@xpert-ai/plugin-sdk 3.18.6 → 3.19.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @xpert-ai/plugin-sdk
 
+## 3.19.0
+
+### Minor Changes
+
+- 99d09ec: Release a coordinated minor update across all Xpert workspace packages, including the API, Web and Bosi applications, shared SDK and contracts, backend and UI libraries, bundled plugins, sandbox runtimes and documentation.
+
+### Patch Changes
+
+- 8a78318: Add explicit application Project types, provider-backed domain bindings, and typed Project provisioning/access contracts. App plugins using ProjectTypeProvider require these releases (3.19.0 or newer) and the matching host Project type endpoints/schema migration.
+- Updated dependencies [8a78318]
+- Updated dependencies [1e44173]
+- Updated dependencies [c953822]
+- Updated dependencies [b7983c8]
+- Updated dependencies [08f66e7]
+- Updated dependencies [b62543f]
+- Updated dependencies [5f26e05]
+- Updated dependencies [99d09ec]
+  - @xpert-ai/contracts@3.19.0
+
+## 3.18.7
+
+### Patch Changes
+
+- 5213185: Expose keyword analyzer strategy interfaces, discovery metadata, and a scoped registry with exact source lookup. Add optional plugin removal preflight guards so hosts can protect active analyzer dependencies.
+
+  Correct read-only SQL classification for derived tables, CTE column declarations and type modifiers, and preserve duplicate MySQL output names with direct bounded pagination.
+
 ## 3.18.6
 
 ### Patch Changes

package/MIDDLEWARE_APPS.md

@@ -0,0 +1,71 @@
+# MCP Apps in Agent middleware
+
+An `AgentMiddleware` can return `apps` alongside `tools`. It does not need a remote
+MCP server or a published Toolset. The host renders the bundled HTML using its
+existing MCP App sandbox and RPC bridge.
+
+ChatKit accesses resources, RPC, approvals and teardown through `/api/ai/mcp-apps`,
+using the AI module's `ApiKeyOrClientSecretAuthGuard`. The ordinary management
+routes keep the platform's standard authorization. Use an SDK version whose
+`client.mcp.apps` targets this AI endpoint.
+
+```ts
+return {
+  name: 'ProjectSettings',
+  tools: [configure, readSettings, saveSettings],
+  apps: {
+    definitions: [{ key: 'settings', entry: 'dist/mcp-apps/settings.html' }],
+    tools: {
+      configure: { resourceKey: 'settings', visibility: ['model', 'app'] },
+      read_settings: { visibility: ['app'], approval: 'none' },
+      save_settings: { visibility: ['app'], approval: 'none' }
+    }
+  }
+}
+```
+
+Keys in `apps.tools` must match actual tool names. App-only tools are excluded
+from the model's tool list. `approval: 'none'` is a trusted plugin declaration for
+operations whose own services enforce scope, revision and validation. Omit it
+to retain host approval. App access never grants access to another middleware.
+For decorated providers, use `@XpertToolProvider({ apps: [...] })` and
+`@XpertTool({ middleware: true, app: { ... } })` with the same binding contract.
+
+To pause after a successful tool, configure the Assistant:
+
+```yaml
+team:
+  agentConfig:
+    interruptAfter: [configure]
+```
+
+The completed tool result is checkpointed before a separate gate calls
+LangGraph `interrupt`. Resume targets the gate, so tool side effects are not
+replayed. Ordinary tools display a Continue control; an App sends a standard
+`ui/message` after saving. The host supplies the original tool-call and execution
+identity, and ChatKit uses the existing `action: resume` protocol. No `ui/resume`
+extension is required. The App's message is added once at user priority on resume,
+so the Agent can distinguish the confirmed input from the pre-pause tool result.
+Inline images, audio and binary resources are retained in this message (25 MiB
+combined); arbitrary file paths and remote attachment URLs are rejected. ChatKit
+acknowledges continuation only after the run response supplies `Content-Location`,
+not when the local thread is resolved. Cross-origin hosts must expose that header.
+Error ToolMessages skip this gate so the Agent can repair
+the failure. Prefer calling interactive tools alone rather than mixing them with
+unrelated parallel work.
+
+The runtime re-resolves middleware bindings and enabled tools for each App RPC.
+UI teardown retains paused native form snapshots for 7 days; it does not cancel
+the Agent. Business settings must still be persisted by domain services before
+continuation. This requires the host capability `platform.middleware.mcp-apps`
+and the corresponding ChatKit continuation support; it adds no ORM dependency
+to the SDK.
+
+On hosts with schema synchronization disabled, apply
+`packages/server-ai/src/mcp-app-runtime/migrations/20260928-middleware-app-audit.sql`
+before enabling native middleware Apps. Their audit rows retain provider identity
+in `source` and leave `toolsetId` null. Interactive ChatKit user sessions are
+accepted only for their bound Assistant; existing user JWT access remains valid.
+An App produced by an external Assistant is also accessible when its persisted
+execution parent chain terminates at the session's entry Assistant in the same
+thread. Each execution remains subject to the normal access check.

