@teleporthq/teleport-plugin-next-workflows 0.43.32 → 0.43.34

package/src/data-api-route-generator.ts

@@ -176,9 +176,26 @@ async function safeQuery(client, sql, params, mode) {
   }
 }
 
-function buildWhereClause(filters, queryParams, startIndex) {
+function isSkippableFilterValue(value) {
+  if (value === undefined || value === null) return true;
+  if (typeof value === 'string' && value.trim() === '') return true;
+  if (Array.isArray(value) && value.length === 0) return true;
+  return false;
+}
+
+function isAllSentinelFilterValue(value, filter) {
+  if (typeof value !== 'string') return false;
+  var normalized = value.trim().toLowerCase();
+  if (filter && typeof filter.treatAsAll === 'string' && filter.treatAsAll.trim().toLowerCase() === normalized) {
+    return true;
+  }
+  return normalized === 'all' || normalized === 'any' || normalized === 'everything' || normalized === '__all__';
+}
+
+function buildWhereClause(filters, queryParams, startIndex, options) {
   var conditions = [];
   var paramIndex = startIndex;
+  var skipOptionalEmpty = !!(options && options.skipOptionalEmpty);
 
   if (!filters || !Array.isArray(filters) || filters.length === 0) {
     return { clause: '', paramIndex: paramIndex };
@@ -194,6 +211,7 @@ function buildWhereClause(filters, queryParams, startIndex) {
     var operand = f.operand || f.operator || '=';
 
     if (value === undefined) continue;
+    if (skipOptionalEmpty && (isSkippableFilterValue(value) || isAllSentinelFilterValue(value, f))) continue;
 
     if (Array.isArray(value)) {
       if (value.length === 0) continue;
@@ -211,6 +229,37 @@ function buildWhereClause(filters, queryParams, startIndex) {
         conditions.push(field + ' IS NOT NULL');
       }
     } else {
+      var normalizedOperand = String(operand || '=').toLowerCase();
+      if (normalizedOperand === 'contains' || normalizedOperand === 'not_contains' || normalizedOperand === 'not-contains') {
+        if (isSkippableFilterValue(value)) {
+          conditions.push('FALSE');
+          continue;
+        }
+        conditions.push(field + (normalizedOperand === 'contains' ? ' ILIKE ' : ' NOT ILIKE ') + '$' + paramIndex);
+        queryParams.push('%' + String(value) + '%');
+        paramIndex++;
+        continue;
+      }
+      if (normalizedOperand === 'startswith' || normalizedOperand === 'starts_with' || normalizedOperand === 'starts-with') {
+        if (isSkippableFilterValue(value)) {
+          conditions.push('FALSE');
+          continue;
+        }
+        conditions.push(field + ' ILIKE $' + paramIndex);
+        queryParams.push(String(value) + '%');
+        paramIndex++;
+        continue;
+      }
+      if (normalizedOperand === 'endswith' || normalizedOperand === 'ends_with' || normalizedOperand === 'ends-with') {
+        if (isSkippableFilterValue(value)) {
+          conditions.push('FALSE');
+          continue;
+        }
+        conditions.push(field + ' ILIKE $' + paramIndex);
+        queryParams.push('%' + String(value));
+        paramIndex++;
+        continue;
+      }
       var validOps = ['=', '!=', '>', '<', '>=', '<=', 'LIKE', 'ILIKE'];
       var sqlOp = validOps.indexOf(operand) !== -1 ? operand : '=';
       conditions.push(field + ' ' + sqlOp + ' $' + paramIndex);
@@ -253,7 +302,7 @@ async function handleSelect(client, body) {
   var cols = selectedColumns.length > 0 ? selectedColumns.join(', ') : '*';
   var sql = 'SELECT ' + cols + ' FROM ' + tableName;
 
