aiex-cli 0.0.1-beta.5 → 0.0.1-beta.6

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { C as doctorDiagnosticsTableRows, a as writeAIConfig, b as toSnakeCase, c as PLACEHOLDER_TEXT, d as seedConfig, f as description$1, g as createMigrationConfig, h as version, i as readAIConfig, l as AIConfigSchema, m as package_default, n as getDefaultAIConfig, o as DEFAULT_PROMPT_CONFIG, p as name, r as maskApiKey, s as PLACEHOLDER_SCHEMA, t as collectDoctorDiagnostics, u as createConfig, v as JsonSchemaDefinitionSchema, w as formatDoctorDiagnosticsJson, x as generateDrizzleSchema, y as parseJsonSchema } from "./doctor-Cd_N16iC.mjs";
+import { C as doctorDiagnosticsTableRows, a as writeAIConfig, b as toSnakeCase, c as PLACEHOLDER_TEXT, d as seedConfig, f as description, g as createMigrationConfig, h as version, i as readAIConfig, l as AIConfigSchema, m as package_default, n as getDefaultAIConfig, o as DEFAULT_PROMPT_CONFIG, p as name, r as maskApiKey, s as PLACEHOLDER_SCHEMA, t as collectDoctorDiagnostics, u as createConfig, v as JsonSchemaDefinitionSchema, w as formatDoctorDiagnosticsJson, x as generateDrizzleSchema, y as parseJsonSchema } from "./doctor-BTfByg-I.mjs";
 import { createRequire } from "node:module";
 import path from "node:path";
 import process from "node:process";
@@ -12702,248 +12702,6 @@ function lookupModelCapabilities(modelName) {
 	return null;
 }
 
-//#endregion
-//#region schemas/table-schema.json
-var $id = "https://raw.githubusercontent.com/OSpoon/aiex-cli/main/app/cli/schemas/table-schema.json";
-var table_schema_default = {
-	$schema: "http://json-schema.org/draft-07/schema#",
-	$id,
-	title: "aiex Table Schema",
-	description: "Defines a database table and its columns for aiex-cli schema-to-SQLite migration.",
-	type: "object",
-	required: [
-		"title",
-		"type",
-		"table",
-		"properties"
-	],
-	additionalProperties: false,
-	properties: {
-		"$schema": {
-			"type": "string",
-			"description": "Pointer to this schema file for IDE validation.",
-			"format": "uri",
-			"default": "https://raw.githubusercontent.com/OSpoon/aiex-cli/main/app/cli/schemas/table-schema.json"
-		},
-		"title": {
-			"type": "string",
-			"minLength": 1,
-			"description": "Human-readable table title (e.g. 'User', 'OrderItem')."
-		},
-		"description": {
-			"type": "string",
-			"description": "Optional table description."
-		},
-		"type": {
-			"type": "string",
-			"const": "object",
-			"description": "Must be 'object' — each file defines one table."
-		},
-		"table": {
-			"$ref": "#/$defs/tableConfig",
-			"description": "Table-level configuration."
-		},
-		"properties": {
-			"$ref": "#/$defs/properties",
-			"description": "Column definitions keyed by property name (camelCase)."
-		},
-		"required": {
-			"type": "array",
-			"items": { "type": "string" },
-			"description": "List of property names that are NOT NULL.",
-			"default": []
-		}
-	},
-	$defs: {
-		"tableConfig": {
-			"type": "object",
-			"required": ["name"],
-			"additionalProperties": false,
-			"properties": {
-				"name": {
-					"type": "string",
-					"minLength": 1,
-					"pattern": "^[a-z][a-z0-9_]*$",
-					"description": "SQLite table name in snake_case (lowercase letters, digits, underscores).",
-					"examples": [
-						"users",
-						"order_items",
-						"blog_posts"
-					]
-				},
-				"timestamps": {
-					"type": "boolean",
-					"default": false,
-					"description": "Automatically add created_at and updated_at TIMESTAMP columns."
-				},
-				"softDelete": {
-					"type": "boolean",
-					"default": false,
-					"description": "Automatically add deleted_at nullable TIMESTAMP column."
-				}
-			}
-		},
-		"properties": {
-			"type": "object",
-			"minProperties": 1,
-			"additionalProperties": { "$ref": "#/$defs/property" },
-			"description": "Column definitions. Keys are camelCase property names."