package/README.md

@@ -115,6 +115,8 @@ For completed operations, `prepareToolResult(() => project(result), () => minima
 
 For a host-native MCP App, declare each static HTML bundle once in the Provider's `apps` array, then bind a Tool with `mcp.app.resourceKey` and include `app` visibility. The App key must exist in the same Provider and its entry must be a relative `.html` path inside the packaged plugin. The host publishes the bundle as a `ui://` resource; plugins must not create a stdio server or put CSP/credentials in Tool results.
 
+Agent middleware can also expose these Apps without a published Toolset. See [middleware Apps and post-tool continuation](./MIDDLEWARE_APPS.md) for `app` bindings and `interruptAfter` checkpoints.
+
 The host owns the public MCP endpoint identity. It combines the plugin's stable `artifactNamespace`, the Provider key, and an opaque scope hash; client names and product-specific identifiers do not belong in the slug. A tenant- or system-level plugin has one tenant-scoped Publication and capability snapshot, while each organization receives an independent access grant and organization-bound credential. An organization-level plugin receives a dedicated organization-scoped Publication.
 
 ## View extensions

package/data-workbench.cjs.js

@@ -8,6 +8,159 @@ const DataSourceRuntimeCapability = Object.freeze({
     __type: undefined
 });
 
+/** Mask comments and quoted content without changing source offsets. Shared by guards and pagination. */ function lexWorkbenchSql(source) {
+    if (!source.trim() || source.length > 100000 || source.includes('\0')) throw new Error('invalid_sql');
+    const masked = source.split('');
+    const quoted = new Map();
+    const hide = (start, end, kind)=>{
+        for(let i = start; i < end; i++)if (masked[i] !== '\n') masked[i] = ' ';
+        if (kind) {
+            const marker = start + 1;
+            quoted.set(marker, kind);
+            masked[marker] = kind === 'literal' ? '?' : 'i';
+        }
+    };
+    let index = 0;
+    while(index < source.length){
+        const start = index, c = source[index], next = source[index + 1];
+        if (c === '-' && next === '-' || c === '#') {
+            while(index < source.length && source[index] !== '\n')index++;
+            hide(start, index);
+            continue;
+        }
+        if (c === '/' && next === '*') {
+            if (source[index + 2] === '!') throw new Error('executable_comment_not_supported');
+            const end = source.indexOf('*/', index + 2);
+            if (end < 0) throw new Error('unterminated_comment');
+            index = end + 2;
+            hide(start, index);
+            continue;
+        }
+        if (c === "'" || c === '"' || c === '`') {
+            let closed = false;
+            index++;
+            while(index < source.length){
+                if (source[index] === '\\') throw new Error('use_parameters_for_backslash_literals');
+                if (source[index] === c) {
+                    if (source[index + 1] === c) {
+                        index += 2;
+                        continue;
+                    }
+                    index++;
+                    closed = true;
+                    break;
+                }
+                index++;
+            }
+            if (!closed) throw new Error('unterminated_literal');
+            hide(start, index, c === "'" ? 'literal' : 'identifier');
+            continue;
+        }
+        if (c === '$') {
+            var _source_slice_match;
+            const tag = (_source_slice_match = source.slice(index).match(/^\$(?:[A-Za-z_][A-Za-z_0-9]*)?\$/)) == null ? void 0 : _source_slice_match[0];