-  var where = buildWhereClause(filters, queryParams, 1);
+  var where = buildWhereClause(filters, queryParams, 1, { skipOptionalEmpty: true });
   sql += where.clause;
 
   if (sorts.length > 0) {
@@ -278,7 +327,11 @@ async function handleSelect(client, body) {
     // Validate the raw user-provided query for forbidden operations
     assertQuerySafe(rawQueryUserPart);
     sql = rawQueryUserPart;
-    queryParams = [];
+    // SECURITY: the raw override fully replaces the assembled SELECT, so bind the
+    // security net's $N params for it, never inline text. rawQueryUserPartParams
+    // carries the workflow values (already resolved by the executor) that back the
+    // $1, $2, … placeholders the net emitted into rawQueryUserPart.
+    queryParams = Array.isArray(body.rawQueryUserPartParams) ? body.rawQueryUserPartParams : [];
   }
 
   // Final validation of the assembled query
@@ -289,7 +342,7 @@ async function handleSelect(client, body) {
 
   var countSql = 'SELECT COUNT(*) FROM ' + tableName;
   var countParams = [];
-  var countWhere = buildWhereClause(filters, countParams, 1);
+  var countWhere = buildWhereClause(filters, countParams, 1, { skipOptionalEmpty: true });
   countSql += countWhere.clause;
   var countResult = await safeQuery(client, countSql, countParams, 'count');
   var count = parseInt(countResult.rows[0].count, 10);
@@ -306,7 +359,7 @@ async function handleCount(client, body) {
 
   var queryParams = [];
   var sql = 'SELECT COUNT(*) FROM ' + tableName;
-  var where = buildWhereClause(filters, queryParams, 1);
+  var where = buildWhereClause(filters, queryParams, 1, { skipOptionalEmpty: true });
   sql += where.clause;
 
   var result = await safeQuery(client, sql, queryParams, 'count');
@@ -340,8 +393,31 @@ function splitCommaOrPgArrayString(val) {
   return s.split(',').map(function(x) { return x.trim(); }).filter(Boolean);
 }
 
+// HTML checkbox convention: a checked box submits a truthy string value
+// ('on' by default, or the input's own value attribute); an UNCHECKED box
+// is omitted from FormData entirely, which general-extract-form-data (the
+// client-side node that builds the workflow payload) represents as '' /
+// undefined - never false. Without this branch that '' fell through to
+// the generic empty-string-to-null guard below and was written as SQL
+// NULL instead of false: a silent "not featured" -> NULL data corruption
+// in the common case (breaks any WHERE is_featured = true/false filter,
+// since NULL fails three-valued-logic equality), and a hard 23502
+// not-null-violation whenever the boolean column itself is NOT NULL - the
+// exact "update failed" error reported for an unchecked "feature this item"
+// checkbox. "Not submitted" always means unchecked/false for an HTML
+// checkbox, so this mapping is unambiguous and safe for every boolean
+// column, not just one page's flag.
+var BOOLEAN_TRUE_STRINGS = { 'on': 1, 'true': 1, '1': 1 };
+
 function coerceValueForPgColumn(col, val, colTypes) {
   var dt = colTypes[col];
+  if (dt === 'boolean') {
+    if (typeof val === 'boolean') return val;
+    if (val === undefined || val === null) return false;
+    if (typeof val === 'number') return val !== 0;
+    if (typeof val === 'string') return !!BOOLEAN_TRUE_STRINGS[val.trim().toLowerCase()];
+    return false;
+  }
   if (dt !== 'ARRAY') return val;
   if (val == null) return val;
   if (Array.isArray(val)) return val;
@@ -670,6 +746,16 @@ async function handleRawQuery(client, body, req) {
     return { rows: [], error: 'No query provided' };
   }
 
+  // SECURITY: bind the workflow's context/state values as POSITIONAL parameters
+  // ($1, $2, …) instead of interpolating them into the SQL text. The generation
+  // net rewrites every {{state.X}}/{{Current User.id}}/… value interpolation into
+  // a $N placeholder and moves the {{…}} token into this sibling params array; the
+  // executor resolves those tokens to concrete values before POSTing, so here they
+  // arrive as plain bound values. A bound value can never terminate a string literal
+  // or alter query structure — SQL injection is impossible for the value class.
+  // Legacy raw queries carry no params array and run unparameterized (backward-compat).
+  var params = Array.isArray(body.params) ? body.params : [];
+
   // Validate the raw query for forbidden operations before execution
   assertQuerySafe(query);
 
