, generateMySQLFetcher, generateMariaDBFetcher, generateRedshiftFetcher, generateMongoDBFetcher, validateMongoDBConfig, generateRedisFetcher, validateRedisConfig, generateFirestoreFetcher, validateFirestoreConfig, generateClickHouseFetcher, validateClickHouseConfig, generateAirtableFetcher, validateAirtableConfig, generateSupabaseFetcher, validateSupabaseConfig, generateTursoFetcher, validateTursoConfig, generateRESTAPIFetcher, validateRESTAPIConfig, generateJavaScriptFetcher, validateJavaScriptConfig, generateCSVFileFetcher, validateCSVConfig, generateGoogleSheetsFetcher, validateGoogleSheetsConfig, generateTeleportFetcher, validateTeleportConfig, generateRawQueryFetcher, parseQueryTemplateVariables, } from './fetchers';
 import { validateDatabaseConfig } from './validation';
 import { generateCountFetcher } from './count-fetchers';
-import { DataCache, TableAccess } from '@teleporthq/teleport-shared';
+import { DataCache, DataExposure, TableAccess } from '@teleporthq/teleport-shared';
 import { isViewDependentTable } from './fetchers/utils/browser-row-policy';
+import { guardExternalDriverCount, guardExternalDriverModule, } from './fetchers/utils/external-read-guard';
+import { schemaOf } from './fetchers/utils/table-access-guard';
 /** `public."users"` → `users`: the table a spelling names. */
 var bareTableName = function (tableName) {
     return (String(tableName || '')
@@ -51,7 +64,47 @@ export var getDataSourceDependencies = function (type, config) {
     };
     return dependencyMap[type];
 };
+/**
+ * Whether the driver's read route carries the table-access guard inline (the
+ * TeleportHQ and Postgres-family fetchers); every other driver is wrapped by
+ * `guardExternalDriverModule`.
+ */
+var hasInlineReadGuard = function (dataSource) {
+    return dataSource.type === 'teleport' ||
+        dataSource.type === 'postgresql' ||
+        dataSource.type === 'cockroachdb' ||
+        (dataSource.type === 'supabase' && isSupabaseConnectionStringFallback(dataSource.config));
+};
+/**
+ * The read route of `tableName` over `dataSource`: its driver's fetcher, behind
+ * the read guard (see `fetchers/utils/table-access-guard.ts`).
+ */
 export function generateDataSourceFetcher(dataSource, tableName, transformOptions) {
+    if (transformOptions === void 0) { transformOptions = {}; }
+    var routeExposure = routeExposureOf(dataSource, tableName, transformOptions);
+    var driverCode = generateDriverFetcher(dataSource, tableName, __assign(__assign({}, transformOptions), { routeExposure: routeExposure }));
+    if (hasInlineReadGuard(dataSource)) {
+        return driverCode;
+    }
+    return guardExternalDriverModule(driverCode, {
+        tableName: tableName,
+        dataSourceType: dataSource.type,
+        exposure: routeExposure,
+        trustedReaderRoles: transformOptions.trustedReaderRoles || [],
+        schema: schemaOf(dataSource.config, tableName),
+        reader: transformOptions,
+    });
+}
+/** The exposure of the route of `tableName` over `dataSource` (by source id and table). */
+var routeExposureOf = function (dataSource, tableName, transformOptions) {
+    return transformOptions.routeExposure ||
+        DataExposure.readExposureFor(transformOptions.dataExposure, {
+            tableName: tableName,
+            dataSourceId: dataSource && dataSource.id,
+            dataSourceType: dataSource && dataSource.type,
+        });
+};
+function generateDriverFetcher(dataSource, tableName, transformOptions) {
     if (transformOptions === void 0) { transformOptions = {}; }
     if (!dataSource || typeof dataSource !== 'object') {
         throw new Error('Invalid data source: data source must be a valid object');
@@ -71,7 +124,7 @@ export function generateDataSourceFetcher(dataSource, tableName, transformOption
                 if (!validation.isValid) {
                     throw new Error("PostgreSQL/CockroachDB config validation failed: ".concat(validation.error));
                 }
-                return generatePostgreSQLFetcher(config, tableName, transformOptions.trustedReaderRoles);
+                return generatePostgreSQLFetcher(config, tableName, transformOptions.trustedReaderRoles, transformOptions.dataExposure, transformOptions.routeExposure, transformOptions);
             }
             case 'mysql':
             case 'tidb': {
@@ -137,7 +190,7 @@ export function generateDataSourceFetcher(dataSource, tableName, transformOption
                     if (!pgValidation.isValid) {
                         throw new Error("Supabase (PostgreSQL fallback) config validation failed: ".concat(pgValidation.error));
                     }
-                    return generatePostgreSQLFetcher(config, tableName, transformOptions.trustedReaderRoles);
+                    return generatePostgreSQLFetcher(config, tableName, transformOptions.trustedReaderRoles, transformOptions.dataExposure, transformOptions.routeExposure, transformOptions);
                 }
                 var validation = validateSupabaseConfig(config);
                 if (!validation.isValid) {
@@ -204,6 +257,12 @@ export function generateDataSourceFetcher(dataSource, tableName, transformOption
 export function generateDataSourceFetcherWithCore(dataSource, tableName, isApiRoute, transformOptions, cacheOptions) {
     if (isApiRoute === void 0) { isApiRoute = false; }
     if (transformOptions === void 0) { transformOptions = {}; }
+    // A row-owned page's read answers each session its own rows: nothing about
+    // it may be cached for another (see DataReadExposure.ownerRules).
+    var ownedExposure = routeExposureOf(dataSource, tableName, transformOptions);
+    var routeCacheOptions = ownedExposure.public || ownedExposure.anySession || !(ownedExposure.ownerRules || []).length
+        ? cacheOptions
+        : undefined;
     var apiHandler = generateDataSourceFetcher(dataSource, tableName, transformOptions);
     // Extract the handler function body from the API route
     // The API route is structured as: export default async function handler(req, res) { ... }
@@ -214,8 +273,12 @@ export function generateDataSourceFetcherWithCore(dataSource, tableName, isApiRo
     var importRegex = /^import\s+.*?$/gm;
     var imports = handlerCode.match(importRegex) || [];
     var handlerWithoutImports = handlerCode.replace(importRegex, '').trim();
-    // Generate count fetcher code and extract its imports
-    var countFetcherCode = generateCountFetcher(dataSource, tableName);
+    // Generate count fetcher code and extract its imports. An external driver's
+    // count runs behind the same guard as its rows.
+    var driverCountCode = generateCountFetcher(dataSource, tableName);
+    var countFetcherCode = hasInlineReadGuard(dataSource)
+        ? driverCountCode
+        : guardExternalDriverCount(driverCountCode);
     var countImports = countFetcherCode.match(importRegex) || [];
     var countFetcherWithoutImports = countFetcherCode.replace(importRegex, '').trim();
     // Combine and deduplicate imports
@@ -229,41 +292,55 @@ export function generateDataSourceFetcherWithCore(dataSource, tableName, isApiRo
     // The import depth differs by destination: this module is written to
     // `utils/data-sources/` normally, but the `isApiRoute` variant is inlined
     // straight into `pages/api/`.
-    var cachePreamble = cacheOptions
+    var cachePreamble = routeCacheOptions
         ? "import { tqWithCache } from '".concat(isApiRoute ? '../../' : '../', "tq-cache/server'")
         : '';
     // A module carrying the browser row policy (the Postgres-family routes) keys
     // its cache by who is reading; see `__tqCacheByView` below.
     var splitsCacheByView = handlerCode.indexOf('function __brpSharesPublicView(') !== -1;
-    var cacheWiring = cacheOptions
+    // Only a table every visitor may read can sit in a shared (CDN) cache, and a
+    // table only some sessions may read is checked BEFORE the cache: a cached
+    // answer never reaches a visitor the route itself would refuse.
+    var routeExposure = routeExposureOf(dataSource, tableName, transformOptions);
+    var routeIsPublic = routeExposure.public;
+    var sharedCacheSeconds = function (seconds) {
+        return routeIsPublic ? seconds || 0 : 0;
+    };
+    var cacheWiring = routeCacheOptions
         ? "\nconst __tqDataCache = ".concat(JSON.stringify({
-            scope: cacheOptions.scope,
-            ttl: cacheOptions.ttlSeconds,
-            sMaxAge: cacheOptions.sMaxAge || 0,
-            swr: cacheOptions.staleWhileRevalidate || 0,
+            scope: routeCacheOptions.scope,
+            ttl: routeCacheOptions.ttlSeconds,
+            sMaxAge: sharedCacheSeconds(routeCacheOptions.sMaxAge),
+            swr: sharedCacheSeconds(routeCacheOptions.staleWhileRevalidate),
         }), "\nconst __tqCountCache = ").concat(JSON.stringify({
-            scope: DataCache.countScopeFor(cacheOptions.scope),
+            scope: DataCache.countScopeFor(routeCacheOptions.scope),
             // Its OWN keyspace, but the DATA scope's version row. A write bumps one
             // row; if the count kept a separate version nothing would ever bump it,
             // and the total would stay stale after every create and delete — the
             // grid showing one more row than the pager counts.
