@xpert-ai/plugin-sdk 3.18.6 → 3.19.0

package/data-workbench.esm.js

@@ -6,6 +6,159 @@ const DataSourceRuntimeCapability = Object.freeze({
     __type: undefined
 });
 
+/** Mask comments and quoted content without changing source offsets. Shared by guards and pagination. */ function lexWorkbenchSql(source) {
+    if (!source.trim() || source.length > 100000 || source.includes('\0')) throw new Error('invalid_sql');
+    const masked = source.split('');
+    const quoted = new Map();
+    const hide = (start, end, kind)=>{
+        for(let i = start; i < end; i++)if (masked[i] !== '\n') masked[i] = ' ';
+        if (kind) {
+            const marker = start + 1;
+            quoted.set(marker, kind);
+            masked[marker] = kind === 'literal' ? '?' : 'i';
+        }
+    };
+    let index = 0;
+    while(index < source.length){
+        const start = index, c = source[index], next = source[index + 1];
+        if (c === '-' && next === '-' || c === '#') {
+            while(index < source.length && source[index] !== '\n')index++;
+            hide(start, index);
+            continue;
+        }
+        if (c === '/' && next === '*') {
+            if (source[index + 2] === '!') throw new Error('executable_comment_not_supported');
+            const end = source.indexOf('*/', index + 2);
+            if (end < 0) throw new Error('unterminated_comment');
+            index = end + 2;
+            hide(start, index);
+            continue;
+        }
+        if (c === "'" || c === '"' || c === '`') {
+            let closed = false;
+            index++;
+            while(index < source.length){
+                if (source[index] === '\\') throw new Error('use_parameters_for_backslash_literals');
+                if (source[index] === c) {
+                    if (source[index + 1] === c) {
+                        index += 2;
+                        continue;
+                    }
+                    index++;
+                    closed = true;
+                    break;
+                }
+                index++;
+            }
+            if (!closed) throw new Error('unterminated_literal');
+            hide(start, index, c === "'" ? 'literal' : 'identifier');
+            continue;
+        }
+        if (c === '$') {
+            var _source_slice_match;
+            const tag = (_source_slice_match = source.slice(index).match(/^\$(?:[A-Za-z_][A-Za-z_0-9]*)?\$/)) == null ? void 0 : _source_slice_match[0];
+            if (tag) {
+                const end = source.indexOf(tag, index + tag.length);
+                if (end < 0) throw new Error('unterminated_literal');
+                index = end + tag.length;
+                hide(start, index, 'literal');
+                continue;
+            }
+        }
+        index++;
+    }
+    const text = masked.join('');
+    const tokens = [
+        ...text.matchAll(/[A-Z_][A-Z_0-9]*|[0-9]+|[^\s]/gi)
+    ].map((match)=>{
+        var _quoted_get;
+        return {
+            text: match[0].toUpperCase(),
+            start: match.index,
+            end: match.index + match[0].length,
+            kind: (_quoted_get = quoted.get(match.index)) != null ? _quoted_get : /^[A-Z_]/i.test(match[0]) ? 'word' : /^[0-9]/.test(match[0]) ? 'number' : 'symbol'
+        };
+    });
+    return {
+        masked: text,
+        tokens
+    };
+}
+
+const MODIFIED_TYPES = new Set('DECIMAL NUMERIC CHAR VARCHAR NCHAR NVARCHAR BINARY VARBINARY DATETIME TIME TIMESTAMP'.split(' '));
+/** Positions where name(...) declares columns or a built-in type, rather than invoking a function. */ function sqlDeclarationPositions(tokens) {
+    const declarations = new Set();
+    const closing = new Map(), parents = new Map();
+    const stack = [];
+    tokens.forEach((token, index)=>{
+        if (stack.length) parents.set(index, stack[stack.length - 1]);
+        if (token.text === '(') stack.push(index);
