firstly 0.10.6 → 0.10.8

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # firstly
 
+## 0.10.8
+
+### Patch Changes
+
+- [#393](https://github.com/jycouet/firstly/pull/393) [`37feeb8`](https://github.com/jycouet/firstly/commit/37feeb820a2a7867a449d14181e3be9f72df3ec5) Thanks [@jycouet](https://github.com/jycouet)! - Dependencies are `^` ranges instead of exact pins, so apps share one copy of each with their own deps. `tailwindcss` is no longer a dependency (firstly never imports it). `vite-plugin-kit-routes` 1.1.1 and `vite-plugin-stripper` 0.10.6 publish ranges too, so `@kitql/*` and `esrap` dedupe as well.
+
+## 0.10.7
+
+### Patch Changes
+
+- [#388](https://github.com/jycouet/firstly/pull/388) [`7eca18a`](https://github.com/jycouet/firstly/commit/7eca18af4a55e2481dc81d38ba9e4f7f0d0f01a0) Thanks [@jycouet](https://github.com/jycouet)! - sqlAdmin: reads now run as a read-only Postgres role upserted at boot (`readPool`, default `'auto'`, `false` to opt out, or your own pool); `tokens.pool` is removed. SQL and results now travel encoded (`ffsql1:`) from `<SqlAdmin />` and `ff-sql`, so WAF rules stop blocking them; plain SQL still works.
+
 ## 0.10.6
 
 ### Patch Changes

package/bin/args.d.ts

@@ -1,10 +1,11 @@
 /**
  * @param {string[]} argv
- * @returns {{ help: boolean, json: boolean, origin?: string, apiPath?: string, sql: string, error?: string }}
+ * @returns {{ help: boolean, json: boolean, raw: boolean, origin?: string, apiPath?: string, sql: string, error?: string }}
  */
 export function parseArgs(argv: string[]): {
     help: boolean;
     json: boolean;
+    raw: boolean;
     origin?: string;
     apiPath?: string;
     sql: string;

package/bin/args.js

@@ -2,7 +2,7 @@
 // the cli. Plain JS like its caller: bin/ ships unbuilt.
 
 /** Flags that take no value. */
-const BOOLEAN = ['json', 'help']
+const BOOLEAN = ['json', 'help', 'raw']
 /** Flags that need one, as `--x=y` or `--x y`. */
 const VALUED = ['origin', 'api-path']
 
@@ -13,11 +13,11 @@ const FLAG = /^--[a-z][\w-]*(=|$)/
 
 /**
  * @param {string[]} argv
- * @returns {{ help: boolean, json: boolean, origin?: string, apiPath?: string, sql: string, error?: string }}
+ * @returns {{ help: boolean, json: boolean, raw: boolean, origin?: string, apiPath?: string, sql: string, error?: string }}
  */
 export function parseArgs(argv) {
 	/** @type {any} */
-	const out = { help: false, json: false, sql: '' }
+	const out = { help: false, json: false, raw: false, sql: '' }
 	const positional = []
 	const seen = new Set()
 

package/bin/ff-sql.js

@@ -15,6 +15,7 @@ const HELP = `ff-sql - run SQL through a firstly sql token
   SQL
 
   --json          raw JSON instead of a table
+  --raw           send plain SQL, not ffsql1: (servers older than the encoding)
   --              end of flags, everything after is SQL
   --origin=URL    the app to query (or FF_SQL_ORIGIN)
   --api-path=P    remult api root (default /api)
@@ -27,6 +28,13 @@ camelCase and need double quotes: "createdAt", not created_at. A heredoc avoids
 fighting the shell over single quotes, and keeps the token out of the line.`
 
 const TRAILING_SLASH = /\/$/
+// Same scheme as `sqlWire.ts`: keeps WAF rules from matching SQL in transit.
+const WIRE = 'ffsql1:'
+const encode = (s) => WIRE + Buffer.from(s, 'utf8').toString('base64')
+const decode = (s) =>
+	typeof s === 'string' && s.startsWith(WIRE)
+		? Buffer.from(s.slice(WIRE.length), 'base64').toString('utf8')
+		: s
 
 const cli = parseArgs(process.argv.slice(2))
 