+            if (tag) {
+                const end = source.indexOf(tag, index + tag.length);
+                if (end < 0) throw new Error('unterminated_literal');
+                index = end + tag.length;
+                hide(start, index, 'literal');
+                continue;
+            }
+        }
+        index++;
+    }
+    const text = masked.join('');
+    const tokens = [
+        ...text.matchAll(/[A-Z_][A-Z_0-9]*|[0-9]+|[^\s]/gi)
+    ].map((match)=>{
+        var _quoted_get;
+        return {
+            text: match[0].toUpperCase(),
+            start: match.index,
+            end: match.index + match[0].length,
+            kind: (_quoted_get = quoted.get(match.index)) != null ? _quoted_get : /^[A-Z_]/i.test(match[0]) ? 'word' : /^[0-9]/.test(match[0]) ? 'number' : 'symbol'
+        };
+    });
+    return {
+        masked: text,
+        tokens
+    };
+}
+
+const MODIFIED_TYPES = new Set('DECIMAL NUMERIC CHAR VARCHAR NCHAR NVARCHAR BINARY VARBINARY DATETIME TIME TIMESTAMP'.split(' '));
+/** Positions where name(...) declares columns or a built-in type, rather than invoking a function. */ function sqlDeclarationPositions(tokens) {
+    const declarations = new Set();
+    const closing = new Map(), parents = new Map();
+    const stack = [];
+    tokens.forEach((token, index)=>{
+        if (stack.length) parents.set(index, stack[stack.length - 1]);
+        if (token.text === '(') stack.push(index);
+        if (token.text === ')') {
+            const open = stack.pop();
+            if (open !== undefined) closing.set(open, index);
+        }
+    });
+    const name = (index)=>{
+        var _tokens_index;
+        return [
+            'word',
+            'identifier'
+        ].includes((_tokens_index = tokens[index]) == null ? void 0 : _tokens_index.kind);
+    };
+    const is = (index, word)=>{
+        var _tokens_index;
+        return ((_tokens_index = tokens[index]) == null ? void 0 : _tokens_index.text) === word;
+    };
+    for(let i = 0; i < tokens.length; i++){
+        if (tokens[i].kind !== 'word' || !is(i, 'WITH')) continue;
+        let cursor = i + 1;
+        if (is(cursor, 'RECURSIVE')) cursor++;
+        while(name(cursor)){
+            const declaration = cursor++;
+            let columns = false;
+            if (is(cursor, '(')) {
+                const end = closing.get(cursor);
+                if (end === undefined || end === cursor + 1) break;
+                const columnTokens = tokens.slice(cursor + 1, end);
+                if (columnTokens.length % 2 === 0 || !columnTokens.every((token, n)=>n % 2 === 0 ? [
+                        'word',
+                        'identifier'
+                    ].includes(token.kind) : token.text === ',')) break;
+                columns = true;
+                cursor = end + 1;
+            }
+            if (!is(cursor++, 'AS')) break;
+            if (is(cursor, 'NOT')) cursor++;
+            if (is(cursor, 'MATERIALIZED')) cursor++;
+            if (!is(cursor, '(')) break;
+            const end = closing.get(cursor);
+            if (end === undefined) break;
+            if (columns) declarations.add(tokens[declaration].start);
+            cursor = end + 1;
+            if (!is(cursor, ',')) break;
+            cursor++;
+        }
+    }
+    tokens.forEach((token, i)=>{
+        var _tokens_;
+        if (token.kind !== 'word' || !MODIFIED_TYPES.has(token.text) || !is(i + 1, '(')) return;
+        const end = closing.get(i + 1);
+        if (end === undefined) return;
+        const args = tokens.slice(i + 2, end);
+        if (![
+            1,
+            3
+        ].includes(args.length) || !args.every((arg, n)=>n % 2 ? arg.text === ',' : arg.kind === 'number')) return;