@@ -677,7 +763,7 @@ async function handleRawQuery(client, body, req) {
     await ensurePgVector(client);
   }
 
-  var result = await safeQuery(client, query, [], 'raw-query');
+  var result = await safeQuery(client, query, params, 'raw-query');
   var rows = Array.isArray(result.rows) ? result.rows : [];
 
   // Auto-fire the low-stock alert when the workflow runs the post-

package/src/executor-generator.ts

@@ -294,6 +294,37 @@ function finalizeResolvedConfig(nodeType, config) {
     }
   }
   walk(config, false);
+
+  // BACKSTOP: a data-node FILTER value that STILL holds a literal {{…}} token
+  // after resolution is an unresolvable template — a JS expression, an embedded
+  // token, or an unknown root the runtime never substitutes (run d9a24741:
+  // "{{state.filterDateEnd || '2099-12-31'}} 23:59:59" and
+  // "{{Current Page Entity.guest_id}}"). Left alone it reaches SQL as literal
+  // text and breaks the query. For a READ (data-select / data-count) DROP the
+  // clause — the optional-filter idiom degrades to "no filter" (more rows, never
+  // a crash). For a WRITE the filter scopes the mutation, so an unscoped/partial
+  // filter is unsafe → surface a validation error (same posture as the
+  // route-param sentinel above).
+  if (isDataNode && config && Array.isArray(config.filters)) {
+    var isReadNode = nodeType === 'data-select' || nodeType === 'data-count';
+    var keptFilters = [];
+    for (var fi = 0; fi < config.filters.length; fi++) {
+      var filt = config.filters[fi];
+      var fval = filt && typeof filt === 'object'
+        ? (filt.value !== undefined ? filt.value : filt.destination)
+        : undefined;
+      if (typeof fval === 'string' && /\\{\\{[\\s\\S]*?\\}\\}/.test(fval)) {
+        if (!isReadNode && !error) {
+          var fcol = (filt && (filt.column || filt.field || filt.source)) || 'filter';
+          error = 'Filter on "' + fcol + '" carries an unresolved template ({{…}}) and cannot safely scope this write';
+        }
+        continue; // drop the unresolvable clause
+      }
+      keptFilters.push(filt);
+    }
+    config.filters = keptFilters;
+  }
+
   return error;
 }
 

package/src/nodes/data/data-delete-item.ts

@@ -29,7 +29,13 @@ async function data_delete_item(config: any, context: any) {
             '" needs a page route param not available here; nothing deleted (workflow continues)'
         )
       }
-      return { deletedId: null, success: true, deletedCount: 0, __skippedUnavailableFilter: true }
+      return {
+        deletedId: null,
+        success: true,
+        deletedCount: 0,
+        affected: 0,
+        __skippedUnavailableFilter: true,
+      }
     }
   }
 
@@ -52,16 +58,21 @@ async function data_delete_item(config: any, context: any) {
         deletedId: null,
         success: false,
         deletedCount: 0,
+        affected: 0,
         error: data.error || 'Delete item failed',
       }
     }
+    // `affected` mirrors `deletedCount` so a success gate authored against either
+    // synonym resolves (the AI schema historically advertised `affected`).
+    const __deleted = data.deletedCount || 0
     return {
       deletedId: data.deletedId || null,
-      success: (data.deletedCount || 0) > 0,
-      deletedCount: data.deletedCount || 0,
+      success: __deleted > 0,
+      deletedCount: __deleted,
+      affected: __deleted,
     }
   } catch (err: unknown) {
-    return { deletedId: null, success: false, error: (err as Error).message }
+    return { deletedId: null, success: false, affected: 0, error: (err as Error).message }
   }
 }
 export const dataDeleteItem: NodeHandlerGenerator = {