+        if (token.text === ')') {
+            const open = stack.pop();
+            if (open !== undefined) closing.set(open, index);
+        }
+    });
+    const name = (index)=>{
+        var _tokens_index;
+        return [
+            'word',
+            'identifier'
+        ].includes((_tokens_index = tokens[index]) == null ? void 0 : _tokens_index.kind);
+    };
+    const is = (index, word)=>{
+        var _tokens_index;
+        return ((_tokens_index = tokens[index]) == null ? void 0 : _tokens_index.text) === word;
+    };
+    for(let i = 0; i < tokens.length; i++){
+        if (tokens[i].kind !== 'word' || !is(i, 'WITH')) continue;
+        let cursor = i + 1;
+        if (is(cursor, 'RECURSIVE')) cursor++;
+        while(name(cursor)){
+            const declaration = cursor++;
+            let columns = false;
+            if (is(cursor, '(')) {
+                const end = closing.get(cursor);
+                if (end === undefined || end === cursor + 1) break;
+                const columnTokens = tokens.slice(cursor + 1, end);
+                if (columnTokens.length % 2 === 0 || !columnTokens.every((token, n)=>n % 2 === 0 ? [
+                        'word',
+                        'identifier'
+                    ].includes(token.kind) : token.text === ',')) break;
+                columns = true;
+                cursor = end + 1;
+            }
+            if (!is(cursor++, 'AS')) break;
+            if (is(cursor, 'NOT')) cursor++;
+            if (is(cursor, 'MATERIALIZED')) cursor++;
+            if (!is(cursor, '(')) break;
+            const end = closing.get(cursor);
+            if (end === undefined) break;
+            if (columns) declarations.add(tokens[declaration].start);
+            cursor = end + 1;
+            if (!is(cursor, ',')) break;
+            cursor++;
+        }
+    }
+    tokens.forEach((token, i)=>{
+        var _tokens_;
+        if (token.kind !== 'word' || !MODIFIED_TYPES.has(token.text) || !is(i + 1, '(')) return;
+        const end = closing.get(i + 1);
+        if (end === undefined) return;
+        const args = tokens.slice(i + 2, end);
+        if (![
+            1,
+            3
+        ].includes(args.length) || !args.every((arg, n)=>n % 2 ? arg.text === ',' : arg.kind === 'number')) return;
+        const parent = parents.get(i);
+        const owner = parent === undefined ? undefined : (_tokens_ = tokens[parent - 1]) == null ? void 0 : _tokens_.text;
+        const cast = owner === 'CAST' && is(i - 1, 'AS');
+        const convert = owner === 'CONVERT' && is(i - 1, ',');
+        const postgresCast = is(i - 1, ':') && is(i - 2, ':');
+        if (cast || convert || postgresCast) declarations.add(token.start);
+    });
+    return declarations;
+}
+
 const WRITE = new Set([
     'INSERT',
     'UPDATE',
@@ -40,15 +193,16 @@ const FORBIDDEN = new Set([
     'DETACH'
 ]);
 const SAFE_FUNCTIONS = new Set('ABS ACOS ASIN ATAN ATAN2 AVG CAST CEIL CEILING COALESCE CONCAT CONCAT_WS CONVERT COS COUNT CURDATE CURRENT_DATE CURRENT_TIMESTAMP DATE DATE_ADD DATE_SUB DATE_FORMAT DATEDIFF DAY DAYOFMONTH DAYOFWEEK EXTRACT FLOOR FORMAT GREATEST GROUP_CONCAT IF IFNULL JSON_EXTRACT JSON_LENGTH JSON_UNQUOTE LEAST LEFT LENGTH LN LOG LOWER LPAD LTRIM MAX MD5 MIN MOD MONTH NOW NULLIF POWER RAND REPLACE REVERSE RIGHT ROUND ROW_NUMBER RANK DENSE_RANK LAG LEAD FIRST_VALUE LAST_VALUE LPAD RPAD RTRIM SIGN SIN SQRT STDDEV STDDEV_POP STDDEV_SAMP SUBSTR SUBSTRING SUM TAN TO_CHAR TO_DATE TO_TIMESTAMP TRIM TRUNC UPPER VAR_POP VAR_SAMP VERSION WEEK YEAR DATABASE CURRENT_DATABASE CURRENT_SCHEMA ARRAY_AGG STRING_AGG JSON_AGG JSON_BUILD_OBJECT PG_GET_VIEWDEF'.split(' '));
-const SQL_PARENS = new Set('IN AS EXISTS OVER PARTITION VALUES SELECT WITH AND OR NOT ON USING FILTER GROUPING ROLLUP CUBE DISTINCT EXPLAIN'.split(' '));
+// FROM/JOIN can introduce a parenthesized subquery, not a function call.