+        const parent = parents.get(i);
+        const owner = parent === undefined ? undefined : (_tokens_ = tokens[parent - 1]) == null ? void 0 : _tokens_.text;
+        const cast = owner === 'CAST' && is(i - 1, 'AS');
+        const convert = owner === 'CONVERT' && is(i - 1, ',');
+        const postgresCast = is(i - 1, ':') && is(i - 2, ':');
+        if (cast || convert || postgresCast) declarations.add(token.start);
+    });
+    return declarations;
+}
+
 const WRITE = new Set([
     'INSERT',
     'UPDATE',
@@ -42,15 +195,16 @@ const FORBIDDEN = new Set([
     'DETACH'
 ]);
 const SAFE_FUNCTIONS = new Set('ABS ACOS ASIN ATAN ATAN2 AVG CAST CEIL CEILING COALESCE CONCAT CONCAT_WS CONVERT COS COUNT CURDATE CURRENT_DATE CURRENT_TIMESTAMP DATE DATE_ADD DATE_SUB DATE_FORMAT DATEDIFF DAY DAYOFMONTH DAYOFWEEK EXTRACT FLOOR FORMAT GREATEST GROUP_CONCAT IF IFNULL JSON_EXTRACT JSON_LENGTH JSON_UNQUOTE LEAST LEFT LENGTH LN LOG LOWER LPAD LTRIM MAX MD5 MIN MOD MONTH NOW NULLIF POWER RAND REPLACE REVERSE RIGHT ROUND ROW_NUMBER RANK DENSE_RANK LAG LEAD FIRST_VALUE LAST_VALUE LPAD RPAD RTRIM SIGN SIN SQRT STDDEV STDDEV_POP STDDEV_SAMP SUBSTR SUBSTRING SUM TAN TO_CHAR TO_DATE TO_TIMESTAMP TRIM TRUNC UPPER VAR_POP VAR_SAMP VERSION WEEK YEAR DATABASE CURRENT_DATABASE CURRENT_SCHEMA ARRAY_AGG STRING_AGG JSON_AGG JSON_BUILD_OBJECT PG_GET_VIEWDEF'.split(' '));
-const SQL_PARENS = new Set('IN AS EXISTS OVER PARTITION VALUES SELECT WITH AND OR NOT ON USING FILTER GROUPING ROLLUP CUBE DISTINCT EXPLAIN'.split(' '));
+// FROM/JOIN can introduce a parenthesized subquery, not a function call.
+const SQL_PARENS = new Set('IN AS EXISTS OVER PARTITION VALUES SELECT WITH FROM JOIN AND OR NOT ON USING FILTER GROUPING ROLLUP CUBE DISTINCT EXPLAIN'.split(' '));
 const UNSAFE_FUNCTIONS = /\b(pg_sleep|sleep|benchmark|dblink\w*|lo_\w+|pg_(?:read|write|ls|stat|terminate|cancel|reload|rotate|log|create|drop|promote|switch|backup|replication|advisory)\w*|get_lock|release_lock|load_file|nextval|setval|set_config|http\w*|s3|hdfs|jdbc|mysql|postgresql|file|url)\s*\(/i;
 function splitWorkbenchSql(source) {
-    if (!source.trim() || source.length > 100000 || source.includes('\0')) throw new Error('invalid_sql');
+    const { masked, tokens } = lexWorkbenchSql(source);
     const statements = [];
-    let start = 0, index = 0, clean = '';
+    let start = 0;
     const finish = (end)=>{
-        const text = clean.trim();
-        if (text) {
+        const text = masked.slice(start, end);
+        if (text.trim()) {
             var _text_toUpperCase_match;
             const words = (_text_toUpperCase_match = text.toUpperCase().match(/[A-Z_][A-Z_0-9]*/g)) != null ? _text_toUpperCase_match : [];
             const first = words[0];
@@ -61,10 +215,11 @@ function splitWorkbenchSql(source) {
                 if (words.some((word, index)=>WRITE.has(word) && !(first === 'SHOW' && index === 1 && word === 'CREATE') || FORBIDDEN.has(word)) || UNSAFE_FUNCTIONS.test(text) || /\bFOR\s+(UPDATE|SHARE)\b/i.test(text) || /:=|\bEXPLAIN\s+ANALYZE\b|@/i.test(text)) effect = 'unsupported';
                 // eslint-disable-next-line no-control-regex -- intentional: reject any non-ASCII/control input
                 if (/[^\x00-\x7f]/.test(text) || /\.\s*[A-Z_][A-Z_0-9]*\s*\(/i.test(text)) effect = 'unsupported';
+                const declarations = sqlDeclarationPositions(tokens.filter((token)=>token.start >= start && token.end <= end));
                 if ([
                     ...text.matchAll(/([A-Z_][A-Z_0-9]*)\s*\(/gi)
-                ].some((match)=>!SAFE_FUNCTIONS.has(match[1].toUpperCase()) && !SQL_PARENS.has(match[1].toUpperCase()))) effect = 'unsupported';