package/src/nodes/data/data-raw-query.ts

@@ -3,13 +3,19 @@ import { NodeHandlerGenerator, handlerToString } from '../types'
 async function data_raw_query(config: any, context: any) {
   const dataSourceId = config.dataSourceId
   const query = config.query
+  // SECURITY: values that back the query's $N placeholders ride here as bound
+  // params, never interpolated into the SQL text. The generation net stored each
+  // as a {{…}} token; resolveConfig has already substituted them to concrete
+  // values by the time this handler runs. Empty/absent when the query is a static
+  // literal (backward-compat: the API route then runs it unparameterized).
+  const params = Array.isArray(config.params) ? config.params : []
   const baseUrl = (context && context.__baseUrl) || ''
 
   try {
     const response = await fetch(baseUrl + '/api/data/' + dataSourceId + '/raw-query', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ query }),
+      body: JSON.stringify({ query, params }),
     })
 
     const data = await response.json()

package/src/nodes/data/data-select.ts

@@ -9,8 +9,50 @@ async function data_select(config: any, context: any) {
   const limit = config.limit
   const skip = config.skip
   const rawQueryUserPart = config.rawQueryUserPart
+  // SECURITY: bound values that back the raw override's $N placeholders. The
+  // generation net emitted them alongside rawQueryUserPart; resolveConfig has
+  // already substituted the {{…}} tokens to concrete values here.
+  const rawQueryUserPartParams = Array.isArray(config.rawQueryUserPartParams)
+    ? config.rawQueryUserPartParams
+    : []
   const baseUrl = (context && context.__baseUrl) || ''
 
+  function isEmptyFilterValue(value: any) {
+    if (value === undefined || value === null) return true
+    if (typeof value === 'string' && value.trim() === '') return true
+    if (Array.isArray(value) && value.length === 0) return true
+    return false
+  }
+
+  function isAllSentinel(value: any, filter: any) {
+    if (typeof value !== 'string') return false
+    const normalized = value.trim().toLowerCase()
+    const configured = filter && filter.treatAsAll
+    if (typeof configured === 'string' && configured.trim().toLowerCase() === normalized) {
+      return true
+    }
+    return (
+      normalized === 'all' ||
+      normalized === 'any' ||
+      normalized === 'everything' ||
+      normalized === '__all__'
+    )
+  }
+
+  function shouldSkipOptionalFilter(filter: any) {
+    if (!filter) return true
+    const value = filter.destination !== undefined ? filter.destination : filter.value
+    if (isEmptyFilterValue(value)) return true
+    if (isAllSentinel(value, filter)) return true
+    if (Array.isArray(filter.skipIfValue) && filter.skipIfValue.indexOf(value) !== -1) return true
+    if (filter.skipIfEmpty === true && isEmptyFilterValue(value)) return true
+    return false
+  }
+
+  const effectiveFilters = filters.filter(function (filter: any) {
+    return !shouldSkipOptionalFilter(filter)
+  })
+
   // A filter whose value is the unresolved route-param sentinel (see
   // resolveTemplateTokenString in runtime-utils) — e.g. a select scoped to
   // {{Current Page Entity.id}} that runs on a page with no such route param
@@ -19,8 +61,8 @@ async function data_select(config: any, context: any) {
   // WHOLE workflow (a single unresolvable filter must never kill the note-create
   // submit). Never fall through to an unscoped query. Observable via the warn +
   // the __skippedUnavailableFilter marker.
-  for (let __fi = 0; __fi < filters.length; __fi++) {
-    const __f: any = filters[__fi]
+  for (let __fi = 0; __fi < effectiveFilters.length; __fi++) {
+    const __f: any = effectiveFilters[__fi]
     if (
       __f &&
       (__f.value === '__TQ_UNRESOLVED_ROUTE_PARAM__' ||
@@ -39,7 +81,7 @@ async function data_select(config: any, context: any) {
   }
 
   try {
-    const payload: any = { tableName, filters, sorts, selectedColumns }
+    const payload: any = { tableName, filters: effectiveFilters, sorts, selectedColumns }
     if (limit !== undefined && limit !== null) {
       payload.limit = limit
     }
@@ -48,6 +90,9 @@ async function data_select(config: any, context: any) {
     }
     if (rawQueryUserPart) {
       payload.rawQueryUserPart = rawQueryUserPart
+      if (rawQueryUserPartParams.length > 0) {
+        payload.rawQueryUserPartParams = rawQueryUserPartParams
+      }
     }
 