-            versionScope: cacheOptions.scope,
-            ttl: cacheOptions.ttlSeconds,
-            sMaxAge: cacheOptions.sMaxAge || 0,
-            swr: cacheOptions.staleWhileRevalidate || 0,
+            versionScope: routeCacheOptions.scope,
+            ttl: routeCacheOptions.ttlSeconds,
+            sMaxAge: sharedCacheSeconds(routeCacheOptions.sMaxAge),
+            swr: sharedCacheSeconds(routeCacheOptions.staleWhileRevalidate),
         }), "\n\n").concat(splitsCacheByView
-            ? "// The store's own server code and its administrators may be served rows a\n// visitor is not (see __brpSharesPublicView), so they read and fill a cache of\n// their own \u2014 one never marked for a shared (CDN) cache either.\nconst __tqViewDependent = ".concat(JSON.stringify(isViewDependentTable(tableName, __spreadArray(__spreadArray([], TableAccess.PROTECTED_TABLES, true), Object.keys(TableAccess.PUBLIC_FEED_TABLES), true))), "\n// The members' public profiles a page reads (see __BRP_PUBLIC_PROFILE) are never\n// a visitor's answer \u2014 a browser is served no row of the table \u2014 so they are\n// read fresh, never kept where a browser's request could be answered from.\nconst __tqProfileTable = ").concat(JSON.stringify(TableAccess.AUTH_CREDENTIAL_TABLES.indexOf(bareTableName(tableName)) !== -1), "\nfunction __tqCacheByView(fn, opts) {\n  const publicView = tqWithCache(fn, opts)\n  const trustedView = tqWithCache(fn, Object.assign({}, opts, {\n    scope: opts.scope + ':trusted',\n    versionScope: opts.versionScope || opts.scope,\n    sMaxAge: 0,\n    swr: 0,\n  }))\n  return async function (req, res) {\n    if (__tqProfileTable && __taIsVisitorView(req)) return fn(req, res)\n    return (await __brpSharesPublicView(req, __tqViewDependent)) ? publicView(req, res) : trustedView(req, res)\n  }\n}\n\nconst cachedHandler = __tqCacheByView(handler, __tqDataCache)\nconst cachedGetCount = __tqCacheByView(getCount, __tqCountCache)")
+            ? "// The store's own server code and its administrators may be served rows a\n// visitor is not (see __brpSharesPublicView), so they read and fill a cache of\n// their own \u2014 one never marked for a shared (CDN) cache either.\nconst __tqViewDependent = ".concat(JSON.stringify(isViewDependentTable(tableName, __spreadArray(__spreadArray([], TableAccess.PROTECTED_TABLES, true), Object.keys(TableAccess.PUBLIC_FEED_TABLES), true))), "\n// The members' public profiles a page reads (see __BRP_PUBLIC_PROFILE) are never\n// a visitor's answer \u2014 a browser is served no row of the table \u2014 so they are\n// read fresh, never kept where a browser's request could be answered from.\nconst __tqProfileTable = ").concat(JSON.stringify(TableAccess.AUTH_CREDENTIAL_TABLES.indexOf(bareTableName(tableName)) !== -1), "\nfunction __tqCacheByView(fn, opts) {\n  const publicView = tqWithCache(fn, opts)\n  const trustedView = tqWithCache(fn, Object.assign({}, opts, {\n    scope: opts.scope + ':trusted',\n    versionScope: opts.versionScope || opts.scope,\n    sMaxAge: 0,\n    swr: 0,\n  }))\n  // The app's own server code reads whole tables; a browser's read is capped\n  // (__taReadWindow). Neither is ever served the other's answer.\n  const serverView = tqWithCache(fn, Object.assign({}, opts, {\n    scope: opts.scope + ':server',\n    versionScope: opts.versionScope || opts.scope,\n    sMaxAge: 0,\n    swr: 0,\n  }))\n  return async function (req, res) {\n    if (__taIsInternalRequest(req)) return serverView(req, res)\n    if (__tqProfileTable && __taIsVisitorView(req)) return fn(req, res)\n    return (await __brpSharesPublicView(req, __tqViewDependent)) ? publicView(req, res) : trustedView(req, res)\n  }\n}\n").concat(routeIsPublic
+                ? ''
+                : "\n// Readable only by some sessions (see __TA_ROUTE_EXPOSURE): the session is\n// checked before any cached answer is handed out.\nfunction __tqExposureFirst(fn) {\n  return async function (req, res) {\n    const __denied = await __taGuardExposure(req)\n    if (__denied) {\n      return res.status(__denied.status).json({ success: false, error: __denied.message, timestamp: Date.now() })\n    }\n    return fn(req, res)\n  }\n}\n", "\nconst cachedHandler = ").concat(routeIsPublic
+                ? '__tqCacheByView(handler, __tqDataCache)'
+                : '__tqExposureFirst(__tqCacheByView(handler, __tqDataCache))', "\nconst cachedGetCount = ").concat(routeIsPublic
+                ? '__tqCacheByView(getCount, __tqCountCache)'
+                : '__tqExposureFirst(__tqCacheByView(getCount, __tqCountCache))')
             : "const cachedHandler = tqWithCache(handler, __tqDataCache)\nconst cachedGetCount = tqWithCache(getCount, __tqCountCache)", "\n")
         : '';
-    var handlerExport = cacheOptions ? 'cachedHandler' : 'handler';
-    var countExport = cacheOptions ? 'cachedGetCount' : 'getCount';
+    var handlerExport = routeCacheOptions ? 'cachedHandler' : 'handler';
+    var countExport = routeCacheOptions ? 'cachedGetCount' : 'getCount';
     // For API routes, export just the handler function
     // For utils files, export the full object with all functions
     //
     // The uncached branch is spelled out verbatim rather than interpolated, so an
     // uncached project keeps generating byte-identical output — `handler as
     // handler` would be harmless at runtime and still a diff in every snapshot.
-    var exports = !cacheOptions
+    var exports = !routeCacheOptions
         ? isApiRoute
             ? 'export default handler'
             : "export { fetchData, fetchCount, handler, getCount }\nexport default { fetchData, fetchCount, handler, getCount }"

package/dist/esm/data-source-fetchers.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-source-fetchers.js","sourceRoot":"","sources":["../../src/data-source-fetchers.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAEpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAE1E,8DAA8D;AAC9D,IAAM,aAAa,GAAG,UAAC,SAAiB;IACtC,OAAA,CACE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SACpB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAE,IAAI,EAAE,CACf,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;AANnB,CAMmB,CAAA;AAErB,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,CAAA;AAO/D,MAAM,CAAC,IAAM,kCAAkC,GAAG,UAAC,MAA+B;IAChF,OAAO,CAAC,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,gBAAgB,CAAA,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW,CAAA,CAAA;AAC3D,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,yBAAyB,GAAG,UACvC,IAAoB,EACpB,MAAgC;IAEhC,yDAAyD;IACzD,IAAI,IAAI,KAAK,UAAU,IAAI,MAAM,IAAI,kCAAkC,CAAC,MAAM,CAAC,EAAE;QAC/E,OAAO,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAA;KACpD;IAED,IAAM,aAAa,GAA0D;QAC3E,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC/D,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACxD,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACvD,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QAC1D,iBAAiB,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QAC/D,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QAC1D,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACzD,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACtD,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACnE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,oBAAoB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACxE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACzE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QAC/D,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;QACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACpE,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;QACpD,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;KACvD,CAAA;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC,CAAA;AAED,MAAM,UAAU,yBAAyB,CACvC,UAA0B,EAC1B,SAAiB,EACjB,gBAA6C;IAA7C,iCAAA,EAAA,qBAA6C;IAE7C,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;QACjD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;KAC3E;IAEO,IAAA,IAAI,GAAa,UAAU,KAAvB,EAAE,MAAM,GAAK,UAAU,OAAf,CAAe;IAEnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;QACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;KAC9E;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC,sDAA+C,IAAI,CAAE,CAAC,CAAA;KACvE;IAED,IAAI;QACF,QAAQ,IAAI,EAAE;YACZ,KAAK,YAAY,CAAC;YAClB,KAAK,aAAa,CAAC,CAAC;gBAClB,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,2DAAoD,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACxF;gBACD,OAAO,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,kBAAkB,CAAC,CAAA;aACzF;YAED,KAAK,OAAO,CAAC;YACb,KAAK,MAAM,CAAC,CAAC;gBACX,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAAwC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC5E;gBACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAC/C;YAED,KAAK,SAAS,CAAC,CAAC;gBACd,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,4CAAqC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACzE;gBACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACjD;YAED,KAAK,iBAAiB,CAAC,CAAC;gBACtB,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,oDAA6C,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACjF;gBACD,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAClD;YAED,KAAK,SAAS,CAAC,CAAC;gBACd,IAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;gBAChD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,4CAAqC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACzE;gBACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACjD;YAED,KAAK,OAAO,CAAC,CAAC;gBACZ,IAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;gBAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,0CAAmC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACvE;gBACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAA;aACpC;YAED,KAAK,WAAW,CAAC,CAAC;gBAChB,IAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;gBAClD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,8CAAuC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC3E;gBACD,OAAO,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACnD;YAED,KAAK,YAAY,CAAC,CAAC;gBACjB,IAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;gBACnD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAAwC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC5E;gBACD,OAAO,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACpD;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAAsC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC1E;gBACD,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAClD;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,uFAAuF;gBACvF,IAAI,kCAAkC,CAAC,MAAM,CAAC,EAAE;oBAC9C,IAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;oBACnD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,mEAA4D,YAAY,CAAC,KAAK,CAAE,CACjF,CAAA;qBACF;oBACD,OAAO,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,kBAAkB,CAAC,CAAA;iBACzF;gBAED,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAAsC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC1E;gBACD,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAClD;YAED,KAAK,OAAO,CAAC,CAAC;gBACZ,IAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;gBAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,0CAAmC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACvE;gBACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAC/C;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,IAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;gBAChD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAAsC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC1E;gBACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAA;aACtC;YAED,KAAK,YAAY,CAAC,CAAC;gBACjB,IAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;gBACnD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAAwC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC5E;gBACD,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAA;aACzC;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,IAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;gBAC5C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,wCAAiC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACrE;gBACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAA;aACtC;YAED,KAAK,eAAe,CAAC,CAAC;gBACpB,IAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;gBACrD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,kDAA2C,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC/E;gBACD,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;aAC3C;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAAsC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC1E;gBACD,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;aACpE;YAED;gBACE,MAAM,IAAI,KAAK,CAAC,wCAAiC,IAAI,CAAE,CAAC,CAAA;SAC3D;KACF;IAAC,OAAO,KAAK,EAAE;QACd,6BAA6B;QAC7B,IAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;QAC7E,MAAM,IAAI,KAAK,CAAC,yCAAkC,IAAI,eAAK,YAAY,CAAE,CAAC,CAAA;KAC3E;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA0B,EAC1B,SAAiB,EACjB,UAA2B,EAC3B,gBAA6C,EAC7C,YAA2C;IAF3C,2BAAA,EAAA,kBAA2B;IAC3B,iCAAA,EAAA,qBAA6C;IAG7C,IAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAErF,uDAAuD;IACvD,0FAA0F;IAC1F,qEAAqE;IAErE,0EAA0E;IAC1E,IAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CACpC,uCAAuC,EACvC,wBAAwB,CACzB,CAAA;IAED,+DAA+D;IAC/D,IAAM,WAAW,GAAG,kBAAkB,CAAA;IACtC,IAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IACpD,IAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAEzE,sDAAsD;IACtD,IAAM,gBAAgB,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IACpE,IAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IAC9D,IAAM,0BAA0B,GAAG,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAEnF,kCAAkC;IAClC,IAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,iCAAK,OAAO,SAAK,YAAY,QAAE,CAAC,CAAA;IAErE,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,2BAA2B;IAC3B,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,8BAA8B;IAC9B,IAAM,aAAa,GAAG,YAAY;QAChC,CAAC,CAAC,uCAAgC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,qBAAkB;QACjF,CAAC,CAAC,EAAE,CAAA;IACN,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAM,iBAAiB,GAAG,WAAW,CAAC,OAAO,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CAAA;IAEvF,IAAM,WAAW,GAAG,YAAY;QAC9B,CAAC,CAAC,kCACkB,IAAI,CAAC,SAAS,CAAC;YAC/B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,GAAG,EAAE,YAAY,CAAC,UAAU;YAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC;YAClC,GAAG,EAAE,YAAY,CAAC,oBAAoB,IAAI,CAAC;SAC5C,CAAC,sCACiB,IAAI,CAAC,SAAS,CAAC;YAChC,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC;YAClD,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,mDAAmD;YACnD,YAAY,EAAE,YAAY,CAAC,KAAK;YAChC,GAAG,EAAE,YAAY,CAAC,UAAU;YAC5B,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC;YAClC,GAAG,EAAE,YAAY,CAAC,oBAAoB,IAAI,CAAC;SAC5C,CAAC,iBAGN,iBAAiB;YACf,CAAC,CAAC,wQAGsB,IAAI,CAAC,SAAS,CAClC,oBAAoB,CAAC,SAAS,kCACzB,WAAW,CAAC,gBAAgB,SAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAC9C,CACH,iSAIoB,IAAI,CAAC,SAAS,CACjC,WAAW,CAAC,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAC5E,ioBAgB0D;YAC7D,CAAC,CAAC,yHACuD,OAE5D;QACG,CAAC,CAAC,EAAE,CAAA;IAEN,IAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;IAChE,IAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAA;IAEhE,mDAAmD;IACnD,6DAA6D;IAC7D,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,4EAA4E;IAC5E,IAAM,OAAO,GAAG,CAAC,YAAY;QAC3B,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,kHACoD;QACxD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,yBAAkB,aAAa,CAAE;YACnC,CAAC,CAAC,0CAAmC,aAAa,0BAAgB,WAAW,8EAC9B,aAAa,yBAAe,WAAW,OAAI,CAAA;IAE5F,OAAO,UAAG,gCAAI,UAAU,UAAE,aAAa,UAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mkCAgC3D,aAAa,6gBA0Bb,WAAW,0LASnB,0BAA0B,iBAE1B,qBAAqB,eACrB,WAAW,eACX,OAAO,OACR,CAAA;AACD,CAAC"}
+{"version":3,"file":"data-source-fetchers.js","sourceRoot":"","sources":["../../src/data-source-fetchers.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AACA,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAElF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAA;AAE9D,8DAA8D;AAC9D,IAAM,aAAa,GAAG,UAAC,SAAiB;IACtC,OAAA,CACE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SACpB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAE,IAAI,EAAE,CACf,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;AANnB,CAMmB,CAAA;AAErB,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,CAAA;AAO/D,MAAM,CAAC,IAAM,kCAAkC,GAAG,UAAC,MAA+B;IAChF,OAAO,CAAC,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,gBAAgB,CAAA,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW,CAAA,CAAA;AAC3D,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,yBAAyB,GAAG,UACvC,IAAoB,EACpB,MAAgC;IAEhC,yDAAyD;IACzD,IAAI,IAAI,KAAK,UAAU,IAAI,MAAM,IAAI,kCAAkC,CAAC,MAAM,CAAC,EAAE;QAC/E,OAAO,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAA;KACpD;IAED,IAAM,aAAa,GAA0D;QAC3E,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC/D,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACxD,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACvD,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QAC1D,iBAAiB,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QAC/D,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QAC1D,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACzD,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACtD,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACnE,UAAU,EAAE,EAAE,QAAQ,EAAE,CAAC,oBAAoB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACxE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,uBAAuB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QACzE,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,gBAAgB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;QAC/D,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;QACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;QACpE,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;QACpD,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE;KACvD,CAAA;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC,CAAA;AAED;;;;GAIG;AACH,IAAM,kBAAkB,GAAG,UAAC,UAA0B;IACpD,OAAA,UAAU,CAAC,IAAI,KAAK,UAAU;QAC9B,UAAU,CAAC,IAAI,KAAK,YAAY;QAChC,UAAU,CAAC,IAAI,KAAK,aAAa;QACjC,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU,IAAI,kCAAkC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAHzF,CAGyF,CAAA;AAE3F;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAA0B,EAC1B,SAAiB,EACjB,gBAA6C;IAA7C,iCAAA,EAAA,qBAA6C;IAE7C,IAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC9E,IAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,EAAE,SAAS,wBACzD,gBAAgB,KACnB,aAAa,eAAA,IACb,CAAA;IACF,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE;QAClC,OAAO,UAAU,CAAA;KAClB;IACD,OAAO,yBAAyB,CAAC,UAAU,EAAE;QAC3C,SAAS,WAAA;QACT,cAAc,EAAE,UAAU,CAAC,IAAI;QAC/B,QAAQ,EAAE,aAAa;QACvB,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB,IAAI,EAAE;QAC7D,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC;QAC9C,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAA;AACJ,CAAC;AAED,2FAA2F;AAC3F,IAAM,eAAe,GAAG,UACtB,UAA0B,EAC1B,SAAiB,EACjB,gBAAwC;IAExC,OAAA,gBAAgB,CAAC,aAAa;QAC9B,YAAY,CAAC,eAAe,CAAC,gBAAgB,CAAC,YAAY,EAAE;YAC1D,SAAS,WAAA;YACT,YAAY,EAAE,UAAU,IAAI,UAAU,CAAC,EAAE;YACzC,cAAc,EAAE,UAAU,IAAI,UAAU,CAAC,IAAI;SAC9C,CAAC;AALF,CAKE,CAAA;AAEJ,SAAS,qBAAqB,CAC5B,UAA0B,EAC1B,SAAiB,EACjB,gBAA6C;IAA7C,iCAAA,EAAA,qBAA6C;IAE7C,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;QACjD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;KAC3E;IAEO,IAAA,IAAI,GAAa,UAAU,KAAvB,EAAE,MAAM,GAAK,UAAU,OAAf,CAAe;IAEnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;QACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;KAC9E;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC,sDAA+C,IAAI,CAAE,CAAC,CAAA;KACvE;IAED,IAAI;QACF,QAAQ,IAAI,EAAE;YACZ,KAAK,YAAY,CAAC;YAClB,KAAK,aAAa,CAAC,CAAC;gBAClB,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,2DAAoD,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACxF;gBACD,OAAO,yBAAyB,CAC9B,MAAM,EACN,SAAS,EACT,gBAAgB,CAAC,kBAAkB,EACnC,gBAAgB,CAAC,YAAY,EAC7B,gBAAgB,CAAC,aAAa,EAC9B,gBAAgB,CACjB,CAAA;aACF;YAED,KAAK,OAAO,CAAC;YACb,KAAK,MAAM,CAAC,CAAC;gBACX,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAAwC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC5E;gBACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAC/C;YAED,KAAK,SAAS,CAAC,CAAC;gBACd,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,4CAAqC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACzE;gBACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACjD;YAED,KAAK,iBAAiB,CAAC,CAAC;gBACtB,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,oDAA6C,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACjF;gBACD,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAClD;YAED,KAAK,SAAS,CAAC,CAAC;gBACd,IAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;gBAChD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,4CAAqC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACzE;gBACD,OAAO,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACjD;YAED,KAAK,OAAO,CAAC,CAAC;gBACZ,IAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;gBAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,0CAAmC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACvE;gBACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAA;aACpC;YAED,KAAK,WAAW,CAAC,CAAC;gBAChB,IAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;gBAClD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,8CAAuC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC3E;gBACD,OAAO,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACnD;YAED,KAAK,YAAY,CAAC,CAAC;gBACjB,IAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;gBACnD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAAwC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC5E;gBACD,OAAO,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aACpD;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAAsC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC1E;gBACD,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAClD;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,uFAAuF;gBACvF,IAAI,kCAAkC,CAAC,MAAM,CAAC,EAAE;oBAC9C,IAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;oBACnD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE;wBACzB,MAAM,IAAI,KAAK,CACb,mEAA4D,YAAY,CAAC,KAAK,CAAE,CACjF,CAAA;qBACF;oBACD,OAAO,yBAAyB,CAC9B,MAAM,EACN,SAAS,EACT,gBAAgB,CAAC,kBAAkB,EACnC,gBAAgB,CAAC,YAAY,EAC7B,gBAAgB,CAAC,aAAa,EAC9B,gBAAgB,CACjB,CAAA;iBACF;gBAED,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAAsC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC1E;gBACD,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAClD;YAED,KAAK,OAAO,CAAC,CAAC;gBACZ,IAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;gBAC9C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,0CAAmC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACvE;gBACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;aAC/C;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,IAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;gBAChD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAAsC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC1E;gBACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAA;aACtC;YAED,KAAK,YAAY,CAAC,CAAC;gBACjB,IAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;gBACnD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,+CAAwC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC5E;gBACD,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAA;aACzC;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,IAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;gBAC5C,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,wCAAiC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBACrE;gBACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAA;aACtC;YAED,KAAK,eAAe,CAAC,CAAC;gBACpB,IAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAA;gBACrD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,kDAA2C,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC/E;gBACD,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;aAC3C;YAED,KAAK,UAAU,CAAC,CAAC;gBACf,IAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBACjD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;oBACvB,MAAM,IAAI,KAAK,CAAC,6CAAsC,UAAU,CAAC,KAAK,CAAE,CAAC,CAAA;iBAC1E;gBACD,OAAO,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;aACpE;YAED;gBACE,MAAM,IAAI,KAAK,CAAC,wCAAiC,IAAI,CAAE,CAAC,CAAA;SAC3D;KACF;IAAC,OAAO,KAAK,EAAE;QACd,6BAA6B;QAC7B,IAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;QAC7E,MAAM,IAAI,KAAK,CAAC,yCAAkC,IAAI,eAAK,YAAY,CAAE,CAAC,CAAA;KAC3E;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA0B,EAC1B,SAAiB,EACjB,UAA2B,EAC3B,gBAA6C,EAC7C,YAA2C;IAF3C,2BAAA,EAAA,kBAA2B;IAC3B,iCAAA,EAAA,qBAA6C;IAG7C,2EAA2E;IAC3E,kEAAkE;IAClE,IAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC9E,IAAM,iBAAiB,GACrB,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,IAAI,CAAC,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM;QAC1F,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,SAAS,CAAA;IACf,IAAM,UAAU,GAAG,yBAAyB,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAErF,uDAAuD;IACvD,0FAA0F;IAC1F,qEAAqE;IAErE,0EAA0E;IAC1E,IAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CACpC,uCAAuC,EACvC,wBAAwB,CACzB,CAAA;IAED,+DAA+D;IAC/D,IAAM,WAAW,GAAG,kBAAkB,CAAA;IACtC,IAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IACpD,IAAM,qBAAqB,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAEzE,4EAA4E;IAC5E,gDAAgD;IAChD,IAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IACnE,IAAM,gBAAgB,GAAG,kBAAkB,CAAC,UAAU,CAAC;QACrD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAA;IAC7C,IAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IAC9D,IAAM,0BAA0B,GAAG,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAEnF,kCAAkC;IAClC,IAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,iCAAK,OAAO,SAAK,YAAY,QAAE,CAAC,CAAA;IAErE,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,2BAA2B;IAC3B,EAAE;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,8BAA8B;IAC9B,IAAM,aAAa,GAAG,iBAAiB;QACrC,CAAC,CAAC,uCAAgC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,qBAAkB;QACjF,CAAC,CAAC,EAAE,CAAA;IACN,6EAA6E;IAC7E,4DAA4D;IAC5D,IAAM,iBAAiB,GAAG,WAAW,CAAC,OAAO,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CAAA;IACvF,6EAA6E;IAC7E,0EAA0E;IAC1E,gEAAgE;IAChE,IAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC9E,IAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAA;IAC1C,IAAM,kBAAkB,GAAG,UAAC,OAA2B;QACrD,OAAA,aAAa,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAAhC,CAAgC,CAAA;IAElC,IAAM,WAAW,GAAG,iBAAiB;QACnC,CAAC,CAAC,kCACkB,IAAI,CAAC,SAAS,CAAC;YAC/B,KAAK,EAAE,iBAAiB,CAAC,KAAK;YAC9B,GAAG,EAAE,iBAAiB,CAAC,UAAU;YACjC,OAAO,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACtD,GAAG,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,oBAAoB,CAAC;SAChE,CAAC,sCACiB,IAAI,CAAC,SAAS,CAAC;YAChC,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC;YACvD,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,mDAAmD;YACnD,YAAY,EAAE,iBAAiB,CAAC,KAAK;YACrC,GAAG,EAAE,iBAAiB,CAAC,UAAU;YACjC,OAAO,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACtD,GAAG,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,oBAAoB,CAAC;SAChE,CAAC,iBAGN,iBAAiB;YACf,CAAC,CAAC,wQAGsB,IAAI,CAAC,SAAS,CAClC,oBAAoB,CAAC,SAAS,kCACzB,WAAW,CAAC,gBAAgB,SAC5B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAC9C,CACH,iSAIoB,IAAI,CAAC,SAAS,CACjC,WAAW,CAAC,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAC5E,w5BAwBL,aAAa;gBACX,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,gbAYL,qCAGO,aAAa;gBACX,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,4DAA4D,sCAGhE,aAAa;gBACX,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,8DAA8D,CAClE;YACJ,CAAC,CAAC,yHACuD,OAE5D;QACG,CAAC,CAAC,EAAE,CAAA;IAEN,IAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,IAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAA;IAErE,mDAAmD;IACnD,6DAA6D;IAC7D,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,4EAA4E;IAC5E,IAAM,OAAO,GAAG,CAAC,iBAAiB;QAChC,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,kHACoD;QACxD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,yBAAkB,aAAa,CAAE;YACnC,CAAC,CAAC,0CAAmC,aAAa,0BAAgB,WAAW,8EAC9B,aAAa,yBAAe,WAAW,OAAI,CAAA;IAE5F,OAAO,UAAG,gCAAI,UAAU,UAAE,aAAa,UAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mkCAgC3D,aAAa,6gBA0Bb,WAAW,0LASnB,0BAA0B,iBAE1B,qBAAqB,eACrB,WAAW,eACX,OAAO,OACR,CAAA;AACD,CAAC"}

package/dist/esm/fetchers/postgresql.d.ts

@@ -1,3 +1,5 @@
-export declare const generatePostgreSQLFetcher: (config: Record<string, unknown>, tableName: string, trustedReaderRoles?: ReadonlyArray<string>) => string;
+import type { DataReadExposure, ProjectDataExposure } from '@teleporthq/teleport-types';
+import { SessionReaderPlacement } from './utils/table-access-guard';
+export declare const generatePostgreSQLFetcher: (config: Record<string, unknown>, tableName: string, trustedReaderRoles?: ReadonlyArray<string>, dataExposure?: ProjectDataExposure, routeExposure?: DataReadExposure, reader?: SessionReaderPlacement) => string;
 export declare const generatePostgreSQLCountFetcher: (config: Record<string, unknown>, tableName: string) => string;
 //# sourceMappingURL=postgresql.d.ts.map

package/dist/esm/fetchers/postgresql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgresql.d.ts","sourceRoot":"","sources":["../../../src/fetchers/postgresql.ts"],"names":[],"mappings":"AA8BA,eAAO,MAAM,yBAAyB,WAC5B,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,uBACG,cAAc,MAAM,CAAC,KACxC,MA8SF,CAAA;AAED,eAAO,MAAM,8BAA8B,WACjC,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,KAChB,MA8FF,CAAA"}
+{"version":3,"file":"postgresql.d.ts","sourceRoot":"","sources":["../../../src/fetchers/postgresql.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEvF,OAAO,EAGL,sBAAsB,EAEvB,MAAM,4BAA4B,CAAA;AAmBnC,eAAO,MAAM,yBAAyB,WAC5B,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,uBACG,cAAc,MAAM,CAAC,iBAE1B,mBAAmB,kBAElB,gBAAgB,WAExB,sBAAsB,KAC7B,MA6TF,CAAA;AAED,eAAO,MAAM,8BAA8B,WACjC,OAAO,MAAM,EAAE,OAAO,CAAC,aACpB,MAAM,KAChB,MA+FF,CAAA"}

package/dist/esm/fetchers/postgresql.js

@@ -3,14 +3,22 @@ import { generateSortFallbackFieldHelper, generateSortFieldSqlHelper } from '../
 import { SORT_NULLS_LAST_SQL } from '../list-sort-order';
 import { generateRowOrderTiebreakHelper, rowIdentityColumn } from '../row-order';
 import { generateProductFilterClauseHelper } from '../product-filter-fields';
-import { generateReadGuardCall, generateTableAccessPreamble } from './utils/table-access-guard';
+import { DataExposure } from '@teleporthq/teleport-shared';
+import { generateReadGuardCall, generateTableAccessPreamble, sqlRouteFieldPolicy, } from './utils/table-access-guard';
 import { generateSearchSqlHelpersCode, PG_SEARCH_SQL } from '../search-relevance';
 import { generateRequestSqlGuardsCode } from './utils/request-sql-guards';
 import { generateArrayOverlapSqlCode } from '../array-overlap-sql';
 import { PG_CLIENT_IMPORT } from './pg-client-import';
-export var generatePostgreSQLFetcher = function (config, tableName, trustedReaderRoles) {
+export var generatePostgreSQLFetcher = function (config, tableName, trustedReaderRoles, 
+// Who may read the table from a browser — see DataExposure.readExposureFor.
+dataExposure, 
+// The route's own exposure, already resolved for its data source (preferred).
+routeExposure, 
+// Where the route sits and whether its session reader checks revocation.
+reader) {
     var _a;
     if (trustedReaderRoles === void 0) { trustedReaderRoles = []; }
+    if (reader === void 0) { reader = {}; }
     var pgConfig = config;
     var schema = (_a = pgConfig.options) === null || _a === void 0 ? void 0 : _a.schema;
     var clientConfig = pgConfig.connectionString
@@ -20,7 +28,7 @@ export var generatePostgreSQLFetcher = function (config, tableName, trustedReade
             : pgConfig.sslConfig
                 ? "{\n      ".concat(pgConfig.sslConfig.ca ? "ca: ".concat(replaceSecretReference(pgConfig.sslConfig.ca), ",") : '', "\n      ").concat(pgConfig.sslConfig.cert ? "cert: ".concat(replaceSecretReference(pgConfig.sslConfig.cert), ",") : '', "\n      ").concat(pgConfig.sslConfig.key ? "key: ".concat(replaceSecretReference(pgConfig.sslConfig.key), ",") : '', "\n      rejectUnauthorized: false\n    }")
                 : '{ rejectUnauthorized: false }', "\n  }");
-    return "".concat(PG_CLIENT_IMPORT, "\n\n").concat(generateTableAccessPreamble(trustedReaderRoles), "\n\nconst getClient = () => {\n  return new Client(").concat(clientConfig, ")\n}\n\n").concat(generateSafeJSONParseCode(), "\n\n").concat(generateFilterTreeHelpersCode(), "\n\n").concat(generateSearchEscapeHelpersCode(), "\n").concat(generateSearchSqlHelpersCode(PG_SEARCH_SQL), "\n").concat(generateArrayOverlapSqlCode(), "\n\n// Builds one SQL clause for the whole filter tree, so an OR group nested in\n// the root AND keeps its meaning instead of being flattened into ANDs.\n").concat(generateRequestSqlGuardsCode(), "\nconst processFilters = (filters, conditions, queryParams, paramIndex) => {\n  if (!filters) return paramIndex\n  \n  const filterTree = normalizeFilterTree(safeJSONParse(filters))\n  if (!filterTree) return paramIndex\n  \n  const buildCondition = (condition) => {\n    const field = condition.source\n    const normalizedCondition = normalizeInOperand(condition.operand, condition.destination)\n    if (normalizedCondition === null) return null\n    const value = normalizedCondition.value\n    const operand = normalizedCondition.operand\n    \n    // The products table's virtual fields (effective price, rating bucket,\n    // on-sale flag, variant axes) are whole clauses, not columns - so they are\n    // answered before any branch below can interpolate the field name raw.\n    const productClause = productFilterClause(field, operand, value, (param) => {\n      queryParams.push(param)\n      return '$' + paramIndex++\n    })\n    if (productClause !== null) return productClause\n    assertRequestColumn(field, 'filter field')\n    \n    if (Array.isArray(value)) {\n      if (value.length === 0) return null\n      if (operand === 'array_overlap') {\n        // The row's list (see array-overlap-sql.ts) shares any value with the set.\n        const clause = arrayOverlapSql([field], '$' + paramIndex)\n        queryParams.push(value.map((entry) => String(entry)))\n        paramIndex++\n        return clause\n      }\n      const placeholders = value.map(() => `$${paramIndex++}`)\n      queryParams.push(...value)\n      return operand === '!='\n        ? `${field} NOT IN (${placeholders.join(', ')})`\n        : `${field} IN (${placeholders.join(', ')})`\n    }\n    \n    if (operand === 'array_overlap') {\n      if (value === '' || value === null || value === undefined) return null\n      // A single comma-joined string (the multi-select Category Filter's\n      // ?categoryFilter=a,b,c) expands to multiple ids; one id stays one.\n      const overlapValues = String(value).split(',').map((entry) => entry.trim()).filter(Boolean)\n      if (overlapValues.length === 0) return null\n      const clause = arrayOverlapSql([field], '$' + paramIndex)\n      queryParams.push(overlapValues)\n      paramIndex++\n      return clause\n    }\n    \n    if (value === null) {\n      if (operand === '=') return `${field} IS NULL`\n      if (operand === '!=') return `${field} IS NOT NULL`\n      return null\n    }\n    \n    const validOps = ['=', '!=', '>', '<', '>=', '<=']\n    const sqlOperator = validOps.includes(operand) ? operand : '='\n    const clause = `${field} ${sqlOperator} $${paramIndex}`\n    queryParams.push(value)\n    paramIndex++\n    return clause\n  }\n  \n  const clause = buildFilterTreeClause(filterTree, buildCondition)\n  if (clause) conditions.push(clause)\n  \n  return paramIndex\n}\n\n").concat(generateDateFormatterCode(), "\n\n").concat(generateSortFieldSqlHelper(tableName), "\n\n").concat(generateSortFallbackFieldHelper(tableName), "\n\n").concat(generateRowOrderTiebreakHelper(rowIdentityColumn(config, tableName)), "\n\n").concat(generateProductFilterClauseHelper(tableName), "\n\nexport default async function handler(req, res) {\n").concat(generateReadGuardCall(tableName, null), "\n  const client = getClient()\n  \n  try {\n    await client.connect()\n    ").concat(schema ? "await client.query('SET search_path TO ".concat(schema, "')") : '', "\n    \n    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query\n    // A visitor never filters, sorts or searches by a column it is not served.