-                if (first === 'SHOW' && !/^(SHOW\s+(DATABASES|SCHEMAS|CATALOGS|TABLES|FULL\s+TABLES|COLUMNS|FULL\s+COLUMNS|INDEX|INDEXES|KEYS|CREATE\s+TABLE|CREATE\s+VIEW|PARTITIONS|VARIABLES|STATUS|GRANTS))\b/i.test(text)) effect = 'unsupported';
+                ].some((match)=>!declarations.has(start + match.index) && !SAFE_FUNCTIONS.has(match[1].toUpperCase()) && !SQL_PARENS.has(match[1].toUpperCase()))) effect = 'unsupported';
+                if (first === 'SHOW' && !/^(SHOW\s+(DATABASES|SCHEMAS|CATALOGS|TABLES|FULL\s+TABLES|COLUMNS|FULL\s+COLUMNS|INDEX|INDEXES|KEYS|CREATE\s+TABLE|CREATE\s+VIEW|PARTITIONS|VARIABLES|STATUS|GRANTS))\b/i.test(text.trim())) effect = 'unsupported';
             }
             // CREATE/ALTER routines, external resources and privileged SQL are outside this app.
             if (effect === 'write' && /\b(FUNCTION|PROCEDURE|TRIGGER|USER|ROLE|CATALOG|RESOURCE|SYSTEM|SERVER|EXTENSION|FILE|OUTFILE|DUMPFILE|EXECUTE)\b/i.test(text)) effect = 'unsupported';
@@ -74,63 +229,10 @@ function splitWorkbenchSql(source) {
                 effect
             });
         }
-        clean = '';
         start = end + 1;
     };
-    while(index < source.length){
-        const c = source[index], next = source[index + 1];
-        if (c === '-' && next === '-' || c === '#') {
-            while(index < source.length && source[index] !== '\n')index++;
-            clean += ' ';
-            continue;
-        }
-        if (c === '/' && next === '*') {
-            if (source[index + 2] === '!') throw new Error('executable_comment_not_supported');
-            const end = source.indexOf('*/', index + 2);
-            if (end < 0) throw new Error('unterminated_comment');
-            index = end + 2;
-            clean += ' ';
-            continue;
-        }
-        if (c === "'" || c === '"' || c === '`') {
-            const quote = c;
-            let closed = false;
-            index++;
-            while(index < source.length){
-                if (source[index] === '\\') throw new Error('use_parameters_for_backslash_literals');
-                if (source[index] === quote) {
-                    if (source[index + 1] === quote) {
-                        index += 2;
-                        continue;
-                    }
-                    index++;
-                    closed = true;
-                    break;
-                }
-                index++;
-            }
-            if (!closed) throw new Error('unterminated_literal');
-            clean += quote === "'" ? ' ? ' : ' identifier ';
-            continue;
-        }
-        if (c === '$') {
-            var _source_slice_match;
-            const tag = (_source_slice_match = source.slice(index).match(/^\$(?:[A-Za-z_][A-Za-z_0-9]*)?\$/)) == null ? void 0 : _source_slice_match[0];
-            if (tag) {
-                const end = source.indexOf(tag, index + tag.length);
-                if (end < 0) throw new Error('unterminated_literal');
-                index = end + tag.length;
-                clean += ' ? ';
-                continue;
-            }
-        }
-        if (c === ';') {
-            finish(index);
-            index++;
-            continue;
-        }
-        clean += c;
-        index++;
+    for (const token of tokens){
+        if (token.kind === 'symbol' && token.text === ';') finish(token.start);
     }
     finish(source.length);
     if (!statements.length || statements.length > 50) throw new Error('statement_count_exceeded');
@@ -148,6 +250,53 @@ function quoteDatabaseIdentifier(name, engine) {
     return quote + name.split(quote).join(quote + quote) + quote;
 }
 