     const response = await fetch(baseUrl + '/api/data/' + dataSourceId + '/select', {

package/src/nodes/data/data-update-item.ts

@@ -30,7 +30,13 @@ async function data_update_item(config: any, context: any) {
             '" needs a page route param not available here; no rows updated (workflow continues)'
         )
       }
-      return { id: null, updatedCount: 0, success: true, __skippedUnavailableFilter: true }
+      return {
+        id: null,
+        updatedCount: 0,
+        affected: 0,
+        success: true,
+        __skippedUnavailableFilter: true,
+      }
     }
   }
   if (Array.isArray(columnMappings)) {
@@ -49,6 +55,43 @@ async function data_update_item(config: any, context: any) {
     }
   }
 
+  // A columnMapping whose resolved value is `undefined` means its binding never
+  // produced a value: an unread page-entity column, or (most commonly) an empty
+  // form field that general-extract-form-data omits by default. Sending it would
+  // write NULL and break a NOT NULL column — run d9a24741 blanked
+  // guests.full_name from an un-prefilled guest_name input. OMIT such mappings so
+  // the column keeps its stored value. (An intentional null — e.g. a route-param
+  // sentinel degraded above — is preserved: only `undefined` is dropped.)
+  let effectiveColumnMappings: any = columnMappings
+  if (Array.isArray(columnMappings)) {
+    effectiveColumnMappings = columnMappings.filter(function (__m: any) {
+      return !(__m && typeof __m === 'object' && __m.value === undefined)
+    })
+  } else if (columnMappings && typeof columnMappings === 'object') {
+    effectiveColumnMappings = {}
+    const __ck = Object.keys(columnMappings)
+    for (let __ci = 0; __ci < __ck.length; __ci++) {
+      if ((columnMappings as any)[__ck[__ci]] !== undefined) {
+        ;(effectiveColumnMappings as any)[__ck[__ci]] = (columnMappings as any)[__ck[__ci]]
+      }
+    }
+  }
+  const __hasWrites = Array.isArray(effectiveColumnMappings)
+    ? effectiveColumnMappings.length > 0
+    : !!effectiveColumnMappings && Object.keys(effectiveColumnMappings).length > 0
+  if (!__hasWrites) {
+    // Nothing resolvable to write — never send an empty UPDATE (the DB would
+    // reject it / touch nothing). Report a clean zero-row no-op so a downstream
+    // updatedCount/affected gate takes its "no change" branch.
+    return {
+      id: null,
+      updatedCount: 0,
+      affected: 0,
+      success: true,
+      __skippedEmptyUpdate: true,
+    }
+  }
+
   // Same anonymous-user hint as data-create-item — a workflow that
   // updates a row written by a guest must be able to re-stamp its
   // ownership column with the same anon UUID rather than NULL.
@@ -72,7 +115,12 @@ async function data_update_item(config: any, context: any) {
   }
 
   try {
-    const reqBody: any = { tableName, filters, columnMappings, returnUpdated: true }
+    const reqBody: any = {
+      tableName,
+      filters,
+      columnMappings: effectiveColumnMappings,
+      returnUpdated: true,
+    }
     if (__anonymousUserId) {
       reqBody.__anonymousUserId = __anonymousUserId
     }
@@ -90,11 +138,20 @@ async function data_update_item(config: any, context: any) {
     const data = await response.json()
 
     if (!response.ok) {
-      return { id: null, updatedCount: 0, error: data.error || 'Update item failed' }
+      return { id: null, updatedCount: 0, affected: 0, error: data.error || 'Update item failed' }
+    }
+    // `affected` mirrors `updatedCount` — a success gate authored against either
+    // synonym (the AI schema historically advertised `affected`) must resolve.
+    // Placed after the row spread so it can't be shadowed by a table column.
+    const __updated = data.updatedCount || 0
+    return {
+      id: data.id || null,
+      ...(data.item || {}),
+      updatedCount: __updated,
+      affected: __updated,
     }
-    return { id: data.id || null, ...(data.item || {}), updatedCount: data.updatedCount || 0 }
   } catch (err: unknown) {
-    return { id: null, updatedCount: 0, error: (err as Error).message }
+    return { id: null, updatedCount: 0, affected: 0, error: (err as Error).message }
   }
 }
 export const dataUpdateItem: NodeHandlerGenerator = {