@@ -65,7 +73,7 @@ try {
 	res = await fetch(`${origin.replace(TRAILING_SLASH, '')}${apiPath}/ff/sqlAdmin/exec`, {
 		method: 'POST',
 		headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
-		body: JSON.stringify({ args: [cmd] }),
+		body: JSON.stringify({ args: [cli.raw ? cmd : encode(cmd)] }),
 	})
 } catch (err) {
 	console.error(`${origin} unreachable: ${err.message}`)
@@ -75,11 +83,13 @@ try {
 const body = await res.json().catch(() => null)
 if (!res.ok) {
 	// 403 here is almost always a dead token: expired, revoked, or minted elsewhere.
-	console.error(`${res.status} ${body?.message ?? res.statusText}`)
+	console.error(`${res.status} ${decode(body?.message) ?? res.statusText}`)
 	process.exit(1)
 }
 
-const { rows, rowCount, took } = body.data ?? body
+let data = body.data ?? body
+if (typeof data === 'string') data = JSON.parse(decode(data))
+const { rows, rowCount, took } = data
 // Table and rows on stdout, the summary on stderr, so `| jq` and `> file` stay clean.
 const out = new Console(process.stdout)
 if (cli.json) out.log(JSON.stringify(rows, null, 2))

package/esm/sqlAdmin/SqlAdminController.d.ts

@@ -47,17 +47,19 @@ export type SqlTokensOptions = {
     apiPath?: string;
     /** @default 30 */
     callLogRetentionDays?: number;
-    /** Override the pool used by `read` tokens. Defaults to the Postgres pool behind the data provider. */
-    pool?: SqlTokenPool;
 };
 export declare const SERVER_ONLY = "sqlAdmin: server-only";
 export declare const SQL_ADMINS: ("FF_Role.Admin" | "SqlAdmin.Admin")[];
+export declare function getDb(): SqlDatabase;
+/** The pg pool remult wraps, if any. `_getSourceSql` is internal but has been stable since remult 1. */
+export declare function poolFrom(db: SqlDatabase): SqlTokenPool | undefined;
 export declare class SqlAdminController {
     /** Optional override set by the `sqlAdmin()` module's `initApi`. Falls back to `SqlDatabase.getDb()`. */
     static dp?: SqlDatabase;
     /** Set by the `sqlAdmin()` module's `initApi`. */
     static options: {
         tokens?: SqlTokensOptions;
+        readPool?: SqlTokenPool;
     };
     /**
      * @param cmd SQL to run.
@@ -67,8 +69,11 @@ export declare class SqlAdminController {
      *   want to mutate - the UI gates this behind an explicit checkbox.
      *
      * With a sql token the token decides, not the caller.
+     *
+     * A `cmd` sent through `encodeSqlWire` gets its result (or error message)
+     * back encoded the same way, as a string; plain SQL gets plain JSON.
      */
-    static exec(cmd: string, capabilities?: SqlCapability[]): Promise<SqlResult>;
+    static exec(cmd: string, capabilities?: SqlCapability[]): Promise<SqlResult | string>;
     private static run;
     private static execAsToken;
     /**