+/** Apply a page to a MySQL result without turning its (possibly duplicate) output names into table columns. */ function paginateMysqlQuery(sql, parameters = [], limit, offset) {
+    const { tokens } = lexWorkbenchSql(sql);
+    const top = [];
+    let depth = 0;
+    for (const token of tokens){
+        if (token.text === '(') depth++;
+        if (!depth) top.push(token);
+        if (token.text === ')') depth--;
+        if (depth < 0) throw new Error('unsupported_pagination');
+    }
+    if (depth) throw new Error('unsupported_pagination');
+    const start = top.findIndex((token)=>token.kind === 'word' && token.text === 'LIMIT');
+    if (start < 0) return {
+        sql: `${sql}\nLIMIT ${limit + 1} OFFSET ${offset}`,
+        parameters
+    };
+    const clause = top.slice(start + 1);
+    const bindings = tokens.filter((token)=>token.text === '?' && token.kind === 'symbol');
+    const consumed = new Set();
+    const integer = (token)=>{
+        if ((token == null ? void 0 : token.kind) === 'number') return BigInt(token.text);
+        if ((token == null ? void 0 : token.kind) === 'symbol' && token.text === '?') {
+            const index = bindings.indexOf(token), value = parameters[index];
+            if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0) {
+                consumed.add(index);
+                return BigInt(value);
+            }
+        }
+        throw new Error('unsupported_pagination');
+    };
+    let count, skip = 0n;
+    if (clause.length === 1) count = integer(clause[0]);
+    else if (clause.length === 3 && clause[1].text === ',') {
+        skip = integer(clause[0]);
+        count = integer(clause[2]);
+    } else if (clause.length === 3 && clause[1].kind === 'word' && clause[1].text === 'OFFSET') {
+        count = integer(clause[0]);
+        skip = integer(clause[2]);
+    } else throw new Error('unsupported_pagination');
+    const remaining = count > BigInt(offset) ? count - BigInt(offset) : 0n;
+    const size = remaining < BigInt(limit + 1) ? remaining : BigInt(limit + 1);
+    return {
+        sql: `${sql.slice(0, top[start].start)}LIMIT ${size} OFFSET ${skip + BigInt(offset)}${sql.slice(clause[clause.length - 1].end)}`,
+        parameters: parameters.filter((_, index)=>!consumed.has(index))
+    };
+}
+
 const number = (value)=>Number(value != null ? value : 0);
 const string = (value)=>value == null ? '' : String(value);
 const cell = (result, row, name)=>row[result.columns.findIndex((column)=>column.name.toLowerCase() === name.toLowerCase())];
@@ -389,12 +538,14 @@ const cell = (result, row, name)=>row[result.columns.findIndex((column)=>column.
         if (input.mode === 'write' && !(await this.capabilities()).writes) throw new Error('engine_version_writes_unavailable');
         if (input.mode === 'write' && offset) throw new Error('mutation_cannot_be_paginated');
         let sql = statements[0].sql;
-        // Wrap a SELECT instead of appending LIMIT after an existing LIMIT or trailing comment.
+        let parameters = input.parameters;
         if (input.mode === 'read' && [
             'SELECT',
             'WITH'
-        ].includes(statements[0].words[0])) sql = `SELECT * FROM (\n${sql}\n) AS ${this.quote('_db_studio_page')} LIMIT ${limit + 1} OFFSET ${offset}`;
-        else if (offset) throw new Error('statement_cannot_be_paginated');
+        ].includes(statements[0].words[0])) {
+            if (this.engine === 'mysql') ({ sql, parameters } = paginateMysqlQuery(sql, parameters, limit, offset));
+            else sql = `SELECT * FROM (\n${sql}\n) AS ${this.quote('_db_studio_page')} LIMIT ${limit + 1} OFFSET ${offset}`;
+        } else if (offset) throw new Error('statement_cannot_be_paginated');
         this.busy = true;
         let readTransaction = false;
         try {
@@ -403,7 +554,7 @@ const cell = (result, row, name)=>row[result.columns.findIndex((column)=>column.
                 readTransaction = true;
             }
             var _input_timeoutMs;
-            const result = await this.raw(sql, input.parameters, limit + 1, signal, Math.max(1, Math.min((_input_timeoutMs = input.timeoutMs) != null ? _input_timeoutMs : 30000, 120000)));
+            const result = await this.raw(sql, parameters, limit + 1, signal, Math.max(1, Math.min((_input_timeoutMs = input.timeoutMs) != null ? _input_timeoutMs : 30000, 120000)));
             const hasMore = result.rows.length > limit || result.truncated;
             return _extends._extends({}, result, {
                 rows: result.rows.slice(0, limit),