arc-1 1.1.2 → 1.2.0

package/dist/adt/sql-source-analyzer.js

@@ -0,0 +1,158 @@
+/**
+ * Conservative ABAP SQL source analysis for the experimental data-source blocklist.
+ *
+ * This is an authorization parser, not a formatter or best-effort dependency extractor:
+ * anything that cannot be proven to be one complete static SELECT/WITH statement is refused.
+ */
+import { Expressions, MemoryFile, Registry, Version } from '@abaplint/core';
+import { getDefaultAbaplintConfig } from '../lint/abaplint-config-cache.js';
+import { canonicalDataSourceName } from './data-source-name.js';
+const MAX_SQL_LENGTH = 100_000;
+const SYNTHETIC_TARGET = '__arc1_policy_result';
+const FORBIDDEN_EXPRESSIONS = [
+    ['privileged access', Expressions.SQLPrivilegedAccess],
+    ['client override', Expressions.SQLClient],
+    ['secondary database connection', Expressions.DatabaseConnection],
+    ['dynamic expression', Expressions.Dynamic],
+    ['CDS association path', Expressions.SQLPathForEntity],
+    ['CDS column path', Expressions.SQLPathForColumn],
+    ['external PROVIDED BY source', Expressions.SQLProvidedBy],
+];
+export class SqlSourceAnalysisError extends Error {
+    constructor(message) {
+        super(`SQL source analysis failed: ${message}`);
+        this.name = 'SqlSourceAnalysisError';
+    }
+}
+/**
+ * Canonicalize a source the parser found, reporting failure as a SQL-grammar problem.
+ *
+ * Identity rules live in one place (`data-source-name.ts`); a name the shared canonicalizer refuses
+ * means the statement is outside the accepted subset, not that lineage is unresolved.
+ */
+function parsedSourceName(raw) {
+    try {
+        return canonicalDataSourceName(raw, 'SQL data source');
+    }
+    catch (error) {
+        throw new SqlSourceAnalysisError(error instanceof Error ? error.message : String(error));
+    }
+}
+/**
+ * Refuse lexical constructs the strict subset does not accept, before the statement is parsed.
+ *
+ * `@abaplint/core` strips ABAP comments during lexing, so a commented region is invisible to the
+ * security parser while the ORIGINAL, unmodified string — comment included — is what is posted to
+ * `/sap/bc/adt/datapreview/freestyle`. That divergence is not a demonstrated exploit: live SAP_BASIS
+ * 758 answered an inline quote comment with HTTP 400 and ignored a column-one asterisk comment,
+ * matching ordinary ABAP comment semantics. It is refused anyway for a narrower reason — while
+ * comments are accepted, the text the analyzer inspects is not the text SAP receives, and that is
+ * only safe because of an assumption about a parser ARC-1 does not control. Rejecting them removes
+ * the assumption and shrinks the accepted grammar at no cost.
+ *
+ * Lexing is literal-aware: a double quote or semicolon INSIDE a single-quoted literal is legitimate
+ * (`WHERE X = 'a"b'`) and stays accepted, and doubled single quotes (`'it''s'`) are escaped quotes,
+ * not literal terminators.
+ */
+function rejectUnsupportedLexicalConstructs(sql) {
+    let inLiteral = false;
+    let column = 0;
+    for (let i = 0; i < sql.length; i++) {
+        const char = sql[i];
+        if (char === '\n' || char === '\r') {
+            column = 0;
+            continue;
+        }
+        const atColumnOne = column === 0;
+        column += 1;
+        if (inLiteral) {
+            if (char === "'") {
+                if (sql[i + 1] === "'") {
+                    i += 1;
+                    column += 1;
+                    continue;
+                }
+                inLiteral = false;
+            }
+            continue;
+        }
+        if (char === "'") {
+            inLiteral = true;
+            continue;
+        }
+        if (char === '"') {
+            throw new SqlSourceAnalysisError('ABAP inline comments (") are not accepted by the strict SQL subset; remove the comment and resubmit');
+        }
+        if (char === ';') {