+const SQL_PARENS = new Set('IN AS EXISTS OVER PARTITION VALUES SELECT WITH FROM JOIN AND OR NOT ON USING FILTER GROUPING ROLLUP CUBE DISTINCT EXPLAIN'.split(' '));
 const UNSAFE_FUNCTIONS = /\b(pg_sleep|sleep|benchmark|dblink\w*|lo_\w+|pg_(?:read|write|ls|stat|terminate|cancel|reload|rotate|log|create|drop|promote|switch|backup|replication|advisory)\w*|get_lock|release_lock|load_file|nextval|setval|set_config|http\w*|s3|hdfs|jdbc|mysql|postgresql|file|url)\s*\(/i;
 function splitWorkbenchSql(source) {
-    if (!source.trim() || source.length > 100000 || source.includes('\0')) throw new Error('invalid_sql');
+    const { masked, tokens } = lexWorkbenchSql(source);
     const statements = [];
-    let start = 0, index = 0, clean = '';
+    let start = 0;
     const finish = (end)=>{
-        const text = clean.trim();
-        if (text) {
+        const text = masked.slice(start, end);
+        if (text.trim()) {
             var _text_toUpperCase_match;
             const words = (_text_toUpperCase_match = text.toUpperCase().match(/[A-Z_][A-Z_0-9]*/g)) != null ? _text_toUpperCase_match : [];
             const first = words[0];
@@ -59,10 +213,11 @@ function splitWorkbenchSql(source) {
                 if (words.some((word, index)=>WRITE.has(word) && !(first === 'SHOW' && index === 1 && word === 'CREATE') || FORBIDDEN.has(word)) || UNSAFE_FUNCTIONS.test(text) || /\bFOR\s+(UPDATE|SHARE)\b/i.test(text) || /:=|\bEXPLAIN\s+ANALYZE\b|@/i.test(text)) effect = 'unsupported';
                 // eslint-disable-next-line no-control-regex -- intentional: reject any non-ASCII/control input
                 if (/[^\x00-\x7f]/.test(text) || /\.\s*[A-Z_][A-Z_0-9]*\s*\(/i.test(text)) effect = 'unsupported';
+                const declarations = sqlDeclarationPositions(tokens.filter((token)=>token.start >= start && token.end <= end));
                 if ([
                     ...text.matchAll(/([A-Z_][A-Z_0-9]*)\s*\(/gi)
-                ].some((match)=>!SAFE_FUNCTIONS.has(match[1].toUpperCase()) && !SQL_PARENS.has(match[1].toUpperCase()))) effect = 'unsupported';
-                if (first === 'SHOW' && !/^(SHOW\s+(DATABASES|SCHEMAS|CATALOGS|TABLES|FULL\s+TABLES|COLUMNS|FULL\s+COLUMNS|INDEX|INDEXES|KEYS|CREATE\s+TABLE|CREATE\s+VIEW|PARTITIONS|VARIABLES|STATUS|GRANTS))\b/i.test(text)) effect = 'unsupported';
+                ].some((match)=>!declarations.has(start + match.index) && !SAFE_FUNCTIONS.has(match[1].toUpperCase()) && !SQL_PARENS.has(match[1].toUpperCase()))) effect = 'unsupported';
+                if (first === 'SHOW' && !/^(SHOW\s+(DATABASES|SCHEMAS|CATALOGS|TABLES|FULL\s+TABLES|COLUMNS|FULL\s+COLUMNS|INDEX|INDEXES|KEYS|CREATE\s+TABLE|CREATE\s+VIEW|PARTITIONS|VARIABLES|STATUS|GRANTS))\b/i.test(text.trim())) effect = 'unsupported';
             }
             // CREATE/ALTER routines, external resources and privileged SQL are outside this app.