package/esm/sqlAdmin/SqlAdminController.js

@@ -5,21 +5,25 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 import { BackendMethod, remult, repo, SqlDatabase } from 'remult';
+import { Log } from '@kitql/helpers';
 import { FF_Role } from '../core/common';
 import { Roles_SqlAdmin } from './Roles_SqlAdmin';
 import { SQL_CAPABILITIES, SQL_TOKEN_TTLS, SqlToken, SqlTokenCall, } from './sqlTokenEntities';
+import { decodeSqlWire, encodeSqlWire, isSqlWire } from './sqlWire';
 // Thrown when a server-only body runs on the client (its `import.meta.env.SSR` block is gone there).
 export const SERVER_ONLY = 'sqlAdmin: server-only';
 export const SQL_ADMINS = [Roles_SqlAdmin.SqlAdmin_Admin, FF_Role.FF_Role_Admin];
 const CALL_LOG_CMD_MAX = 4000;
+// Not `log` from '../index': that barrel pulls the svelte components into the server.
+const log = new Log('sqlAdmin');
 /** Retention is a housekeeping sweep, not something to pay for on every query. */
 const CALL_LOG_SWEEP_EVERY_MS = 3_600_000;
 let lastCallLogSweep = 0;
-function getDb() {
+export function getDb() {
     return SqlAdminController.dp ?? SqlDatabase.getDb();
 }
 /** The pg pool remult wraps, if any. `_getSourceSql` is internal but has been stable since remult 1. */
-function poolFrom(db) {
+export function poolFrom(db) {
     const pool = db._getSourceSql?.()?.pool;
     return typeof pool?.connect === 'function' ? pool : undefined;
 }
@@ -36,12 +40,35 @@ export class SqlAdminController {
      *   want to mutate - the UI gates this behind an explicit checkbox.
      *
      * With a sql token the token decides, not the caller.
+     *
+     * A `cmd` sent through `encodeSqlWire` gets its result (or error message)
+     * back encoded the same way, as a string; plain SQL gets plain JSON.
      */
     static async exec(cmd, capabilities = ['read']) {
-        const token = remult.context.sqlToken;
-        if (token)
-            return SqlAdminController.execAsToken(token, cmd);
-        return SqlAdminController.run(cmd, capabilities);
+        const wire = isSqlWire(cmd);
+        if (wire)
+            cmd = decodeSqlWire(cmd);
+        try {
+            const token = remult.context.sqlToken;
+            const res = token
+                ? await SqlAdminController.execAsToken(token, cmd)
+                : await SqlAdminController.run(cmd, capabilities);
+            return wire ? encodeSqlWire(JSON.stringify(res)) : res;
+        }
+        catch (err) {
+            if (!wire)
+                throw err;
+            const msg = err instanceof Error ? err.message : String(err);
+            // remult logs the message it sends, so the clear one goes to the server log here.
+            log.error(msg);
+            // No stack: it repeats the message in clear. Status flags kept, or a 403 turns into a 400.
+            const { httpStatusCode, isForbiddenError } = (err ?? {});
+            throw Object.assign(new Error(encodeSqlWire(msg)), {
+                stack: undefined,
+                httpStatusCode,
+                isForbiddenError,
+            });
+        }
     }
     static async run(cmd, capabilities) {
         if (import.meta.env.SSR) {
@@ -54,7 +81,8 @@ export class SqlAdminController {
                     return { rows, rowCount: rows.length, took: performance.now() - start };
                 }
                 const { readOnlySql } = await import('./server/readOnlySql');
-                return await readOnlySql(db, SqlAdminController.options.tokens?.pool ?? poolFrom(db), cmd);
+                const o = SqlAdminController.options;
+                return await readOnlySql(db, o.readPool ?? poolFrom(db), cmd);
             }
             catch (err) {
                 const { enrichSqlError } = await import('./server/sqlError');

package/esm/sqlAdmin/index.d.ts

@@ -3,6 +3,7 @@ export { Roles_SqlAdmin } from './Roles_SqlAdmin';
 export { SqlAdminController, type SqlResult, type SqlTokensOptions } from './SqlAdminController';
 export { SqlDriftController, type SqlDriftFlag } from './SqlDriftController';
 export { SQL_CAPABILITIES, SQL_TOKEN_TTLS, SqlToken, SqlTokenCall, type SqlCapability, type SqlTokenTtl, } from './sqlTokenEntities';
+export { decodeSqlWire, encodeSqlWire, isSqlWire, SQL_WIRE_PREFIX } from './sqlWire';
 export { default as SqlAdmin } from './ui/SqlAdmin.svelte';
 export { default as SqlDrift } from './ui/SqlDrift.svelte';
 export { default as SqlTokens } from './ui/SqlTokens.svelte';

package/esm/sqlAdmin/index.js

@@ -3,6 +3,7 @@ export { Roles_SqlAdmin } from './Roles_SqlAdmin';
 export { SqlAdminController } from './SqlAdminController';
 export { SqlDriftController } from './SqlDriftController';
 export { SQL_CAPABILITIES, SQL_TOKEN_TTLS, SqlToken, SqlTokenCall, } from './sqlTokenEntities';
+export { decodeSqlWire, encodeSqlWire, isSqlWire, SQL_WIRE_PREFIX } from './sqlWire';
 export { default as SqlAdmin } from './ui/SqlAdmin.svelte';
 export { default as SqlDrift } from './ui/SqlDrift.svelte';
 export { default as SqlTokens } from './ui/SqlTokens.svelte';

package/esm/sqlAdmin/server/index.d.ts

@@ -1,6 +1,6 @@
 import { type ClassType, type SqlDatabase } from 'remult';
 import { Module } from 'remult/server';
-import { type SqlTokensOptions } from '../SqlAdminController';
+import { type SqlTokenPool, type SqlTokensOptions } from '../SqlAdminController';
 import { type SqlDriftOptions } from '../SqlDriftController';
 export type { SqlTokensOptions, SqlTokenPool } from '../SqlAdminController';
 export type { SqlDriftFlag, SqlDriftOptions } from '../SqlDriftController';
@@ -33,6 +33,16 @@ export type SqlAdminOptions = {
      * @default true
      */
     sqlAdmin?: boolean;
+    /**
+     * Run `read` queries (console and tokens) as a read-only role instead of the
+     * app role. `'auto'` upserts `ff_readonly_<db>` at boot through the app's own
+     * pool (needs CREATEROLE), or pass a pool you connected yourself. `false`, or a
+     * database other than Postgres, leaves reads to the READ ONLY transaction alone.
+     *
+     * @default 'auto'
+     * @example readPool: new pg.Pool({ connectionString: env.DATABASE_URL_READONLY, max: 2 })
+     */
+    readPool?: 'auto' | false | SqlTokenPool;
     /**
      * Bearer tokens that can run SQL from outside a browser session (a script,
      * an AI on a dev machine). Nothing is registered unless set - no entities,