-		},
-		"property": {
-			"type": "object",
-			"required": ["type"],
-			"additionalProperties": false,
-			"properties": {
-				"type": {
-					"$ref": "#/$defs/columnType",
-					"description": "Column data type."
-				},
-				"format": {
-					"$ref": "#/$defs/formatType",
-					"description": "Semantic format hint that influences the SQLite column type."
-				},
-				"primary": {
-					"type": "boolean",
-					"default": false,
-					"description": "Mark this column as PRIMARY KEY. Only one per table."
-				},
-				"autoIncrement": {
-					"type": "boolean",
-					"default": false,
-					"description": "AUTO_INCREMENT for integer primary keys."
-				},
-				"unique": {
-					"type": "boolean",
-					"default": false,
-					"description": "Add UNIQUE constraint."
-				},
-				"default": { "description": "Default value for the column. Type should match the column type." },
-				"minLength": {
-					"type": "integer",
-					"minimum": 0,
-					"description": "Minimum string length (validation only, not a DB constraint)."
-				},
-				"maxLength": {
-					"type": "integer",
-					"minimum": 1,
-					"description": "Maximum string length (validation only, not a DB constraint)."
-				},
-				"minimum": {
-					"type": "number",
-					"description": "Minimum numeric value (validation only, not a DB constraint)."
-				},
-				"maximum": {
-					"type": "number",
-					"description": "Maximum numeric value (validation only, not a DB constraint)."
-				},
-				"drizzle": {
-					"$ref": "#/$defs/drizzleConfig",
-					"description": "Drizzle ORM specific overrides."
-				},
-				"nested": {
-					"$ref": "#/$defs/nestedConfig",
-					"description": "Create a separate related table instead of embedding as JSON."
-				},
-				"foreignKey": {
-					"$ref": "#/$defs/foreignKeyRef",
-					"description": "Foreign key reference to another table."
-				},
-				"properties": {
-					"$ref": "#/$defs/properties",
-					"description": "Sub-properties when type is 'object'. Ignored unless nested.enabled or drizzle.mode='json'."
-				},
-				"items": {
-					"$ref": "#/$defs/property",
-					"description": "Item schema when type is 'array'. Ignored unless items.nested.enabled."
-				},
-				"required": {
-					"type": "array",
-					"items": { "type": "string" },
-					"description": "Required sub-properties for nested objects."
-				}
-			}
-		},
-		"columnType": {
-			"type": "string",
-			"enum": [
-				"string",
-				"integer",
-				"number",
-				"boolean",
-				"object",
-				"array",
-				"null"
-			],
-			"description": "Data type. Maps to SQLite as: string→TEXT, integer→INTEGER, number→REAL, boolean→INTEGER(boolean), object→TEXT(json), array→TEXT(json), null→TEXT."
-		},
-		"formatType": {
-			"type": "string",
-			"enum": [
-				"date-time",
-				"email",
-				"uri",
-				"json"
-			],
-			"description": "Format hints: 'date-time' → INTEGER(timestamp), 'json' → TEXT(json), 'email'/'uri' → TEXT (no special mapping)."
-		},
-		"drizzleConfig": {
-			"type": "object",
-			"additionalProperties": false,
-			"properties": {
-				"mode": {
-					"type": "string",
-					"enum": [
-						"json",
-						"timestamp",
-						"timestamp_ms",
-						"boolean",
-						"bigint"
-					],
-					"description": "Override Drizzle column mode. 'json' stores as TEXT(json), 'timestamp'/'timestamp_ms' as INTEGER, 'boolean' as INTEGER(boolean), 'bigint' as INTEGER(bigint)."
-				},
-				"customType": {
-					"type": "string",
-					"description": "Custom Drizzle type name (reserved for future use)."
-				}
-			}
-		},
-		"nestedConfig": {
-			"type": "object",
-			"required": ["enabled", "relation"],
-			"additionalProperties": false,
-			"properties": {
-				"enabled": {
-					"type": "boolean",
-					"const": true,
-					"description": "Must be true to activate nested table creation."
-				},
-				"relation": {
-					"type": "string",
-					"enum": ["has-one", "has-many"],
-					"description": "'has-one' → one() relation, 'has-many' → many() relation. Only one level of nesting is supported."