             if (effect === 'write' && /\b(FUNCTION|PROCEDURE|TRIGGER|USER|ROLE|CATALOG|RESOURCE|SYSTEM|SERVER|EXTENSION|FILE|OUTFILE|DUMPFILE|EXECUTE)\b/i.test(text)) effect = 'unsupported';
@@ -72,63 +227,10 @@ function splitWorkbenchSql(source) {
                 effect
             });
         }
-        clean = '';
         start = end + 1;
     };
-    while(index < source.length){
-        const c = source[index], next = source[index + 1];
-        if (c === '-' && next === '-' || c === '#') {
-            while(index < source.length && source[index] !== '\n')index++;
-            clean += ' ';
-            continue;
-        }
-        if (c === '/' && next === '*') {
-            if (source[index + 2] === '!') throw new Error('executable_comment_not_supported');
-            const end = source.indexOf('*/', index + 2);
-            if (end < 0) throw new Error('unterminated_comment');
-            index = end + 2;
-            clean += ' ';
-            continue;
-        }
-        if (c === "'" || c === '"' || c === '`') {
-            const quote = c;
-            let closed = false;
-            index++;
-            while(index < source.length){
-                if (source[index] === '\\') throw new Error('use_parameters_for_backslash_literals');
-                if (source[index] === quote) {
-                    if (source[index + 1] === quote) {
-                        index += 2;
-                        continue;
-                    }
-                    index++;
-                    closed = true;
-                    break;
-                }
-                index++;
-            }
-            if (!closed) throw new Error('unterminated_literal');
-            clean += quote === "'" ? ' ? ' : ' identifier ';
-            continue;
-        }
-        if (c === '$') {
-            var _source_slice_match;
-            const tag = (_source_slice_match = source.slice(index).match(/^\$(?:[A-Za-z_][A-Za-z_0-9]*)?\$/)) == null ? void 0 : _source_slice_match[0];
-            if (tag) {
-                const end = source.indexOf(tag, index + tag.length);
-                if (end < 0) throw new Error('unterminated_literal');
-                index = end + tag.length;
-                clean += ' ? ';
-                continue;
-            }
-        }
-        if (c === ';') {
-            finish(index);
-            index++;
-            continue;
-        }
-        clean += c;
-        index++;
+    for (const token of tokens){
+        if (token.kind === 'symbol' && token.text === ';') finish(token.start);
     }
     finish(source.length);
     if (!statements.length || statements.length > 50) throw new Error('statement_count_exceeded');
@@ -146,6 +248,53 @@ function quoteDatabaseIdentifier(name, engine) {
     return quote + name.split(quote).join(quote + quote) + quote;
 }
 
+/** Apply a page to a MySQL result without turning its (possibly duplicate) output names into table columns. */ function paginateMysqlQuery(sql, parameters = [], limit, offset) {
+    const { tokens } = lexWorkbenchSql(sql);
+    const top = [];
+    let depth = 0;
+    for (const token of tokens){
+        if (token.text === '(') depth++;
+        if (!depth) top.push(token);
+        if (token.text === ')') depth--;
+        if (depth < 0) throw new Error('unsupported_pagination');
+    }
+    if (depth) throw new Error('unsupported_pagination');
+    const start = top.findIndex((token)=>token.kind === 'word' && token.text === 'LIMIT');
+    if (start < 0) return {
+        sql: `${sql}\nLIMIT ${limit + 1} OFFSET ${offset}`,
+        parameters
+    };
+    const clause = top.slice(start + 1);
+    const bindings = tokens.filter((token)=>token.text === '?' && token.kind === 'symbol');