+            throw new SqlSourceAnalysisError('semicolons are not accepted by the strict SQL subset');
+        }
+        if (atColumnOne && char === '*') {
+            throw new SqlSourceAnalysisError('ABAP full-line comments (* in column one) are not accepted by the strict SQL subset; remove the comment and resubmit');
+        }
+    }
+    if (inLiteral)
+        throw new SqlSourceAnalysisError('unterminated string literal');
+}
+/** Extract every static database source from one complete ABAP SQL SELECT/WITH statement. */
+export function analyzeSqlDataSources(sql) {
+    if (sql.length > MAX_SQL_LENGTH) {
+        throw new SqlSourceAnalysisError(`SQL is too long for policy analysis (maximum ${MAX_SQL_LENGTH} characters)`);
+    }
+    const trimmed = sql.trim();
+    if (!trimmed)
+        throw new SqlSourceAnalysisError('SQL is empty');
+    // Runs on the trimmed text, which is exactly what is embedded below, so column-one detection
+    // matches what the parser sees.
+    rejectUnsupportedLexicalConstructs(trimmed);
+    const inputLineCount = trimmed.split(/\r?\n/).length;
+    const syntheticTargetRow = inputLineCount + 3;
+    const source = `REPORT zarc1_policy.\nSTART-OF-SELECTION.\n${trimmed}\n` + `INTO TABLE @DATA(${SYNTHETIC_TARGET}).`;
+    const registry = new Registry(getDefaultAbaplintConfig(Version.v758));
+    registry.addFile(new MemoryFile('zarc1_policy.prog.abap', source));
+    registry.parse();
+    const parserIssues = registry.findIssues().filter((issue) => issue.getKey() === 'parser_error');
+    if (parserIssues.length > 0) {
+        throw new SqlSourceAnalysisError('statement is malformed or unsupported by the security parser');
+    }
+    const objects = Array.from(registry.getObjects());
+    const object = objects[0];
+    const structure = object?.getMainABAPFile?.()?.getStructure?.();
+    if (objects.length !== 1 || !structure) {
+        throw new SqlSourceAnalysisError('statement did not produce one complete ABAP program syntax tree');
+    }
+    const statements = structure.findAllStatementNodes();
+    if (statements.length !== 3 ||
+        statements[0]?.get().constructor.name !== 'Report' ||
+        statements[1]?.get().constructor.name !== 'StartOfSelection' ||
+        !['Select', 'With'].includes(statements[2]?.get().constructor.name ?? '')) {
+        throw new SqlSourceAnalysisError('exactly one SELECT or WITH statement is required');
+    }
+    const queryStatement = statements[2];
+    const tokens = queryStatement.getTokens();
+    const syntheticTokens = tokens
+        .filter((token) => token.getRow() === syntheticTargetRow)
+        .map((token) => token.getStr());
+    const expectedTarget = ['INTO', 'TABLE', '@', 'DATA', '(', SYNTHETIC_TARGET, ')', '.'];
+    if (syntheticTokens.length !== expectedTarget.length ||
+        syntheticTokens.some((token, i) => token !== expectedTarget[i])) {
+        throw new SqlSourceAnalysisError('statement is incomplete or already contains an output target');
+    }
+    const callerHostMarkers = tokens.filter((token) => token.constructor.name === 'WAt' && token.getRow() !== syntheticTargetRow);
+    if (callerHostMarkers.length > 0) {
+        throw new SqlSourceAnalysisError('host expressions are not allowed while the data-source blocklist is active');
+    }
+    for (const [label, expression] of FORBIDDEN_EXPRESSIONS) {
+        if (structure.findAllExpressionsRecursive(expression).length > 0) {
+            throw new SqlSourceAnalysisError(`${label} is not allowed while the data-source blocklist is active`);
+        }
+    }
+    const sources = structure
+        .findAllExpressionsRecursive(Expressions.DatabaseTable)
+        .map((node) => parsedSourceName(node.concatTokens()));
+    const uniqueSources = [...new Set(sources)];
+    if (uniqueSources.length === 0) {
+        throw new SqlSourceAnalysisError('no static database source could be proven');
+    }
+    return uniqueSources;
+}
+//# sourceMappingURL=sql-source-analyzer.js.map