-				}
-			}
-		},
-		"foreignKeyRef": {
-			"type": "object",
-			"required": ["table", "column"],
-			"additionalProperties": false,
-			"properties": {
-				"table": {
-					"type": "string",
-					"minLength": 1,
-					"description": "Target table name (snake_case)."
-				},
-				"column": {
-					"type": "string",
-					"minLength": 1,
-					"description": "Target column name in the referenced table."
-				}
-			}
-		}
-	}
-};
-
 //#endregion
 //#region src/core/ai-extraction/json-utils.ts
 function stripFences(text) {
@@ -13132,6 +12890,100 @@ async function readFilePart(filePath) {
 		mimeType: mime
 	};
 }
+function nullableType(type) {
+	return type === "null" ? ["null"] : [type, "null"];
+}
+function propertyToExtractionSchema(property) {
+	if (property.type === "array") return {
+		type: nullableType("array"),
+		items: property.items ? propertyToExtractionSchema(property.items) : {}
+	};
+	if (property.type === "object") {
+		const childProperties = property.properties ? Object.fromEntries(Object.entries(property.properties).map(([name$1, prop]) => [name$1, propertyToExtractionSchema(prop)])) : void 0;
+		return {
+			type: nullableType("object"),
+			...childProperties ? {
+				properties: childProperties,
+				required: Object.keys(childProperties),
+				additionalProperties: false
+			} : { additionalProperties: true }
+		};
+	}
+	return { type: nullableType(property.type) };
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function schemaToExtractionOutputSchema(schema) {
+	const properties = Object.fromEntries(Object.entries(schema.properties).filter(([, prop]) => !(prop.primary && prop.autoIncrement)).map(([name$1, prop]) => [name$1, propertyToExtractionSchema(prop)]));
+	return {
+		type: "object",
+		additionalProperties: false,
+		properties,
+		required: Object.keys(properties)
+	};
+}
+function validatePropertyValue(path$1, property, value, issues) {
+	if (value === null) return;
+	switch (property.type) {
+		case "string":
+			if (typeof value !== "string") issues.push(`${path$1}: expected string or null`);
+			return;
+		case "integer":
+			if (!Number.isInteger(value)) issues.push(`${path$1}: expected integer or null`);
+			return;
+		case "number":
+			if (typeof value !== "number" || Number.isNaN(value)) issues.push(`${path$1}: expected number or null`);
+			return;
+		case "boolean":
+			if (typeof value !== "boolean") issues.push(`${path$1}: expected boolean or null`);
+			return;
+		case "array":
+			if (!Array.isArray(value)) {
+				issues.push(`${path$1}: expected array or null`);
+				return;
+			}
+			if (property.items) {
+				const itemProperty = property.items;
+				value.forEach((item, index) => validatePropertyValue(`${path$1}[${index}]`, itemProperty, item, issues));
+			}
+			return;
+		case "object":
+			if (!isRecord(value)) {
+				issues.push(`${path$1}: expected object or null`);
+				return;
+			}
+			if (property.properties) validateProperties(path$1, property.properties, value, issues);
+			return;
+		case "null": issues.push(`${path$1}: expected null`);
+	}
+}
+function validateProperties(basePath, properties, data, issues) {
+	const expected = Object.entries(properties).filter(([, prop]) => !(prop.primary && prop.autoIncrement));
+	const expectedKeys = new Set(expected.map(([name$1]) => name$1));
+	for (const key of Object.keys(data)) if (!expectedKeys.has(key)) issues.push(`${basePath}.${key}: unexpected field`);
+	for (const [name$1, prop] of expected) {
+		const path$1 = `${basePath}.${name$1}`;
+		if (!(name$1 in data)) {
+			issues.push(`${path$1}: missing field`);
+			continue;
+		}
+		validatePropertyValue(path$1, prop, data[name$1], issues);
+	}
+}
+function validateExtractedData(schema, data) {
+	if (!isRecord(data)) return {
+		success: false,
+		error: "Extracted data must be a JSON object."