+    const consumed = new Set();
+    const integer = (token)=>{
+        if ((token == null ? void 0 : token.kind) === 'number') return BigInt(token.text);
+        if ((token == null ? void 0 : token.kind) === 'symbol' && token.text === '?') {
+            const index = bindings.indexOf(token), value = parameters[index];
+            if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0) {
+                consumed.add(index);
+                return BigInt(value);
+            }
+        }
+        throw new Error('unsupported_pagination');
+    };
+    let count, skip = 0n;
+    if (clause.length === 1) count = integer(clause[0]);
+    else if (clause.length === 3 && clause[1].text === ',') {
+        skip = integer(clause[0]);
+        count = integer(clause[2]);
+    } else if (clause.length === 3 && clause[1].kind === 'word' && clause[1].text === 'OFFSET') {
+        count = integer(clause[0]);
+        skip = integer(clause[2]);
+    } else throw new Error('unsupported_pagination');
+    const remaining = count > BigInt(offset) ? count - BigInt(offset) : 0n;
+    const size = remaining < BigInt(limit + 1) ? remaining : BigInt(limit + 1);
+    return {
+        sql: `${sql.slice(0, top[start].start)}LIMIT ${size} OFFSET ${skip + BigInt(offset)}${sql.slice(clause[clause.length - 1].end)}`,
+        parameters: parameters.filter((_, index)=>!consumed.has(index))
+    };
+}
+
 const number = (value)=>Number(value != null ? value : 0);
 const string = (value)=>value == null ? '' : String(value);
 const cell = (result, row, name)=>row[result.columns.findIndex((column)=>column.name.toLowerCase() === name.toLowerCase())];
@@ -387,12 +536,14 @@ const cell = (result, row, name)=>row[result.columns.findIndex((column)=>column.
         if (input.mode === 'write' && !(await this.capabilities()).writes) throw new Error('engine_version_writes_unavailable');
         if (input.mode === 'write' && offset) throw new Error('mutation_cannot_be_paginated');
         let sql = statements[0].sql;
-        // Wrap a SELECT instead of appending LIMIT after an existing LIMIT or trailing comment.
+        let parameters = input.parameters;
         if (input.mode === 'read' && [
             'SELECT',
             'WITH'
-        ].includes(statements[0].words[0])) sql = `SELECT * FROM (\n${sql}\n) AS ${this.quote('_db_studio_page')} LIMIT ${limit + 1} OFFSET ${offset}`;
-        else if (offset) throw new Error('statement_cannot_be_paginated');
+        ].includes(statements[0].words[0])) {
+            if (this.engine === 'mysql') ({ sql, parameters } = paginateMysqlQuery(sql, parameters, limit, offset));
+            else sql = `SELECT * FROM (\n${sql}\n) AS ${this.quote('_db_studio_page')} LIMIT ${limit + 1} OFFSET ${offset}`;
+        } else if (offset) throw new Error('statement_cannot_be_paginated');
         this.busy = true;
         let readTransaction = false;
         try {
@@ -401,7 +552,7 @@ const cell = (result, row, name)=>row[result.columns.findIndex((column)=>column.
                 readTransaction = true;
             }
             var _input_timeoutMs;
-            const result = await this.raw(sql, input.parameters, limit + 1, signal, Math.max(1, Math.min((_input_timeoutMs = input.timeoutMs) != null ? _input_timeoutMs : 30000, 120000)));
+            const result = await this.raw(sql, parameters, limit + 1, signal, Math.max(1, Math.min((_input_timeoutMs = input.timeoutMs) != null ? _input_timeoutMs : 30000, 120000)));
             const hasMore = result.rows.length > limit || result.truncated;
             return _extends({}, result, {
                 rows: result.rows.slice(0, limit),