package/dist/adt/sql-source-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql-source-analyzer.js","sourceRoot":"","sources":["../../src/adt/sql-source-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,cAAc,GAAG,OAAO,CAAC;AAC/B,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEhD,MAAM,qBAAqB,GAAG;IAC5B,CAAC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB,CAAC;IACtD,CAAC,iBAAiB,EAAE,WAAW,CAAC,SAAS,CAAC;IAC1C,CAAC,+BAA+B,EAAE,WAAW,CAAC,kBAAkB,CAAC;IACjE,CAAC,oBAAoB,EAAE,WAAW,CAAC,OAAO,CAAC;IAC3C,CAAC,sBAAsB,EAAE,WAAW,CAAC,gBAAgB,CAAC;IACtD,CAAC,iBAAiB,EAAE,WAAW,CAAC,gBAAgB,CAAC;IACjD,CAAC,6BAA6B,EAAE,WAAW,CAAC,aAAa,CAAC;CAClD,CAAC;AAaX,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kCAAkC,CAAC,GAAW;IACrD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,GAAG,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,CAAC;QAEZ,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACvB,CAAC,IAAI,CAAC,CAAC;oBACP,MAAM,IAAI,CAAC,CAAC;oBACZ,SAAS;gBACX,CAAC;gBACD,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAC9B,qGAAqG,CACtG,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAAC,sDAAsD,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,WAAW,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,IAAI,sBAAsB,CAC9B,sHAAsH,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,SAAS;QAAE,MAAM,IAAI,sBAAsB,CAAC,6BAA6B,CAAC,CAAC;AACjF,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,IAAI,sBAAsB,CAAC,gDAAgD,cAAc,cAAc,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC/D,6FAA6F;IAC7F,gCAAgC;IAChC,kCAAkC,CAAC,OAAO,CAAC,CAAC;IAE5C,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,kBAAkB,GAAG,cAAc,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,8CAA8C,OAAO,IAAI,GAAG,oBAAoB,gBAAgB,IAAI,CAAC;IAEpH,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAEjB,MAAM,YAAY,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,cAAc,CAAC,CAAC;IAChG,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,8DAA8D,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAEX,CAAC;IACd,MAAM,SAAS,GAAG,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,sBAAsB,CAAC,iEAAiE,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC;IACrD,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;QAClD,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,kBAAkB;QAC5D,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,sBAAsB,CAAC,kDAAkD,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC;IAC1C,MAAM,eAAe,GAAG,MAAM;SAC3B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,kBAAkB,CAAC;SACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACvF,IACE,eAAe,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAChD,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,EAC/D,CAAC;QACD,MAAM,IAAI,sBAAsB,CAAC,8DAA8D,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,kBAAkB,CACrF,CAAC;IACF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,sBAAsB,CAAC,4EAA4E,CAAC,CAAC;IACjH,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,qBAAqB,EAAE,CAAC;QACxD,IAAI,SAAS,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,sBAAsB,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,SAAS;SACtB,2BAA2B,CAAC,WAAW,CAAC,aAAa,CAAC;SACtD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,sBAAsB,CAAC,2CAA2C,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/adt/table-query.d.ts