\n    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)\n    \n    const conditions = []\n    const queryParams = []\n    let paramIndex = 1\n    let searchRank = ''\n    let searchFrom = ''\n    \n    if (query) {\n      let columns = []\n      \n      if (queryColumns) {\n        // Use specified columns. Wrap non-arrays so that a single\n        // column passed as a bare string doesn't get iterated as chars.\n        const parsed = safeJSONParse(queryColumns)\n        columns = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])\n      } else {\n        // Fallback: Get all columns from information_schema\n        try {\n          const schemaQuery = `\n            SELECT column_name\n            FROM information_schema.columns\n            WHERE table_name = $1\n            ").concat(schema ? "AND table_schema = $2" : '', "\n            ORDER BY ordinal_position\n          `\n          const schemaParams = schema \n            ? [").concat(JSON.stringify(tableName), ", ").concat(JSON.stringify(schema), "]\n            : [").concat(JSON.stringify(tableName), "]\n          \n          const schemaResult = await client.query(schemaQuery, schemaParams)\n          columns = schemaResult.rows.map(row => row.column_name)\n        } catch (schemaError) {\n          console.warn('Failed to fetch column names from information_schema:', schemaError.message)\n          // Continue without search if we can't get columns\n        }\n      }\n      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)\n      \n      const search = buildSearchSql(query, columns, paramIndex)\n      if (search) {\n        conditions.push(search.where)\n        queryParams.push(...search.params)\n        paramIndex = search.nextIndex\n        searchRank = search.rank\n        searchFrom = search.from\n      }\n    }\n\n    // Apply filters using helper function\n    paramIndex = processFilters(filters, conditions, queryParams, paramIndex)\n    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')\n    \n    // A search's worked-out texts stay out of the rows: only the table's own columns.\n    let sql = `SELECT ${searchFrom ? '\"").concat(tableName, "\".*' : '*'} FROM \"").concat(tableName, "\"${searchFrom}`\n    \n    if (conditions.length > 0) {\n      sql += ` WHERE ${conditions.join(' AND ')}`\n    }\n    \n    // Handle sorts - new array format. Two ORDER BY clauses are built: the one\n    // actually used (the products table's price rewrites, rows without a value\n    // last), and a plain-column twin kept only as the fallback below.\n    // A search orders its matches by where the words are first; the sort\n    // orders the rows within each of those groups.\n    let orderBySql = ''\n    let plainOrderBySql = ''\n    const searchOrder = searchRank ? searchRank + ', ' : ''\n    if (sorts) {\n      const parsedSorts = safeJSONParse(sorts)\n      if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {\n        const valid = parsedSorts.filter((sort) => sort && sort.field)\n        valid.forEach((sort) => assertRequestColumn(sort.field, 'sort field'))\n        const orderOf = (sort) => (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'\n        const orderClauses = valid.map((sort) => `${sortFieldSql(sort.field)} ${orderOf(sort)}").concat(SORT_NULLS_LAST_SQL, "`)\n        const plainClauses = valid.map((sort) => `${sortFallbackField(sort.field)} ${orderOf(sort)}`)\n\n        if (orderClauses.length > 0) {\n          // The row's own key last, so equal rows can't repeat across pages\n          // or vanish between them.\n          const tiebreak = rowOrderTiebreak(valid.map((sort) => sort.field), orderOf(valid[valid.length - 1]))\n          orderBySql = ` ORDER BY ${searchOrder}${orderClauses.join(', ')}${tiebreak}`\n          plainOrderBySql = ` ORDER BY ${searchOrder}${plainClauses.join(', ')}${tiebreak}`\n        }\n      }\n    } else if (sortBy) {\n      assertRequestColumn(sortBy, 'sort field')\n      const sortByDirection = (sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'\n      const tiebreak = rowOrderTiebreak([sortBy], sortByDirection)\n      orderBySql = ` ORDER BY ${searchOrder}${sortBy} ${sortByDirection}").concat(SORT_NULLS_LAST_SQL, "${tiebreak}`\n      plainOrderBySql = ` ORDER BY ${searchOrder}${sortBy} ${sortByDirection}${tiebreak}`\n    }\n    if (!orderBySql && searchRank) {\n      orderBySql = plainOrderBySql = ' ORDER BY ' + searchRank + rowOrderTiebreak([], 'ASC')\n    }\n    const usedRewrittenSort = orderBySql !== plainOrderBySql\n\n    const limitValue = requestRowCount(limit || perPage)\n    const offsetValue = offset !== undefined ? parseInt(offset) : (page && perPage ? (parseInt(page) - 1) * parseInt(perPage) : undefined)\n\n    let sqlTail = ''\n    if (limitValue !== undefined) {\n      sqlTail += ` LIMIT ${limitValue}`\n    }\n    \n    if (offsetValue !== undefined) {\n      sqlTail += ` OFFSET ${offsetValue}`\n    }\n\n    const baseSql = sql\n    sql = baseSql + orderBySql + sqlTail\n    \n    // The discount-aware price ordering is an inline sub-select over a JSON\n    // column. It is written to be unraisable, but it runs inside ORDER BY for\n    // the whole table \u2014 so if a database ever rejects it, fall back to ordering\n    // by the stored list price rather than serving an empty products page. The\n    // empty-values-last ordering takes the same exit, for a Postgres-compatible\n    // database that does not know NULLS LAST.\n    let result\n    try {\n      result = await client.query(sql, queryParams)\n    } catch (sortError) {\n      if (!usedRewrittenSort) throw sortError\n      console.warn(\n        'Rewritten sort failed; falling back to the plain column:',\n        sortError && sortError.message\n      )\n      result = await client.query(baseSql + plainOrderBySql + sqlTail, queryParams)\n    }\n    const rows = Array.isArray(result?.rows) ? result.rows : []\n    const plainRows = rows.map((row) =>\n      row && typeof row.toJSON === 'function' ? row.toJSON() : row\n    )\n    const safeData = JSON.parse(JSON.stringify(plainRows, dateReplacer))\n\n    return res.status(200).json({\n      success: true,\n      data: __taWithoutCredentials(\n        __rowPolicy ? __brpStripHidden(__rowPolicy, safeData) : safeData,\n        ").concat(JSON.stringify(tableName), "\n      ),\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('PostgreSQL fetch error:', error)\n    // A database error names tables, columns and values: it stays in the server\n    // log. Only an error this route raised for the caller (it carries a status)\n    // is repeated to it.\n    return res.status(error.status || 500).json({\n      success: false,\n      error: error.status ? error.message : 'Failed to fetch data',\n      timestamp: Date.now()\n    })\n  } finally {\n    if (client) {\n      try {\n        await client.end()\n      } catch (error) {\n        console.error('Error closing PostgreSQL client:', error)\n      }\n    }\n  }\n}\n");
+    return "".concat(PG_CLIENT_IMPORT, "\n\n").concat(generateTableAccessPreamble(trustedReaderRoles, routeExposure || DataExposure.readExposureFor(dataExposure, { tableName: tableName }), sqlRouteFieldPolicy(config, tableName), tableName, reader), "\n\n// No query waits on the database longer than this (enforced by the client:\n// a server-side statement_timeout does not survive a pooler).\nconst getClient = () => {\n  return new Client(Object.assign(").concat(clientConfig, ", { query_timeout: ").concat(DataExposure.READ_QUERY_TIMEOUT_MS, " }))\n}\n\n").concat(generateSafeJSONParseCode(), "\n\n").concat(generateFilterTreeHelpersCode(), "\n\n").concat(generateSearchEscapeHelpersCode(), "\n").concat(generateSearchSqlHelpersCode(PG_SEARCH_SQL), "\n").concat(generateArrayOverlapSqlCode(), "\n\n// Builds one SQL clause for the whole filter tree, so an OR group nested in\n// the root AND keeps its meaning instead of being flattened into ANDs.\n").concat(generateRequestSqlGuardsCode(), "\nconst processFilters = (filters, conditions, queryParams, paramIndex) => {\n  if (!filters) return paramIndex\n  \n  const filterTree = normalizeFilterTree(safeJSONParse(filters))\n  if (!filterTree) return paramIndex\n  \n  const buildCondition = (condition) => {\n    const field = condition.source\n    const normalizedCondition = normalizeInOperand(condition.operand, condition.destination)\n    if (normalizedCondition === null) return null\n    const value = normalizedCondition.value\n    const operand = normalizedCondition.operand\n    \n    // The products table's virtual fields (effective price, rating bucket,\n    // on-sale flag, variant axes) are whole clauses, not columns - so they are\n    // answered before any branch below can interpolate the field name raw.\n    const productClause = productFilterClause(field, operand, value, (param) => {\n      queryParams.push(param)\n      return '$' + paramIndex++\n    })\n    if (productClause !== null) return productClause\n    assertRequestColumn(field, 'filter field')\n    \n    if (Array.isArray(value)) {\n      if (value.length === 0) return null\n      if (operand === 'array_overlap') {\n        // The row's list (see array-overlap-sql.ts) shares any value with the set.\n        const clause = arrayOverlapSql([field], '$' + paramIndex)\n        queryParams.push(value.map((entry) => String(entry)))\n        paramIndex++\n        return clause\n      }\n      const placeholders = value.map(() => `$${paramIndex++}`)\n      queryParams.push(...value)\n      return operand === '!='\n        ? `${field} NOT IN (${placeholders.join(', ')})`\n        : `${field} IN (${placeholders.join(', ')})`\n    }\n    \n    if (operand === 'array_overlap') {\n      if (value === '' || value === null || value === undefined) return null\n      // A single comma-joined string (the multi-select Category Filter's\n      // ?categoryFilter=a,b,c) expands to multiple ids; one id stays one.\n      const overlapValues = String(value).split(',').map((entry) => entry.trim()).filter(Boolean)\n      if (overlapValues.length === 0) return null\n      const clause = arrayOverlapSql([field], '$' + paramIndex)\n      queryParams.push(overlapValues)\n      paramIndex++\n      return clause\n    }\n    \n    if (value === null) {\n      if (operand === '=') return `${field} IS NULL`\n      if (operand === '!=') return `${field} IS NOT NULL`\n      return null\n    }\n    \n    // 'like' reads a JSON-list cell for one member (a post's former slugs); the\n    // value is a bound parameter, so a pattern never reaches the SQL text.\n    const validOps = ['=', '!=', '>', '<', '>=', '<=', 'like']\n    const sqlOperator = validOps.includes(operand) ? operand : '='\n    const clause = `${field} ${sqlOperator} $${paramIndex}`\n    queryParams.push(value)\n    paramIndex++\n    return clause\n  }\n  \n  const clause = buildFilterTreeClause(filterTree, buildCondition)\n  if (clause) conditions.push(clause)\n  \n  return paramIndex\n}\n\n").concat(generateDateFormatterCode(), "\n\n").concat(generateSortFieldSqlHelper(tableName), "\n\n").concat(generateSortFallbackFieldHelper(tableName), "\n\n").concat(generateRowOrderTiebreakHelper(rowIdentityColumn(config, tableName)), "\n\n").concat(generateProductFilterClauseHelper(tableName), "\n\nexport default async function handler(req, res) {\n").concat(generateReadGuardCall(tableName, null), "\n  const client = getClient()\n  \n  try {\n    await client.connect()\n    ").concat(schema ? "await client.query('SET search_path TO ".concat(schema, "')") : '', "\n    \n    const { query, queryColumns, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset } = req.query\n    // A visitor never filters, sorts or searches by a column it is not served.\n    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)\n    \n    const conditions = []\n    const queryParams = []\n    let paramIndex = 1\n    let searchRank = ''\n    let searchFrom = ''\n    \n    if (query) {\n      let columns = []\n      \n      if (queryColumns) {\n        // Use specified columns. Wrap non-arrays so that a single\n        // column passed as a bare string doesn't get iterated as chars.