+	};
+	const issues = [];
+	validateProperties("$", schema.properties, data, issues);
+	if (issues.length > 0) return {
+		success: false,
+		error: `Extracted data does not match schema:\n${issues.map((issue) => `  - ${issue}`).join("\n")}`
+	};
+	return { success: true };
+}
 async function loadPromptSnapshot(aiexDir, tableName) {
 	const snapshotPath = path.join(aiexDir, "extracted", `${tableName}.prompt.md`);
 	try {
@@ -13173,15 +13025,16 @@ async function extractStructuredData(input) {
 		let system;
 		let user;
 		const snapshot = await loadPromptSnapshot(aiexDir, schema.table.name);
+		const promptText = file ? PLACEHOLDER_TEXT : text;
 		if (snapshot) {
 			system = snapshot.system;
-			user = snapshot.user.replaceAll(PLACEHOLDER_TEXT, text);
+			user = snapshot.user.replaceAll(PLACEHOLDER_TEXT, promptText);
 		} else {
-			const generated = generateExtractionPrompt(schema, text, config.prompt ?? DEFAULT_PROMPT_CONFIG);
+			const generated = generateExtractionPrompt(schema, promptText, config.prompt ?? DEFAULT_PROMPT_CONFIG);
 			system = generated.system;
 			user = generated.user;
 		}
-		const outputSchema = jsonSchema(table_schema_default);
+		const outputSchema = jsonSchema(schemaToExtractionOutputSchema(schema));
 		let result;
 		if (useFileContent) {
 			const filePart = await readFilePart(file);
@@ -13225,6 +13078,11 @@ async function extractStructuredData(input) {
 		let data;
 		if (useStructuredOutput) data = result.output;
 		else data = safeParseJSON(result.text);
+		const validation = validateExtractedData(schema, data);
+		if (!validation.success) return {
+			success: false,
+			error: validation.error
+		};
 		const outputDir = path.resolve(aiexDir, config.extraction.outputDir.replace(".aiex/", ""));
 		await fs.mkdir(outputDir, { recursive: true });
 		const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
@@ -13409,6 +13267,12 @@ const IMAGE_EXTENSIONS = new Set([
 	"bmp",
 	"svg"
 ]);
+const FILE_PART_EXTENSIONS = new Set([...IMAGE_EXTENSIONS, "pdf"]);
+function fail$1(message) {
+	if (message) consola.error(message);
+	outro("Failed!");
+	process.exitCode = 1;
+}
 async function ensureDatabaseReady(dbPath, schema) {
 	try {
 		await fs.access(dbPath);
@@ -13467,29 +13331,24 @@ const extractCommand = defineCommand({
 		const config = createMigrationConfig(process.cwd());
 		const aiexDir = path.dirname(config.schemaPath);
 		if (!args.text && !args.file) {
-			consola.error("Please provide text (-t) or a file (-f) to extract from");
-			outro("Failed!");
+			fail$1("Please provide text (-t) or a file (-f) to extract from");
 			return;
 		}
 		if (args.text && args.file) {
-			consola.error("-t and -f cannot be used together");
-			outro("Failed!");
+			fail$1("-t and -f cannot be used together");
 			return;
 		}
 		const aiConfig = await readAIConfig(aiexDir);
 		if (!aiConfig) {
-			consola.error("AI configuration not found. Please configure AI settings in the Web interface first");
-			outro("Failed!");
+			fail$1("AI configuration not found. Please configure AI settings in the Web interface first");
 			return;
 		}
 		if (!aiConfig.provider.apiKey) {
-			consola.error("API Key not configured. Please configure AI settings in the Web interface first");
-			outro("Failed!");
+			fail$1("API Key not configured. Please configure AI settings in the Web interface first");
 			return;
 		}
 		if (!aiConfig.provider.models?.length) {
-			consola.error("No models configured. Please add at least one model in AI Settings");
-			outro("Failed!");
+			fail$1("No models configured. Please add at least one model in AI Settings");
 			return;
 		}
 		let modelOverride;
@@ -13497,8 +13356,7 @@ const extractCommand = defineCommand({
 			const matched = aiConfig.provider.models.find((m) => m.name === args.model);
 			if (!matched) {
 				const available = aiConfig.provider.models.map((m) => m.name).join(", ");