@@ -0,0 +1,41 @@
+/** Safe SQL builder and row-limit helpers for ADT data-preview requests. */
+/** Coerce a caller-supplied row limit into [1, MAX_TABLE_QUERY_ROWS]. */
+export declare function clampPreviewRows(requested: number | undefined, fallback?: number): number;
+/**
+ * Validate a caller-supplied SQL identifier exactly. It is NEVER rewritten.
+ *
+ * The previous implementation stripped disallowed characters (`raw.toUpperCase().replace(/[^\w/]/g, '')`).
+ * That made the identifier ARC-1 authorized differ from the identifier it executed: `USR02$` was checked
+ * as `USR02$` but executed as `USR02`. Silent rewriting is therefore banned outright — including when
+ * the blocklist is off, so the identifier contract does not depend on policy state. The only permitted
+ * transformation is ASCII case folding, which is what makes "checked name" and "executed name"
+ * byte-for-byte equal.
+ */
+export declare function exactSqlIdentifier(raw: string, kind: 'table' | 'column' | 'field'): string;
+/**
+ * Build a safe static SELECT from structured TABLE_QUERY parameters.
+ *
+ * Identifiers are validated, not sanitized; values are quoted and escaped, and IN/NOT IN values
+ * cannot become subqueries. Pass an already-canonical table name when the caller has authorized it,
+ * so the authorized and executed identities are the same string.
+ */
+export declare function buildTableQuerySql(tableName: string, columns?: string[], where?: Array<{
+    field: string;
+    op: string;
+    value?: string;
+}>): string;
+/**
+ * Execute statements that have ALREADY been authorized by the data-source policy.
+ *
+ * Kept beside the SQL builder rather than in the ADT facade, but deliberately NOT exported as a
+ * public client method: authorization and execution must stay inside one private client operation so
+ * no caller can obtain a reusable "already authorized" handle.
+ */
+export declare function executeDataPreviewStatements(post: (sql: string, rowLimit: number) => Promise<string>, parse: (body: string) => {
+    columns: string[];
+    rows: Record<string, string>[];
+}, statements: string[], rowLimit: number): Promise<{
+    columns: string[];
+    rows: Record<string, string>[];
+}>;
+//# sourceMappingURL=table-query.d.ts.map

package/dist/adt/table-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table-query.d.ts","sourceRoot":"","sources":["../../src/adt/table-query.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAoC5E,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,SAAM,GAAG,MAAM,CAGtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAE1F;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,EAAE,EAClB,KAAK,CAAC,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3D,MAAM,CAmBR;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,EACxD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;CAAE,EAC9E,UAAU,EAAE,MAAM,EAAE,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;CAAE,CAAC,CAWhE"}