\n        const parsed = safeJSONParse(queryColumns)\n        columns = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])\n      } else {\n        // Fallback: Get all columns from information_schema\n        try {\n          const schemaQuery = `\n            SELECT column_name\n            FROM information_schema.columns\n            WHERE table_name = $1\n            ").concat(schema ? "AND table_schema = $2" : '', "\n            ORDER BY ordinal_position\n          `\n          const schemaParams = schema \n            ? [").concat(JSON.stringify(tableName), ", ").concat(JSON.stringify(schema), "]\n            : [").concat(JSON.stringify(tableName), "]\n          \n          const schemaResult = await client.query(schemaQuery, schemaParams)\n          // A credential column is never searched: a search is an oracle for it.\n          columns = schemaResult.rows.map(row => row.column_name).filter((column) => !__taIsCredentialColumn(column))\n        } catch (schemaError) {\n          console.warn('Failed to fetch column names from information_schema:', schemaError.message)\n          // Continue without search if we can't get columns\n        }\n      }\n      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)\n      \n      const search = buildSearchSql(query, columns, paramIndex)\n      if (search) {\n        conditions.push(search.where)\n        queryParams.push(...search.params)\n        paramIndex = search.nextIndex\n        searchRank = search.rank\n        searchFrom = search.from\n      }\n    }\n\n    // Apply filters using helper function\n    paramIndex = processFilters(filters, conditions, queryParams, paramIndex)\n    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')\n    \n    // A search's worked-out texts stay out of the rows: only the table's own columns.\n    let sql = `SELECT ${searchFrom ? '\"").concat(tableName, "\".*' : '*'} FROM \"").concat(tableName, "\"${searchFrom}`\n    \n    if (conditions.length > 0) {\n      sql += ` WHERE ${conditions.join(' AND ')}`\n    }\n    \n    // Handle sorts - new array format. Two ORDER BY clauses are built: the one\n    // actually used (the products table's price rewrites, rows without a value\n    // last), and a plain-column twin kept only as the fallback below.\n    // A search orders its matches by where the words are first; the sort\n    // orders the rows within each of those groups.\n    let orderBySql = ''\n    let plainOrderBySql = ''\n    const searchOrder = searchRank ? searchRank + ', ' : ''\n    if (sorts) {\n      const parsedSorts = safeJSONParse(sorts)\n      if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {\n        const valid = parsedSorts.filter((sort) => sort && sort.field)\n        valid.forEach((sort) => assertRequestColumn(sort.field, 'sort field'))\n        const orderOf = (sort) => (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'\n        const orderClauses = valid.map((sort) => `${sortFieldSql(sort.field)} ${orderOf(sort)}").concat(SORT_NULLS_LAST_SQL, "`)\n        const plainClauses = valid.map((sort) => `${sortFallbackField(sort.field)} ${orderOf(sort)}`)\n\n        if (orderClauses.length > 0) {\n          // The row's own key last, so equal rows can't repeat across pages\n          // or vanish between them.\n          const tiebreak = rowOrderTiebreak(valid.map((sort) => sort.field), orderOf(valid[valid.length - 1]))\n          orderBySql = ` ORDER BY ${searchOrder}${orderClauses.join(', ')}${tiebreak}`\n          plainOrderBySql = ` ORDER BY ${searchOrder}${plainClauses.join(', ')}${tiebreak}`\n        }\n      }\n    } else if (sortBy) {\n      assertRequestColumn(sortBy, 'sort field')\n      const sortByDirection = (sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'\n      const tiebreak = rowOrderTiebreak([sortBy], sortByDirection)\n      orderBySql = ` ORDER BY ${searchOrder}${sortBy} ${sortByDirection}").concat(SORT_NULLS_LAST_SQL, "${tiebreak}`\n      plainOrderBySql = ` ORDER BY ${searchOrder}${sortBy} ${sortByDirection}${tiebreak}`\n    }\n    if (!orderBySql && searchRank) {\n      orderBySql = plainOrderBySql = ' ORDER BY ' + searchRank + rowOrderTiebreak([], 'ASC')\n    }\n    const usedRewrittenSort = orderBySql !== plainOrderBySql\n\n    // Whole numbers only, and a browser's read capped - see __taReadWindow.\n    const __window = __taReadWindow(req)\n    const limitValue = __window.limit || __window.perPage\n    const offsetValue = __window.offset !== undefined ? __window.offset : (__window.page && __window.perPage ? (__window.page - 1) * __window.perPage : undefined)\n\n    let sqlTail = ''\n    if (limitValue !== undefined) {\n      sqlTail += ` LIMIT ${limitValue}`\n    }\n    \n    if (offsetValue !== undefined) {\n      sqlTail += ` OFFSET ${offsetValue}`\n    }\n\n    const baseSql = sql\n    sql = baseSql + orderBySql + sqlTail\n    \n    // The discount-aware price ordering is an inline sub-select over a JSON\n    // column. It is written to be unraisable, but it runs inside ORDER BY for\n    // the whole table \u2014 so if a database ever rejects it, fall back to ordering\n    // by the stored list price rather than serving an empty products page. The\n    // empty-values-last ordering takes the same exit, for a Postgres-compatible\n    // database that does not know NULLS LAST.\n    let result\n    try {\n      result = await client.query(sql, queryParams)\n    } catch (sortError) {\n      if (!usedRewrittenSort) throw sortError\n      console.warn(\n        'Rewritten sort failed; falling back to the plain column:',\n        sortError && sortError.message\n      )\n      result = await client.query(baseSql + plainOrderBySql + sqlTail, queryParams)\n    }\n    const rows = Array.isArray(result?.rows) ? result.rows : []\n    const plainRows = rows.map((row) =>\n      row && typeof row.toJSON === 'function' ? row.toJSON() : row\n    )\n    const safeData = JSON.parse(JSON.stringify(plainRows, dateReplacer))\n\n    return res.status(200).json({\n      success: true,\n      data: __taWithoutCredentials(\n        __rowPolicy ? __brpStripHidden(__rowPolicy, safeData) : safeData,\n        ").concat(JSON.stringify(tableName), "\n      ),\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('PostgreSQL fetch error:', error)\n    // A database error names tables, columns and values: it stays in the server\n    // log. Only an error this route raised for the caller (it carries a status)\n    // is repeated to it.\n    return res.status(error.status || 500).json({\n      success: false,\n      error: error.status ? error.message : 'Failed to fetch data',\n      timestamp: Date.now()\n    })\n  } finally {\n    if (client) {\n      try {\n        await client.end()\n      } catch (error) {\n        console.error('Error closing PostgreSQL client:', error)\n      }\n    }\n  }\n}\n");
 };
 export var generatePostgreSQLCountFetcher = function (config, tableName) {
     var _a;
@@ -28,6 +36,6 @@ export var generatePostgreSQLCountFetcher = function (config, tableName) {
     var hasSchema = !!((_a = pgConfig.options) === null || _a === void 0 ? void 0 : _a.schema);
     return "\nasync function getCount(req, res) {\n".concat(generateReadGuardCall(tableName, null), "\n  const client = getClient()\n\n  try {\n    await client.connect()\n    const { query, queryColumns, filters } = req.query\n    if (__rowPolicy) __brpAssertVisibleFields(__rowPolicy, req.query)\n    const conditions = []\n    const queryParams = []\n    let paramIndex = 1\n    let searchFrom = ''\n\n    if (query) {\n      let columns = []\n      \n      if (queryColumns) {\n        // Use specified columns\n        const parsed = safeJSONParse(queryColumns)\n        columns = Array.isArray(parsed) ? parsed : [parsed]\n      } else {\n        // Fallback: Get all columns from information_schema\n        try {\n          const schemaQuery = `\n            SELECT column_name \n            FROM information_schema.columns \n            WHERE table_name = $1\n            ").concat(hasSchema ? "AND table_schema = $2" : '', "\n            ORDER BY ordinal_position\n          `\n          const schemaParams = ").concat(hasSchema
         ? "[".concat(JSON.stringify(tableName), ", ").concat(JSON.stringify(pgConfig.options.schema), "]")
-        : "[".concat(JSON.stringify(tableName), "]"), "\n          \n          const schemaResult = await client.query(schemaQuery, schemaParams)\n          columns = schemaResult.rows.map(row => row.column_name)\n        } catch (schemaError) {\n          console.warn('Failed to fetch column names from information_schema:', schemaError.message)\n          // Continue without search if we can't get columns\n        }\n      }\n      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)\n      \n      const search = buildSearchSql(query, columns, paramIndex)\n      if (search) {\n        conditions.push(search.where)\n        queryParams.push(...search.params)\n        paramIndex = search.nextIndex\n        searchFrom = search.from\n      }\n    }\n\n    // Apply filters using helper function\n    paramIndex = processFilters(filters, conditions, queryParams, paramIndex)\n    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')\n\n    let countSql = `SELECT COUNT(*) FROM \"").concat(tableName, "\"${searchFrom}`\n    if (conditions.length > 0) {\n      countSql += ` WHERE ${conditions.join(' AND ')}`\n    }\n\n    const result = await client.query(countSql, queryParams)\n    const count = parseInt(result.rows[0].count, 10)\n\n    return res.status(200).json({\n      success: true,\n      count: count,\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('Error getting count:', error)\n    return res.status(error.status || 500).json({\n      success: false,\n      error: error.status ? error.message : 'Failed to get count',\n      timestamp: Date.now()\n    })\n  } finally {\n    if (client) {\n      try {\n        await client.end()\n      } catch (error) {\n        console.error('Error closing PostgreSQL client:', error)\n      }\n    }\n  }\n}\n");
+        : "[".concat(JSON.stringify(tableName), "]"), "\n          \n          const schemaResult = await client.query(schemaQuery, schemaParams)\n          // A credential column is never searched: a search is an oracle for it.\n          columns = schemaResult.rows.map(row => row.column_name).filter((column) => !__taIsCredentialColumn(column))\n        } catch (schemaError) {\n          console.warn('Failed to fetch column names from information_schema:', schemaError.message)\n          // Continue without search if we can't get columns\n        }\n      }\n      if (__rowPolicy) columns = __brpVisibleColumns(__rowPolicy, columns)\n      \n      const search = buildSearchSql(query, columns, paramIndex)\n      if (search) {\n        conditions.push(search.where)\n        queryParams.push(...search.params)\n        paramIndex = search.nextIndex\n        searchFrom = search.from\n      }\n    }\n\n    // Apply filters using helper function\n    paramIndex = processFilters(filters, conditions, queryParams, paramIndex)\n    if (__rowPolicy) conditions.push('(' + __rowPolicy.predicate + ')')\n\n    let countSql = `SELECT COUNT(*) FROM \"").concat(tableName, "\"${searchFrom}`\n    if (conditions.length > 0) {\n      countSql += ` WHERE ${conditions.join(' AND ')}`\n    }\n\n    const result = await client.query(countSql, queryParams)\n    const count = parseInt(result.rows[0].count, 10)\n\n    return res.status(200).json({\n      success: true,\n      count: count,\n      timestamp: Date.now()\n    })\n  } catch (error) {\n    console.error('Error getting count:', error)\n    return res.status(error.status || 500).json({\n      success: false,\n      error: error.status ? error.message : 'Failed to get count',\n      timestamp: Date.now()\n    })\n  } finally {\n    if (client) {\n      try {\n        await client.end()\n      } catch (error) {\n        console.error('Error closing PostgreSQL client:', error)\n      }\n    }\n  }\n}\n");
 };
 //# sourceMappingURL=postgresql.js.map