-				consola.error(`Model "${args.model}" not found in configuration. Available models: ${available}`);
-				outro("Failed!");
+				fail$1(`Model "${args.model}" not found in configuration. Available models: ${available}`);
 				return;
 			}
 			modelOverride = matched;
@@ -13507,12 +13365,11 @@ const extractCommand = defineCommand({
 		let filePath;
 		if (args.file) {
 			const ext = path.extname(args.file).toLowerCase().replace(".", "");
-			if (IMAGE_EXTENSIONS.has(ext)) filePath = args.file;
+			if (FILE_PART_EXTENSIONS.has(ext)) filePath = args.file;
 			else try {
 				text = await fs.readFile(args.file, "utf-8");
 			} catch {
-				consola.error(`Cannot read file: ${args.file}`);
-				outro("Failed!");
+				fail$1(`Cannot read file: ${args.file}`);
 				return;
 			}
 		} else if (args.text) text = args.text;
@@ -13523,18 +13380,17 @@ const extractCommand = defineCommand({
 			const content = await fs.readFile(schemaPath, "utf-8");
 			schema = JSON.parse(content);
 		} catch {
-			consola.error(`Cannot read schema file: ${schemaName}.json`);
-			outro("Failed!");
+			fail$1(`Cannot read schema file: ${schemaName}.json`);
 			return;
 		}
 		try {
-			JsonSchemaDefinitionSchema.parse(schema);
+			schema = JsonSchemaDefinitionSchema.parse(schema);
 		} catch (e) {
 			if (e instanceof ZodError) {
 				consola.error(`Schema validation failed: ${schemaName}.json`);
 				for (const issue of e.issues) consola.error(`  - ${issue.path.join(".")}: ${issue.message}`);
 			}
-			outro("Failed!");
+			fail$1();
 			return;
 		}
 		const s = spinner();
@@ -13549,8 +13405,7 @@ const extractCommand = defineCommand({
 		});
 		if (!result.success) {
 			s.stop("Extraction failed");
-			consola.error(result.error || "Unknown error");
-			outro("Failed!");
+			fail$1(result.error || "Unknown error");
 			return;
 		}
 		s.stop("Extraction complete");
@@ -13562,8 +13417,7 @@ const extractCommand = defineCommand({
 			const dbError = await ensureDatabaseReady(config.databasePath, schema);
 			if (dbError) {
 				s2.stop("Database not ready");
-				consola.error(dbError);
-				outro("Failed!");
+				fail$1(dbError);
 				return;
 			}
 			try {
@@ -13573,8 +13427,7 @@ const extractCommand = defineCommand({
 					if (insertResult.success) s2.stop(`Inserted into ${insertResult.tablesInserted.length} table(s)`);
 					else {
 						s2.stop("Database insert failed");
-						consola.error(insertResult.error || "Unknown error");
-						outro("Failed!");
+						fail$1(insertResult.error || "Unknown error");
 						return;
 					}
 				} finally {
@@ -13582,8 +13435,7 @@ const extractCommand = defineCommand({
 				}
 			} catch (e) {
 				s2.stop("Database insert failed");
-				consola.error(e instanceof Error ? e.message : String(e));
-				outro("Failed!");
+				fail$1(e instanceof Error ? e.message : String(e));
 				return;
 			}
 		}
@@ -13591,9 +13443,27 @@ const extractCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region schemas/table-schema.json
+var $id = "https://raw.githubusercontent.com/OSpoon/aiex-cli/main/app/cli/schemas/table-schema.json";
+
 //#endregion
 //#region src/commands/schema.ts
 const execFileAsync$1 = promisify(execFile);
+function fail(message) {
+	if (message) consola.error(message);
+	outro("Failed!");
+	process.exitCode = 1;
+}
+async function writeJsonIfAbsent(filePath, data) {
+	try {
+		await fs.writeFile(filePath, `${JSON.stringify(data, null, 2)}\n`, { flag: "wx" });
+		return "created";
+	} catch (error) {
+		if (error.code === "EEXIST") return "skipped";
+		throw error;
+	}
+}
 async function generateFromFiles(schemaFiles, config) {
 	const result = parseAllSchemas(await Promise.all(schemaFiles.map(async (filePath) => {
 		return {
@@ -13611,17 +13481,18 @@ async function generateFromFiles(schemaFiles, config) {