package/src/nodes/general/general-extract-form-data.ts

@@ -97,11 +97,47 @@ async function general_extract_form_data(config: any, context: Record<string, un
     }
 
     const fieldKeys = Object.keys(fields)
-    const result: Record<string, any> = { fields }
+    const result: Record<string, any> = { fields, formData: fields }
     for (let fi = 0; fi < fieldKeys.length; fi++) {
       result[fieldKeys[fi]] = fields[fieldKeys[fi]]
     }
 
+    // Workflows generated/imported from HTML often refer to a form control by
+    // its DOM id (`class-session-select`) while FormData exposes submitted
+    // values by name (`class_session_id`). Preserve the canonical name keys
+    // above, and add non-overwriting aliases for id/data-form-field-id so both
+    // conventions resolve to the same submitted value.
+    try {
+      const addAlias = (alias: string | null | undefined, name: string | undefined) => {
+        if (!alias || !name) return
+        if (fields[name] === undefined) return
+        if (result[alias] === undefined) {
+          result[alias] = fields[name]
+        }
+      }
+      const controls = (formEl as HTMLFormElement).querySelectorAll(
+        'input[name], select[name], textarea[name], button[name]'
+      )
+      for (let ci = 0; ci < controls.length; ci++) {
+        const control = controls[ci] as HTMLInputElement
+        addAlias(control.id, control.name)
+        addAlias(control.getAttribute('data-form-field-id'), control.name)
+      }
+      const outsideControls = document.querySelectorAll(
+        'input[name], select[name], textarea[name], button[name]'
+      )
+      for (let oi = 0; oi < outsideControls.length; oi++) {
+        const control = outsideControls[oi] as HTMLInputElement
+        if (formEl.contains(control)) continue
+        const ownerForm = control.closest('form')
+        if (ownerForm && ownerForm !== formEl) continue
+        addAlias(control.id, control.name)
+        addAlias(control.getAttribute('data-form-field-id'), control.name)
+      }
+    } catch (_aliasErr) {
+      /* aliases are best-effort; canonical name-based fields remain intact */
+    }
+
     // Diagnostic: surface any required inputs whose value is empty at extraction
     // time so downstream custom-JS validators have something concrete to report
     // instead of a generic "please fill in all required fields" message.

package/src/segment-splitter.ts

@@ -279,6 +279,55 @@ const enforceLoopBodyIntegrity = (
   return { reorderedOrder: working, forcedEnvByNodeId }
 }
 
+/**
+ * Resolve a node's intrinsic execution env using the exact same rules the
+ * segment walk applies, without any surrounding-segment context. Used by the
+ * client-config redactor to classify nodes that never land in a segment (e.g.
+ * error-handler branch nodes). Unknown/universal nodes resolve to 'client',
+ * the conservative default (their config is kept).
+ */
+export const resolveNodeExecutionEnv = (node: UIDLWorkflowNode): WorkflowExecutionEnv =>
+  resolveExecutionEnv(node, null)
+
+// The ONLY field of a server node's config the CLIENT executor ever reads is
+// the AI-streaming flag (findStreamingAINodes / callStreamingServerSegment in
+// executor-generator). Everything else — the raw SQL query, filters, table
+// name, bound params, column mappings, data source id, … — is consumed
+// exclusively inside the server API route (see api-route-generator's
+// SEGMENT_CONFIG, which keeps the full config server-side). None of it may
+// reach the browser bundle.
+export const CLIENT_SAFE_SERVER_CONFIG_KEYS: ReadonlyArray<string> = ['streaming']
+
+/**
+ * Strip a server node's config down to the client-safe whitelist before it is
+ * serialized into any bundle that ships to the browser (the page-level
+ * `__wfConfig_*` constants and the shared custom-nodes file).
+ *
+ * Safety: a server segment executes entirely inside its own API route, and the
+ * generated client node-handler file omits every server node type (see
+ * NextWorkflowProjectPlugin.generateNodeHandlerFile), so the browser has no
+ * handler to execute a server node with — it only needs a server node's
+ * { id, type, stepNumber, edges } for branch-skip bookkeeping plus
+ * `config.streaming` for streaming detection. Dropping the rest can therefore
+ * only remove data the client never acts on. Client and universal node configs
+ * are returned untouched.
+ */
+export const redactServerNodeConfig = (
+  config: Record<string, unknown>,
+  env: WorkflowExecutionEnv
+): Record<string, unknown> => {
+  if (env !== 'server' || !config || typeof config !== 'object') {
+    return config
+  }
+  const safe: Record<string, unknown> = {}
+  for (const key of CLIENT_SAFE_SERVER_CONFIG_KEYS) {
+    if (config[key] !== undefined) {
+      safe[key] = config[key]
+    }
+  }
+  return safe
+}
+
 export const getServerSegments = (segments: WorkflowSegment[]): WorkflowSegment[] => {
   return segments.filter((s) => s.env === 'server')
 }