package/dist/adt/table-query.js

@@ -0,0 +1,99 @@
+/** Safe SQL builder and row-limit helpers for ADT data-preview requests. */
+import { canonicalDataSourceName } from './data-source-name.js';
+/** Allowed SQL comparison operators for TABLE_QUERY where conditions. */
+const ALLOWED_OPS = new Set([
+    '=',
+    '!=',
+    '<>',
+    '<',
+    '<=',
+    '>',
+    '>=',
+    'LIKE',
+    'NOT LIKE',
+    'IN',
+    'NOT IN',
+    'IS NULL',
+    'IS NOT NULL',
+]);
+// BETWEEN is intentionally excluded: the value would require parsing "low AND high"
+// where AND is a reserved word, making safe escaping complex and error-prone.
+// Use two separate conditions (>= low, <= high) instead.
+/** Build a safe IN/NOT IN list from comma-separated raw values. */
+function buildInList(raw) {
+    const trimmed = raw.trim();
+    const inner = trimmed.startsWith('(') && trimmed.endsWith(')') ? trimmed.slice(1, -1) : trimmed;
+    const parts = inner.split(',').map((part) => `'${part.trim().replace(/'/g, "''")}'`);
+    return `(${parts.join(', ')})`;
+}
+/** Upper bound for an in-memory TABLE_QUERY result. */
+const MAX_TABLE_QUERY_ROWS = 10_000;
+/** Coerce a caller-supplied row limit into [1, MAX_TABLE_QUERY_ROWS]. */
+export function clampPreviewRows(requested, fallback = 100) {
+    if (requested === undefined || !Number.isFinite(requested) || requested < 1)
+        return fallback;
+    return Math.min(Math.floor(requested), MAX_TABLE_QUERY_ROWS);
+}
+/**
+ * Validate a caller-supplied SQL identifier exactly. It is NEVER rewritten.
+ *
+ * The previous implementation stripped disallowed characters (`raw.toUpperCase().replace(/[^\w/]/g, '')`).
+ * That made the identifier ARC-1 authorized differ from the identifier it executed: `USR02$` was checked
+ * as `USR02$` but executed as `USR02`. Silent rewriting is therefore banned outright — including when
+ * the blocklist is off, so the identifier contract does not depend on policy state. The only permitted
+ * transformation is ASCII case folding, which is what makes "checked name" and "executed name"
+ * byte-for-byte equal.
+ */
+export function exactSqlIdentifier(raw, kind) {
+    return canonicalDataSourceName(raw, `TABLE_QUERY ${kind} name`);
+}
+/**
+ * Build a safe static SELECT from structured TABLE_QUERY parameters.
+ *
+ * Identifiers are validated, not sanitized; values are quoted and escaped, and IN/NOT IN values
+ * cannot become subqueries. Pass an already-canonical table name when the caller has authorized it,
+ * so the authorized and executed identities are the same string.
+ */
+export function buildTableQuerySql(tableName, columns, where) {
+    const safeTable = exactSqlIdentifier(tableName, 'table');
+    const colList = columns?.length ? columns.map((column) => exactSqlIdentifier(column, 'column')).join(', ') : '*';
+    let sql = `SELECT ${colList} FROM ${safeTable}`;
+    if (where?.length) {
+        const clauses = where.map(({ field, op, value }) => {
+            const safeField = exactSqlIdentifier(field, 'field');
+            const safeOp = op.trim().toUpperCase();
+            if (!ALLOWED_OPS.has(safeOp))
+                throw new Error(`TABLE_QUERY: operator "${op}" is not allowed`);
+            if (safeOp === 'IS NULL' || safeOp === 'IS NOT NULL')
+                return `${safeField} ${safeOp}`;
+            if (safeOp === 'IN' || safeOp === 'NOT IN')
+                return `${safeField} ${safeOp} ${buildInList(String(value ?? ''))}`;
+            return `${safeField} ${safeOp} '${String(value ?? '').replace(/'/g, "''")}'`;
+        });
+        sql += ` WHERE ${clauses.join(' AND ')}`;
+    }
+    // ADT freestyle SQL rejects ORDER BY on NW 7.50/7.51; callers sort client-side.
+    return sql;
+}
+/**
+ * Execute statements that have ALREADY been authorized by the data-source policy.
+ *
+ * Kept beside the SQL builder rather than in the ADT facade, but deliberately NOT exported as a
+ * public client method: authorization and execution must stay inside one private client operation so
+ * no caller can obtain a reusable "already authorized" handle.
+ */
+export async function executeDataPreviewStatements(post, parse, statements, rowLimit) {
+    const rows = [];
+    let columns = [];
+    for (const statement of statements) {
+        const remaining = rowLimit - rows.length;
+        if (remaining <= 0)
+            break;
+        const chunk = parse(await post(statement, remaining));
+        if (columns.length === 0)
+            columns = chunk.columns;
+        rows.push(...chunk.rows);
+    }
+    return { columns, rows: rows.slice(0, rowLimit) };
+}
+//# sourceMappingURL=table-query.js.map