 	consola.success(`Generated ${pc.cyan(".aiex/drizzle/schema.ts")} from ${schemaFiles.length} schema file(s)`);
 	return true;
 }
-async function migrate(config) {
+async function migrate(config, migrationName) {
 	const helperPath = resolveHelperPath();
-	const tsxPath = resolveTsxPath();
+	const helperArgs = [
+		resolveTsxPath(),
+		helperPath,
+		config.drizzleSchemaPath,
+		config.migrationsPath,
+		config.databasePath
+	];
+	if (migrationName) helperArgs.push(migrationName);
 	try {
-		const { stdout } = await execFileAsync$1(process.execPath, [
-			tsxPath,
-			helperPath,
-			config.drizzleSchemaPath,
-			config.migrationsPath,
-			config.databasePath
-		], { cwd: process.cwd() });
+		const { stdout } = await execFileAsync$1(process.execPath, helperArgs, { cwd: process.cwd() });
 		const result = JSON.parse(stdout.trim());
 		if (!result.success) {
 			consola.error("Failed to generate migration");
@@ -13862,9 +13733,11 @@ const schemaCommand = defineCommand({
 					"authorId"
 				]
 			};
-			await fs.writeFile(path.join(config.schemaPath, "user.json"), `${JSON.stringify(userSchema, null, 2)}\n`);
-			await fs.writeFile(path.join(config.schemaPath, "post.json"), `${JSON.stringify(postSchema, null, 2)}\n`);
+			const userStatus = await writeJsonIfAbsent(path.join(config.schemaPath, "user.json"), userSchema);
+			const postStatus = await writeJsonIfAbsent(path.join(config.schemaPath, "post.json"), postSchema);
 			consola.success(`Initialized ${pc.cyan(".aiex/")} with example schemas`);
+			if (userStatus === "skipped") consola.warn(`${pc.cyan(".aiex/schema/user.json")} already exists, skipped`);
+			if (postStatus === "skipped") consola.warn(`${pc.cyan(".aiex/schema/post.json")} already exists, skipped`);
 			consola.info("Example includes: User (with preferences has-one), Post (with comments has-many)");
 			outro("Run: aiex schema");
 			return;
@@ -13877,9 +13750,8 @@ const schemaCommand = defineCommand({
 			schemaFiles = [];
 		}
 		if (schemaFiles.length === 0) {
-			consola.error(`No schema files found in ${pc.cyan(".aiex/schema/")}`);
 			consola.info("Use --init to initialize with an example schema");
-			outro("Failed!");
+			fail(`No schema files found in ${pc.cyan(".aiex/schema/")}`);
 			return;
 		}
 		const s1 = spinner();
@@ -13887,7 +13759,7 @@ const schemaCommand = defineCommand({
 		const genOk = await generateFromFiles(schemaFiles, config);
 		s1.stop(genOk ? "Schema generated" : "Generation failed");
 		if (!genOk) {
-			outro("Failed!");
+			fail();
 			return;
 		}
 		if (args.generate) {
@@ -13896,10 +13768,10 @@ const schemaCommand = defineCommand({
 		}
 		const s2 = spinner();
 		s2.start("Running migrations...");
-		const migOk = await migrate(config);
+		const migOk = await migrate(config, args.name);
 		s2.stop(migOk ? "Migrations applied" : "Migration failed");
 		if (!migOk) {
-			outro("Failed!");
+			fail();
 			return;
 		}
 		outro("Done!");
@@ -13977,6 +13849,8 @@ function aiRoutes(config) {
 //#endregion
 //#region src/server/routes/data.ts
 const FILE_REGEX = /\.json$/;
+const EXTRACTION_FILE_RE = /^[\w.-]+\.json$/;
+const TABLE_NAME_RE$1 = /^[a-z][a-z0-9_]*$/;
 const TIMESTAMP_CLEANUP = /(\d{2})-(\d{2})-(\d{2})/;
 const TIMESTAMP_TZ = /(\d{3})Z/;
 function dataRoutes(config) {
@@ -14014,20 +13888,6 @@ function dataRoutes(config) {
 			return c.json({ error: error instanceof Error ? error.message : String(error) }, 500);
 		}
 	});
-	app.get("/data/:name", async (c) => {
-		const name$1 = c.req.param("name");
-		const filePath = path.join(extractedDir, name$1);
-		try {
-			const content = await fs.readFile(filePath, "utf-8");
-			return c.json({
-				success: true,
-				content,
-				name: name$1
-			});
-		} catch {
-			return c.json({ error: "Extraction result not found" }, 404);
-		}
-	});
 	app.get("/data/tables", async (c) => {
 		try {
 			const schemaDir = config.schemaPath;