package/dist/esm/fetchers/postgresql.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgresql.js","sourceRoot":"","sources":["../../../src/fetchers/postgresql.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAA;AAC5E,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AAC/F,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAerD,MAAM,CAAC,IAAM,yBAAyB,GAAG,UACvC,MAA+B,EAC/B,SAAiB,EACjB,kBAA8C;;IAA9C,mCAAA,EAAA,uBAA8C;IAE9C,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,MAAM,GAAG,MAAA,QAAQ,CAAC,OAAO,0CAAE,MAAM,CAAA;IAEvC,IAAM,YAAY,GAAG,QAAQ,CAAC,gBAAgB;QAC5C,CAAC,CAAC,mCACkB,sBAAsB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WACrE;QACA,CAAC,CAAC,uBACM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAC7B,QAAQ,CAAC,IAAI,IAAI,IAAI,0BACrB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,8BAC9C,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,8BACzC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAE3C,QAAQ,CAAC,GAAG,KAAK,KAAK;YACpB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,QAAQ,CAAC,SAAS;gBACpB,CAAC,CAAC,mBACF,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,cAAO,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBACpF,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAS,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBAC1F,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,eAAQ,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,6CAEzF;gBACE,CAAC,CAAC,+BAA+B,UAErC,CAAA;IAEF,OAAO,UAAG,gBAAgB,iBAE1B,2BAA2B,CAAC,kBAAkB,CAAC,gEAG3B,YAAY,qBAGhC,yBAAyB,EAAE,iBAE3B,6BAA6B,EAAE,iBAE/B,+BAA+B,EAAE,eACjC,4BAA4B,CAAC,aAAa,CAAC,eAC3C,2BAA2B,EAAE,wKAI7B,4BAA4B,EAAE,+xFAwE9B,yBAAyB,EAAE,iBAE3B,0BAA0B,CAAC,SAAS,CAAC,iBAErC,+BAA+B,CAAC,SAAS,CAAC,iBAE1C,8BAA8B,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,iBAEpE,iCAAiC,CAAC,SAAS,CAAC,oEAG5C,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,0FAKlC,MAAM,CAAC,CAAC,CAAC,iDAA0C,MAAM,OAAI,CAAC,CAAC,CAAC,EAAE,ggCA2B1D,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,0HAIlC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,+BACpD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,0kCA0BC,SAAS,iCAAqB,SAAS,wkCAoBiB,mBAAmB,y4BAexC,mBAAmB,+hEAkDvF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,irBAwBlC,CAAA;AACD,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,8BAA8B,GAAG,UAC5C,MAA+B,EAC/B,SAAiB;;IAEjB,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,SAAS,GAAG,CAAC,CAAC,CAAA,MAAA,QAAQ,CAAC,OAAO,0CAAE,MAAM,CAAA,CAAA;IAE5C,OAAO,iDAEP,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,yxBA0B1B,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,kGAI1C,SAAS;QACP,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAQ,CAAC,MAAM,CAAC,MAAG;QAC/E,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAG,88BAyBH,SAAS,2xBA8BrD,CAAA;AACD,CAAC,CAAA"}
+{"version":3,"file":"postgresql.js","sourceRoot":"","sources":["../../../src/fetchers/postgresql.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAChF,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAA;AAE5E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC1D,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAE3B,mBAAmB,GACpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAerD,MAAM,CAAC,IAAM,yBAAyB,GAAG,UACvC,MAA+B,EAC/B,SAAiB,EACjB,kBAA8C;AAC9C,4EAA4E;AAC5E,YAAkC;AAClC,8EAA8E;AAC9E,aAAgC;AAChC,yEAAyE;AACzE,MAAmC;;IANnC,mCAAA,EAAA,uBAA8C;IAM9C,uBAAA,EAAA,WAAmC;IAEnC,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,MAAM,GAAG,MAAA,QAAQ,CAAC,OAAO,0CAAE,MAAM,CAAA;IAEvC,IAAM,YAAY,GAAG,QAAQ,CAAC,gBAAgB;QAC5C,CAAC,CAAC,mCACkB,sBAAsB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WACrE;QACA,CAAC,CAAC,uBACM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAC7B,QAAQ,CAAC,IAAI,IAAI,IAAI,0BACrB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,8BAC9C,sBAAsB,CAAC,QAAQ,CAAC,QAAQ,CAAC,8BACzC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAE3C,QAAQ,CAAC,GAAG,KAAK,KAAK;YACpB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,QAAQ,CAAC,SAAS;gBACpB,CAAC,CAAC,mBACF,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,cAAO,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBACpF,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAS,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,qBAC1F,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,eAAQ,sBAAsB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,MAAG,CAAC,CAAC,CAAC,EAAE,6CAEzF;gBACE,CAAC,CAAC,+BAA+B,UAErC,CAAA;IAEF,OAAO,UAAG,gBAAgB,iBAE1B,2BAA2B,CAC3B,kBAAkB,EAClB,aAAa,IAAI,YAAY,CAAC,eAAe,CAAC,YAAY,EAAE,EAAE,SAAS,WAAA,EAAE,CAAC,EAC1E,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,EACtC,SAAS,EACT,MAAM,CACP,2NAKmC,YAAY,gCAC5C,YAAY,CAAC,qBAAqB,wBAIpC,yBAAyB,EAAE,iBAE3B,6BAA6B,EAAE,iBAE/B,+BAA+B,EAAE,eACjC,4BAA4B,CAAC,aAAa,CAAC,eAC3C,2BAA2B,EAAE,wKAI7B,4BAA4B,EAAE,s8FA0E9B,yBAAyB,EAAE,iBAE3B,0BAA0B,CAAC,SAAS,CAAC,iBAErC,+BAA+B,CAAC,SAAS,CAAC,iBAE1C,8BAA8B,CAAC,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,iBAEpE,iCAAiC,CAAC,SAAS,CAAC,oEAG5C,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,0FAKlC,MAAM,CAAC,CAAC,CAAC,iDAA0C,MAAM,OAAI,CAAC,CAAC,CAAC,EAAE,ggCA2B1D,MAAM,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,0HAIlC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,+BACpD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,itCA2BC,SAAS,iCAAqB,SAAS,wkCAoBiB,mBAAmB,y4BAexC,mBAAmB,grEAoDvF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,irBAwBlC,CAAA;AACD,CAAC,CAAA;AAED,MAAM,CAAC,IAAM,8BAA8B,GAAG,UAC5C,MAA+B,EAC/B,SAAiB;;IAEjB,IAAM,QAAQ,GAAG,MAA0B,CAAA;IAC3C,IAAM,SAAS,GAAG,CAAC,CAAC,CAAA,MAAA,QAAQ,CAAC,OAAO,0CAAE,MAAM,CAAA,CAAA;IAE5C,OAAO,iDAEP,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,yxBA0B1B,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,kGAI1C,SAAS;QACP,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAQ,CAAC,MAAM,CAAC,MAAG;QAC/E,CAAC,CAAC,WAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAG,qlCA0BH,SAAS,2xBA8BrD,CAAA;AACD,CAAC,CAAA"}

package/dist/esm/fetchers/raw-query.d.ts

@@ -1,3 +1,22 @@
+/**
+ * What a raw-query state route is behind: the protection of the page it
+ * serves (`PageAccess.resolvePageAccessPolicy`; null for a page every visitor
+ * may open, and for an app-wide global state), and the roles that may read the
+ * protected tables (`TableAccess.resolveTrustedReaderRoles`).
+ */
+export interface RawQueryRouteAccess {
+    pageAccess?: {
+        requiresAuth: boolean;
+        allowedRoles: string[];
+        requiresSubscription?: boolean;
+        subscriptionProductIds?: string[];
+    } | null;
+    trustedReaderRoles?: string[];
+    /** The route's path back to the project root; absent, three folders (`pages/api/page-state/`, `pages/api/global-state/`). */
+    projectRoot?: string;
+    /** The project has authentication: the session reader checks revocation (absent: it does). */
+    withRevocation?: boolean;
+}
 /**
  * Generates an API route handler that executes a parameterized raw SQL query.
  * Supports {{Current User.*}} substitution — bound to the SESSION's user.
@@ -13,7 +32,7 @@
  * @param query - Raw SQL query string with {{Current User.*}} patterns already replaced to $N placeholders
  * @param paramFields - Array of query param field names that map to $1, $2, etc. in order
  */
-export declare const generateRawQueryFetcher: (config: Record<string, unknown>, query: string, paramFields: string[]) => string;
+export declare const generateRawQueryFetcher: (config: Record<string, unknown>, query: string, paramFields: string[], access?: RawQueryRouteAccess) => string;
 /**
  * Parses a SQL query string for {{Current User.*}} template patterns.
  * Returns the parameterized query and an ordered list of field names.

package/dist/esm/fetchers/raw-query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"raw-query.d.ts","sourceRoot":"","sources":["../../../src/fetchers/raw-query.ts"],"names":[],"mappings":"AA6BA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,WAC1B,OAAO,MAAM,EAAE,OAAO,CAAC,SACxB,MAAM,eACA,MAAM,EAAE,KACpB,MA6IF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,UAC/B,MAAM;wBACU,MAAM;iBAAe,MAAM,EAAE;CAoCrD,CAAA"}
+{"version":3,"file":"raw-query.d.ts","sourceRoot":"","sources":["../../../src/fetchers/raw-query.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE;QACX,YAAY,EAAE,OAAO,CAAA;QACrB,YAAY,EAAE,MAAM,EAAE,CAAA;QACtB,oBAAoB,CAAC,EAAE,OAAO,CAAA;QAC9B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;KAClC,GAAG,IAAI,CAAA;IACR,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B,6HAA6H;IAC7H,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8FAA8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAoCD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,WAC1B,OAAO,MAAM,EAAE,OAAO,CAAC,SACxB,MAAM,eACA,MAAM,EAAE,WACb,mBAAmB,KAC1B,MA+NF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,UAC/B,MAAM;wBACU,MAAM;iBAAe,MAAM,EAAE;CAoCrD,CAAA"}

package/dist/esm/fetchers/raw-query.js

@@ -7,9 +7,16 @@ var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
     }
     return to.concat(ar || Array.prototype.slice.call(from));
 };
-import { SessionCookieResolver } from '@teleporthq/teleport-shared';
+import { DataExposure, SessionCookieResolver, TableAccess } from '@teleporthq/teleport-shared';
 import { replaceSecretReference } from '../utils';
 import { PG_CLIENT_IMPORT } from './pg-client-import';
+/** The longest value a request may bind into the statement (a route param). */
+var MAX_REQUEST_PARAM_LENGTH = 256;
+/** The largest row count the baked statement asks for itself (`LIMIT n` at its end), or 0. */
+var statementLimit = function (query) {
+    var match = /\blimit\s+(\d+)\s*(?:offset\s+\d+\s*)?;?\s*$/i.exec(query);
+    return match ? parseInt(match[1], 10) : 0;
+};
 var FORBIDDEN_KEYWORDS = ['CREATE', 'ALTER', 'DROP', 'TRUNCATE', 'RENAME', 'GRANT', 'REVOKE'];
 /** The param a `{{Current User.<field>}}` token becomes: `currentUser` + the field, capitalised. */
 var CURRENT_USER_PARAM_PREFIX = 'currentUser';
@@ -36,21 +43,44 @@ var currentUserField = function (param) {
  * @param query - Raw SQL query string with {{Current User.*}} patterns already replaced to $N placeholders
  * @param paramFields - Array of query param field names that map to $1, $2, etc. in order
  */
-export var generateRawQueryFetcher = function (config, query, paramFields) {
+export var generateRawQueryFetcher = function (config, query, paramFields, access) {
     var _a, _b, _c, _d;
+    if (access === void 0) { access = {}; }
     var pgConfig = config;
     var userParams = paramFields.filter(isCurrentUserParam);
     var requestParams = paramFields.filter(function (param) { return !isCurrentUserParam(param); });
+    var pageAccess = access.pageAccess || null;
+    var rowCap = Math.max(DataExposure.BROWSER_READ_MAX_LIMIT, statementLimit(query));
     var paramDestructure = __spreadArray([
-        requestParams.length > 0 ? "const { ".concat(requestParams.join(', '), " } = req.query") : '',
+        requestParams.length > 0
+            ? "const { ".concat(requestParams
+                .map(function (param) { return "".concat(param, ": __raw_").concat(param); })
+                .join(', '), " } = req.query\n    ").concat(requestParams
+                .map(function (param) { return "const ".concat(param, " = requestParam(__raw_").concat(param, ")"); })
+                .join('\n    '))
+            : '',
         userParams.length > 0 ? 'const __sessionUser = await sessionUser(req)' : ''
     ], userParams.map(function (param) {
         return "const ".concat(param, " = sessionUserField(__sessionUser, ").concat(JSON.stringify(currentUserField(param)), ")");
     }), true).filter(Boolean)
         .join('\n    ');
-    var sessionHelpers = userParams.length > 0
-        ? "".concat(SessionCookieResolver.generateCommonJsSessionTokenResolverCode(), "\n// The signed-in user this request's session names, or null.\nasync function sessionUser(req) {\n  try {\n    return await __tqSessionToken(req)\n  } catch (e) {\n    return null\n  }\n}\n\n// One field of that user, as the session carries it (the token is seeded from\n// the users row), or undefined. The id is the token's subject when not copied.\nfunction sessionUserField(user, field) {\n  if (!user) return undefined\n  var value = field === 'id' && user.id == null ? user.sub : user[field]\n  return value == null || value === '' ? undefined : value\n}\n")
-        : '';
+    // Every route carries the session resolver and the table-access helpers: the
+    // page's protection, the protected tables and the credential columns are
+    // checked here as on every other read route.