package/src/sql-query-validator.ts

@@ -693,6 +693,70 @@ export const validateSQLQuery = (query: string): SQLValidationResult => {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Raw-query parameterization safety
+// ---------------------------------------------------------------------------
+
+/**
+ * Matches a single `{{ … }}` workflow-context template token anywhere in a
+ * string (non-greedy to the first `}}`). A token surviving in the SQL TEXT is
+ * the SQL-injection signal — the workflow executor substitutes it TEXTUALLY
+ * into the query. Parameterized binds use `$1` / `$2` placeholders instead.
+ */
+export const RAW_QUERY_TEMPLATE_TOKEN_RE = /\{\{[\s\S]+?\}\}/
+
+export interface RawQuerySafetyWarning {
+  /** Stable id, aligned with the design-time security rule catalogue. */
+  ruleId: 'sql-unparameterized-context'
+  message: string
+}
+
+export interface RawQuerySafetyResult {
+  /** True when no `{{ … }}` token remains in the SQL text (safe / parameterized). */
+  isSafe: boolean
+  /** Informational security warnings — empty for a correctly-parameterized query. */
+  warnings: RawQuerySafetyWarning[]
+}
+
+/**
+ * Assess whether a raw-SQL string is safely PARAMETERIZED.
+ *
+ * SAFE (zero warnings): the SQL text carries only positional `$N` placeholders
+ * and every workflow-context/state value lives in the sibling `params`
+ * (`rawQueryUserPartParams`) array, bound at runtime via
+ * `client.query(sql, params)`. A bound value can never terminate a string
+ * literal or alter query structure, so injection is impossible for that class.
+ * A `{{ … }}` token appearing in the `params` array is the CORRECT, safe home
+ * for it and is intentionally NOT inspected here — only the SQL text is scanned.
+ *
+ * UNSAFE (one warning): a `{{ … }}` template token still appears in the SQL
+ * TEXT. The executor substitutes it textually, so an attacker-controlled value
+ * (e.g. a search term containing `'`) can break out and inject SQL. Post-net
+ * this should never happen — the generation-time net rewrites every value
+ * interpolation into `$N` and fails loud on anything it cannot bind — but the
+ * check stays as a runtime/publish-time backstop.
+ *
+ * @param query - The raw SQL text (e.g. `data-raw-query.query` /
+ *                `data-select.rawQueryUserPart`).
+ */
+export const analyzeRawQueryParameterization = (query: unknown): RawQuerySafetyResult => {
+  if (typeof query !== 'string' || !RAW_QUERY_TEMPLATE_TOKEN_RE.test(query)) {
+    return { isSafe: true, warnings: [] }
+  }
+  return {
+    isSafe: false,
+    warnings: [
+      {
+        ruleId: 'sql-unparameterized-context',
+        message:
+          'Raw SQL interpolates a workflow context value with `{{...}}` directly into the ' +
+          'query text. If that value is influenced by external input it could be used for ' +
+          'SQL injection. Bind the value via the query parameter list (e.g. `$1`) instead.',
+      },
+    ],
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Context value risk assessment
 // ---------------------------------------------------------------------------