@@ -14066,6 +13926,7 @@ function dataRoutes(config) {
 	});
 	app.get("/data/tables/:name", async (c) => {
 		const tableName = c.req.param("name");
+		if (!TABLE_NAME_RE$1.test(tableName)) return c.json({ error: "Invalid table name" }, 400);
 		const sortField = c.req.query("sortField");
 		const sortOrder = c.req.query("sortOrder") || "asc";
 		let db;
@@ -14100,12 +13961,33 @@ function dataRoutes(config) {
 			db.close();
 		}
 	});
+	app.get("/data/:name", async (c) => {
+		const name$1 = c.req.param("name");
+		if (name$1 !== path.basename(name$1) || !EXTRACTION_FILE_RE.test(name$1) || name$1.includes("..")) return c.json({ error: "Invalid extraction file name" }, 400);
+		const filePath = path.join(extractedDir, name$1);
+		try {
+			const content = await fs.readFile(filePath, "utf-8");
+			return c.json({
+				success: true,
+				content,
+				name: name$1
+			});
+		} catch {
+			return c.json({ error: "Extraction result not found" }, 404);
+		}
+	});
 	return app;
 }
 
 //#endregion
 //#region src/server/routes/schema.ts
 const execFileAsync = promisify(execFile);
+const SCHEMA_FILE_RE = /^[\w.-]+\.json$/;
+const TABLE_NAME_RE = /^[a-z][a-z0-9_]*$/;
+function resolveSchemaFile(schemaDir, name$1) {
+	if (name$1 !== path.basename(name$1) || !SCHEMA_FILE_RE.test(name$1) || name$1.includes("..")) return null;
+	return path.join(schemaDir, name$1);
+}
 function schemaRoutes(config) {
 	const app = new Hono();
 	const schemaDir = config.schemaPath;
@@ -14118,8 +14000,8 @@ function schemaRoutes(config) {
 		return c.json(jsonFiles);
 	});
 	app.get("/schema/:name", async (c) => {
-		const name$1 = c.req.param("name");
-		const filePath = path.join(schemaDir, name$1);
+		const filePath = resolveSchemaFile(schemaDir, c.req.param("name"));
+		if (!filePath) return c.json({ error: "Invalid schema file name" }, 400);
 		try {
 			const content = await fs.readFile(filePath, "utf-8");
 			return c.json(JSON.parse(content));
@@ -14128,8 +14010,8 @@ function schemaRoutes(config) {
 		}
 	});
 	app.post("/schema/:name", async (c) => {
-		const name$1 = c.req.param("name");
-		const filePath = path.join(schemaDir, name$1);
+		const filePath = resolveSchemaFile(schemaDir, c.req.param("name"));
+		if (!filePath) return c.json({ error: "Invalid schema file name" }, 400);
 		try {
 			const body = await c.req.json();
 			await ensureDir();
@@ -14145,6 +14027,10 @@ function schemaRoutes(config) {
 	});
 	app.get("/prompt-snapshot/:name", async (c) => {
 		const name$1 = c.req.param("name");
+		if (!TABLE_NAME_RE.test(name$1)) return c.json({
+			success: false,
+			error: "Invalid table name"
+		}, 400);
 		const aiexDir = path.dirname(schemaDir);
 		const snapshotPath = path.join(aiexDir, "extracted", `${name$1}.prompt.md`);
 		try {
@@ -14161,8 +14047,8 @@ function schemaRoutes(config) {
 		}
 	});
 	app.delete("/schema/:name", async (c) => {
-		const name$1 = c.req.param("name");
-		const filePath = path.join(schemaDir, name$1);
+		const filePath = resolveSchemaFile(schemaDir, c.req.param("name"));
+		if (!filePath) return c.json({ error: "Invalid schema file name" }, 400);
 		try {
 			await fs.unlink(filePath);
 			return c.json({ success: true });
@@ -14239,9 +14125,10 @@ function schemaRoutes(config) {
 
 //#endregion
 //#region src/server/index.ts
+const LOCAL_ORIGIN_RE = /^https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/;
 function createApp(config, staticDir) {
 	const app = new Hono();
-	app.use("*", cors());
+	app.use("*", cors({ origin: (origin) => LOCAL_ORIGIN_RE.test(origin) ? origin : null }));
 	app.route("/api", schemaRoutes(config));
 	app.route("/api", aiRoutes(config));
 	app.route("/api", dataRoutes(config));
@@ -14328,7 +14215,7 @@ runMain(defineCommand({
 	meta: {
 		name,
 		version,
-		description: description$1
+		description
 	},
 	subCommands
 }));