package/dist/adt/table-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table-query.js","sourceRoot":"","sources":["../../src/adt/table-query.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAE5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,yEAAyE;AACzE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,GAAG;IACH,IAAI;IACJ,MAAM;IACN,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,aAAa;CACd,CAAC,CAAC;AAEH,oFAAoF;AACpF,8EAA8E;AAC9E,yDAAyD;AAEzD,mEAAmE;AACnE,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACjC,CAAC;AAED,uDAAuD;AACvD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,SAA6B,EAAE,QAAQ,GAAG,GAAG;IAC5E,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAkC;IAChF,OAAO,uBAAuB,CAAC,GAAG,EAAE,eAAe,IAAI,OAAO,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,OAAkB,EAClB,KAA4D;IAE5D,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACjH,IAAI,GAAG,GAAG,UAAU,OAAO,SAAS,SAAS,EAAE,CAAC;IAEhD,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YACjD,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC;YAC9F,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,aAAa;gBAAE,OAAO,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;YACtF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,GAAG,SAAS,IAAI,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAChH,OAAO,GAAG,SAAS,IAAI,MAAM,KAAK,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,GAAG,IAAI,UAAU,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,gFAAgF;IAChF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAwD,EACxD,KAA8E,EAC9E,UAAoB,EACpB,QAAgB;IAEhB,MAAM,IAAI,GAA6B,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;AACpD,CAAC"}

package/dist/adt/xml-parser.d.ts

@@ -79,21 +79,6 @@ export declare function parsePackageContents(xml: string): Array<{
  * the resolver relies on this to fail closed.
  */
 export declare function parseSubpackageNodestructure(xml: string): string[];
-/**
- * Parse table contents (datapreview response).
- *
- * SAP ADT returns two possible formats for data preview:
- *
- * Format 1 (older/asx): COLUMNS/COLUMN/METADATA + DATASET/DATA
- * Format 2 (newer/dataPreview namespace): columns/metadata + dataSet/data
- *
- * After namespace stripping, both converge but with different casing.
- * We try both patterns with fallback.
- */
-export declare function parseTableContents(xml: string): {
-    columns: string[];
-    rows: Record<string, string>[];
-};
 /** Metrics ADT returns alongside a datapreview result (already in the body, normally discarded). */
 export interface DataPreviewMeta {
     /** True number of rows the query matched, independent of the rowNumber cap. */
@@ -103,6 +88,16 @@ export interface DataPreviewMeta {
     /** The actual OpenSQL ADT generated and ran (whitespace-collapsed). */
     executedQueryString?: string;
 }
+export interface DataPreviewResult extends DataPreviewMeta {
+    columns: string[];
+    rows: Record<string, string>[];
+}
+/** Parse data-preview rows and metrics from one shared fast-xml-parser object tree. */
+export declare function parseDataPreviewResult(xml: string): DataPreviewResult;
+export declare function parseTableContents(xml: string): {
+    columns: string[];
+    rows: Record<string, string>[];
+};
 /**
  * Parse the scalar metrics from a datapreview response — `totalRows`, `queryExecutionTime`,
  * `executedQueryString`. All optional: absent fields are omitted. Reads the same body