+    // The route lives in pages/api/page-state/ or pages/api/global-state/: three folders below the root.
+    var projectRoot = access.projectRoot || '../../..';
+    var sessionHelpers = "".concat(SessionCookieResolver.generateCommonJsSessionTokenResolverCode(projectRoot, {
+        withRevocation: access.withRevocation !== false,
+    }), "\n").concat(TableAccess.generateTableAccessHelperCode({
+        trustedReaderRoles: access.trustedReaderRoles || [],
+        projectRoot: projectRoot,
+    }), "\n// The signed-in user this request's session names, or null.\nasync function sessionUser(req) {\n  try {\n    return await __tqSessionToken(req)\n  } catch (e) {\n    return null\n  }\n}\n\n// One field of that user, as the session carries it (the token is seeded from\n// the users row), or undefined. The id is the token's subject when not copied.\nfunction sessionUserField(user, field) {\n  if (!user) return undefined\n  var value = field === 'id' && user.id == null ? user.sub : user[field]\n  return value == null || value === '' ? undefined : value\n}\n\n// A value the request binds into the statement (a details page's route param):\n// one short string, never a list or an object.\nfunction requestParam(value) {\n  if (Array.isArray(value)) value = value[0]\n  if (value === undefined || value === null) return undefined\n  var text = String(value)\n  return text.length > 0 && text.length <= ").concat(MAX_REQUEST_PARAM_LENGTH, " ? text : undefined\n}\n\n// Who may run this route's statement: the visitors the page it serves admits\n// (PAGE_ACCESS, null for every visitor), and \u2014 when the statement reads a\n// protected table \u2014 only the app's own server code, a trusted role, or a\n// session the statement itself is scoped to (a {{Current User.*}} value bound\n// from that session above). null when the request may proceed.\nvar PAGE_ACCESS = ").concat(JSON.stringify(pageAccess
+        ? {
+            allowedRoles: pageAccess.allowedRoles || [],
+            requiresSubscription: pageAccess.requiresSubscription === true,
+            subscriptionProductIds: pageAccess.subscriptionProductIds || [],
+        }
+        : null), "\n").concat(pageAccess && pageAccess.requiresSubscription ? DataExposure.generateEntitlementCheckCode() : '', "\nvar SESSION_SCOPED = ").concat(JSON.stringify(userParams.length > 0), "\nvar ROW_CAP = ").concat(rowCap, "\n// No query waits on the database longer than this (enforced by the client:\n// a server-side statement_timeout does not survive a pooler).\nvar QUERY_TIMEOUT_MS = ").concat(DataExposure.READ_QUERY_TIMEOUT_MS, "\nasync function guardStatement(req, query) {\n  // A retired table is reached by no caller, this app's own server code included.\n  if (__taRetiredTableNamed(null, query)) return { status: 403, message: 'Forbidden' }\n  if (__taIsInternalRequest(req)) return null\n  var token = await sessionUser(req)\n  var role = token ? __taRoleOf(token) : null\n  if (PAGE_ACCESS) {\n    if (!token) return { status: 401, message: 'Unauthenticated' }\n    if (PAGE_ACCESS.allowedRoles.length > 0 && (!role || PAGE_ACCESS.allowedRoles.indexOf(role) === -1)) {\n      return { status: 403, message: 'Forbidden' }\n    }\n    // A subscriber-only page: its states too need the entitlement.\n    if (PAGE_ACCESS.requiresSubscription && !(await __dxEntitled(token, PAGE_ACCESS.subscriptionProductIds))) {\n      return { status: 403, message: 'Forbidden' }\n    }\n  }\n  if (__taProtectedTablesRead(null, query).length === 0) return null\n  if (role && __TA_TRUSTED_READER_ROLES.indexOf(role) !== -1) return null\n  // Scoped to the session's own value: without a session the statement never\n  // runs (no value to bind), and the request is answered with no rows.\n  if (SESSION_SCOPED) return null\n  return token ? { status: 403, message: 'Forbidden' } : { status: 401, message: 'Unauthenticated' }\n}\n");
     var paramValidation = paramFields.length > 0
         ? "\n    if (".concat(paramFields.map(function (f) { return "!".concat(f); }).join(' || '), ") {\n      return res.status(200).json({ success: true, data: [], timestamp: Date.now() })\n    }")
         : '';
@@ -62,9 +92,9 @@ export var generateRawQueryFetcher = function (config, query, paramFields) {
                 ? "{\n      ".concat(pgConfig.sslConfig.ca ? "ca: ".concat(replaceSecretReference(pgConfig.sslConfig.ca), ",") : '', "\n      ").concat(pgConfig.sslConfig.cert ? "cert: ".concat(replaceSecretReference(pgConfig.sslConfig.cert), ",") : '', "\n      ").concat(pgConfig.sslConfig.key ? "key: ".concat(replaceSecretReference(pgConfig.sslConfig.key), ",") : '', "\n      rejectUnauthorized: false\n    }")
                 : '{ rejectUnauthorized: false }'
             : 'false';
-    return "".concat(PG_CLIENT_IMPORT, "\n\nconst FORBIDDEN_KEYWORDS = ").concat(JSON.stringify(FORBIDDEN_KEYWORDS), "\n").concat(sessionHelpers, "\nconst getClient = () => {\n  const connStr = process.env.TELEPORT_DB_CONNECTION_STRING\n  if (connStr) {\n    const sslEnv = process.env.TELEPORT_DB_SSL\n    const sslOpt = sslEnv === 'false' ? false : sslEnv === 'true' ? { rejectUnauthorized: false } : undefined\n    return new Client(Object.assign({ connectionString: connStr }, sslOpt !== undefined ? { ssl: sslOpt } : {}))\n  }\n  return new Client({\n    host: process.env.TELEPORT_DB_HOST || ").concat(JSON.stringify((_a = pgConfig.host) !== null && _a !== void 0 ? _a : null), ",\n    port: parseInt(process.env.TELEPORT_DB_PORT || '").concat(pgConfig.port || 5432, "', 10),\n    user: process.env.TELEPORT_DB_USER || ").concat(JSON.stringify((_c = (_b = pgConfig.user) !== null && _b !== void 0 ? _b : pgConfig.username) !== null && _c !== void 0 ? _c : null), ",\n    password: process.env.TELEPORT_DB_PASSWORD || ").concat(replaceSecretReference(pgConfig.password) !== 'undefined'
+    return "".concat(PG_CLIENT_IMPORT, "\n\nconst FORBIDDEN_KEYWORDS = ").concat(JSON.stringify(FORBIDDEN_KEYWORDS), "\n").concat(sessionHelpers, "\nconst getClient = () => {\n  const connStr = process.env.TELEPORT_DB_CONNECTION_STRING\n  if (connStr) {\n    const sslEnv = process.env.TELEPORT_DB_SSL\n    const sslOpt = sslEnv === 'false' ? false : sslEnv === 'true' ? { rejectUnauthorized: false } : undefined\n    return new Client(Object.assign({ connectionString: connStr, query_timeout: QUERY_TIMEOUT_MS }, sslOpt !== undefined ? { ssl: sslOpt } : {}))\n  }\n  return new Client({\n    query_timeout: QUERY_TIMEOUT_MS,\n    host: process.env.TELEPORT_DB_HOST || ").concat(JSON.stringify((_a = pgConfig.host) !== null && _a !== void 0 ? _a : null), ",\n    port: parseInt(process.env.TELEPORT_DB_PORT || '").concat(pgConfig.port || 5432, "', 10),\n    user: process.env.TELEPORT_DB_USER || ").concat(JSON.stringify((_c = (_b = pgConfig.user) !== null && _b !== void 0 ? _b : pgConfig.username) !== null && _c !== void 0 ? _c : null), ",\n    password: process.env.TELEPORT_DB_PASSWORD || ").concat(replaceSecretReference(pgConfig.password) !== 'undefined'
         ? replaceSecretReference(pgConfig.password)
-        : 'null', ",\n    database: process.env.TELEPORT_DB_NAME || ").concat(JSON.stringify((_d = pgConfig.database) !== null && _d !== void 0 ? _d : null), ",\n    ssl: ").concat(sslValue, "\n  })\n}\n\nconst validateQuery = (query) => {\n  const trimmed = query.trim().toUpperCase()\n  for (const keyword of FORBIDDEN_KEYWORDS) {\n    if (trimmed.startsWith(keyword)) {\n      return false\n    }\n  }\n  return true\n}\n\nexport default async function handler(req, res) {\n  try {\n    ").concat(paramDestructure, "\n    ").concat(paramValidation, "\n\n    const query = ").concat(JSON.stringify(query), "\n\n    if (!validateQuery(query)) {\n      return res.status(400).json({\n        success: false,\n        error: 'Only SELECT queries are allowed',\n        timestamp: Date.now()\n      })\n    }\n\n    const client = getClient()\n    await client.connect()\n\n    try {\n      const result = await client.query(query, ").concat(paramArray, ")\n\n      return res.status(200).json({\n        success: true,\n        data: result.rows,\n        timestamp: Date.now()\n      })\n    } finally {\n      await client.end()\n    }\n  } catch (error) {\n    // A database error names tables, columns and values: server log only.\n    console.error('Raw query fetch error:', error)\n    return res.status(500).json({\n      success: false,\n      error: 'Failed to fetch data',\n      timestamp: Date.now()\n    })\n  }\n}\n");
+        : 'null', ",\n    database: process.env.TELEPORT_DB_NAME || ").concat(JSON.stringify((_d = pgConfig.database) !== null && _d !== void 0 ? _d : null), ",\n    ssl: ").concat(sslValue, "\n  })\n}\n\nconst validateQuery = (query) => {\n  const trimmed = query.trim().toUpperCase()\n  for (const keyword of FORBIDDEN_KEYWORDS) {\n    if (trimmed.startsWith(keyword)) {\n      return false\n    }\n  }\n  return true\n}\n\nexport default async function handler(req, res) {\n  try {\n    const query = ").concat(JSON.stringify(query), "\n    const __denied = await guardStatement(req, query)\n    if (__denied) {\n      return res.status(__denied.status).json({ success: false, error: __denied.message, timestamp: Date.now() })\n    }\n    ").concat(paramDestructure, "\n    ").concat(paramValidation, "\n\n    if (!validateQuery(query)) {\n      return res.status(400).json({\n        success: false,\n        error: 'Only SELECT queries are allowed',\n        timestamp: Date.now()\n      })\n    }\n\n    const client = getClient()\n    await client.connect()\n\n    try {\n      const result = await client.query(query, ").concat(paramArray, ")\n      const rows = Array.isArray(result && result.rows) ? result.rows : []\n\n      return res.status(200).json({\n        success: true,\n        // No credential column leaves in a row, and a browser gets at most\n        // ROW_CAP rows (the statement's own LIMIT when it asks for more).\n        data: __taWithoutCredentials(__taIsInternalRequest(req) ? rows : rows.slice(0, ROW_CAP), null),\n        timestamp: Date.now()\n      })\n    } finally {\n      await client.end()\n    }\n  } catch (error) {\n    // A database error names tables, columns and values: server log only,\n    // under the reference the client gets.\n    const id = Math.floor(Math.random() * 0xffffffff).toString(16)\n    console.error('Raw query fetch error (' + id + '):', error)\n    return res.status(500).json({\n      success: false,\n      error: 'Failed to fetch data',\n      id: id,\n      timestamp: Date.now()\n    })\n  }\n}\n");
 };
 /**
  * Parses a SQL query string for {{Current User.*}} template patterns.