package/dist/adt/xml-parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xml-parser.d.ts","sourceRoot":"","sources":["../../src/adt/xml-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EACV,eAAe,EAEf,mBAAmB,EAEnB,sBAAsB,EACtB,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EACf,UAAU,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EAEd,gBAAgB,EAGhB,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAoED,0CAA0C;AAC1C,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAUjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAczE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBlE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;CAAE,CA6CrG;AAED,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+GAA+G;IAC/G,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAqBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBhG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAcpH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAetE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAgB9F;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAiBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CA0BvE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAyCzE;AAsCD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAyC3D;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CA0BrE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAuB3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAiDtF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,6BAA6B,CA2CzF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAYrE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAoDrE;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,kBAAkB,CAAC,EAAE;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,GACjF,IAAI,CAmBN;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA4C9F;AAED;;;;;;;gFAOgF;AAChF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuCvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAiB/D;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAazD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAuBjF;AAID;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;sGACsG;AACtG,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOhC;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBvF;AAED,mHAAmH;AACnH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,CA0BxD;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS1E;AA2BD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CA+B7D;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,0BAA0B,CAwBxG;AAqCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE,CAqDlE;AAsDD,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAuCjE;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,CA2KnF"}
+{"version":3,"file":"xml-parser.d.ts","sourceRoot":"","sources":["../../src/adt/xml-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EACV,eAAe,EAEf,mBAAmB,EAEnB,sBAAsB,EACtB,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EACf,UAAU,EACV,6BAA6B,EAC7B,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EAEd,gBAAgB,EAGhB,kBAAkB,EAClB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAoED,0CAA0C;AAC1C,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,EAAE,CAUjE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAczE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBlE;AA6DD,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+GAA+G;IAC/G,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CAChC;AAuBD,uFAAuF;AACvF,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAIrE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;CAAE,CAGrG;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAGjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBhG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAcpH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAetE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAgB9F;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAiBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CA0BvE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAyCzE;AAsCD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAyC3D;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CA0BrE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAuB3E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAiDtF;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,6BAA6B,CA2CzF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAYrE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAoDrE;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,mBAAmB,EACzB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,kBAAkB,CAAC,EAAE;IAAE,qBAAqB,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,GACjF,IAAI,CAmBN;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA4C9F;AAED;;;;;;;gFAOgF;AAChF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuCvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAiB/D;AAID;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAazD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE,CAuBjF;AAID;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;sGACsG;AACtG,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOhC;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBvF;AAED,mHAAmH;AACnH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,CA0BxD;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS1E;AA2BD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CA+B7D;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,0BAA0B,CAwBxG;AAqCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE,CAqDlE;AAsDD,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAuCjE;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,CA2KnF"}

package/dist/adt/xml-parser.js

@@ -204,8 +204,7 @@ export function parseSubpackageNodestructure(xml) {
  * After namespace stripping, both converge but with different casing.
  * We try both patterns with fallback.
  */
-export function parseTableContents(xml) {
-    const parsed = parseXml(xml);
+function parseTableContentsObject(parsed) {
     // Try old format first: abap > values > COLUMNS > COLUMN
     let columns = getDeepArray(parsed, ['abap', 'values', 'COLUMNS', 'COLUMN']);
     if (columns.length === 0) {
@@ -243,15 +242,7 @@ export function parseTableContents(xml) {
     }
     return { columns: colNames, rows };
 }
-/**
- * Parse the scalar metrics from a datapreview response — `totalRows`, `queryExecutionTime`,
- * `executedQueryString`. All optional: absent fields are omitted. Reads the same body
- * `parseTableContents` does; surfaced so SAPQuery can report real row counts + server-side timing.
- */
-export function parseDataPreviewMeta(xml) {
-    if (!xml || xml.trim().length === 0)
-        return {};
-    const parsed = parseXml(xml);
+function parseDataPreviewMetaObject(parsed) {
     const td = (parsed.tableData ?? parsed);
     const meta = {};
     // Guard blank values too: an empty <totalRows/> would otherwise coerce via Number('') to a spurious 0.
@@ -270,6 +261,28 @@ export function parseDataPreviewMeta(xml) {
     }
     return meta;
 }
+/** Parse data-preview rows and metrics from one shared fast-xml-parser object tree. */
+export function parseDataPreviewResult(xml) {
+    if (!xml || xml.trim().length === 0)
+        return { columns: [], rows: [] };
+    const parsed = parseXml(xml);
+    return { ...parseTableContentsObject(parsed), ...parseDataPreviewMetaObject(parsed) };
+}
+export function parseTableContents(xml) {
+    if (!xml || xml.trim().length === 0)
+        return { columns: [], rows: [] };
+    return parseTableContentsObject(parseXml(xml));
+}
+/**
+ * Parse the scalar metrics from a datapreview response — `totalRows`, `queryExecutionTime`,
+ * `executedQueryString`. All optional: absent fields are omitted. Reads the same body
+ * `parseTableContents` does; surfaced so SAPQuery can report real row counts + server-side timing.
+ */
+export function parseDataPreviewMeta(xml) {
+    if (!xml || xml.trim().length === 0)
+        return {};
+    return parseDataPreviewMetaObject(parseXml(xml));
+}
 /**
  * Parse installed components response.
  *