package/esm/sqlAdmin/server/index.js

@@ -2,7 +2,7 @@ import { remult, repo } from 'remult';
 import { Module } from 'remult/server';
 import { yellow } from '@kitql/helpers';
 import { log } from '..';
-import { SqlAdminController } from '../SqlAdminController';
+import { getDb, poolFrom, SqlAdminController, } from '../SqlAdminController';
 import { SqlDriftController } from '../SqlDriftController';
 import { isSqlTokenLive, SqlToken, sqlTokenEntities } from '../sqlTokenEntities';
 import { hashToken } from './token';
@@ -30,6 +30,27 @@ function readPathname(req) {
         return '';
     }
 }
+async function resolveReadPool(opt = 'auto') {
+    if (opt !== 'auto')
+        return opt || undefined;
+    const app = poolFrom(getDb());
+    // Not Postgres (or a custom `dp`): nothing to create, the transaction guard applies.
+    if (!app)
+        return undefined;
+    try {
+        const { ensureReadOnlyPool } = await import('./readOnlyRole');
+        const ro = await ensureReadOnlyPool(app);
+        if (ro.updated)
+            log.info(`reads run as ${yellow(ro.role)} (role created or updated).`);
+        return ro.pool;
+    }
+    catch (err) {
+        // Boot must survive: the READ ONLY transaction still guards reads.
+        const msg = err instanceof Error ? err.message : String(err);
+        log.error(`readPool: 'auto' failed (${msg}) - reads use the app role. ${yellow('readPool: false')} silences this.`);
+        return undefined;
+    }
+}
 /**
  * Drop-in SQL admin endpoint + companion `<SqlAdmin />` component (`firstly/sqlAdmin`).
  *
@@ -76,7 +97,10 @@ export const sqlAdmin = (opts) => {
                 SqlAdminController.dp = await opts.dp();
                 SqlDriftController.dp = SqlAdminController.dp;
             }
-            SqlAdminController.options = { tokens };
+            SqlAdminController.options = {
+                tokens,
+                readPool: enabled ? await resolveReadPool(opts?.readPool) : undefined,
+            };
             SqlDriftController.options = driftOn ? drift : undefined;
             if (enabled)
                 log.info(`AI Hint: visit ${yellow(path)} to query raw SQL.`);

package/esm/sqlAdmin/server/readOnlyRole.d.ts

@@ -0,0 +1,15 @@
+import type { SqlTokenPool } from '../SqlAdminController';
+export declare const readOnlyRoleName: (db: string) => string;
+/**
+ * Returns a pool connected as a login role that can only SELECT in this
+ * database. Per-database grants rather than `pg_read_all_data`: that one
+ * reaches every database of the cluster. A boot where the role is already
+ * right costs one login and one catalog query; anything off (new schema,
+ * rotated app password, missing grant) re-runs the full setup. Needs
+ * CREATEROLE on the app role.
+ */
+export declare function ensureReadOnlyPool(app: SqlTokenPool): Promise<{
+    pool: SqlTokenPool;
+    role: string;
+    updated: boolean;
+}>;

package/esm/sqlAdmin/server/readOnlyRole.js

@@ -0,0 +1,123 @@
+import { createHmac, randomBytes } from 'node:crypto';
+const NON_IDENT = /[^a-z0-9_]/g;
+const MAX_IDENT = 63;
+const DUPLICATE_OBJECT = '42710';
+const STATEMENT_TIMEOUT = '30s';
+/** Schemas the app can grant on: it owns them, or is a member of their owner. */
+const GRANTABLE_SCHEMA = `n.nspname !~ '^pg_' and n.nspname <> 'information_schema' and pg_has_role(n.nspowner, 'USAGE')`;
+/** One round trip: is the role still exactly what setup would leave behind? */
+const STATE_SQL = `
+select
+  r.rolsuper or r.rolcreaterole or r.rolcreatedb or r.rolreplication or r.rolbypassrls as extra,
+  coalesce(r.rolconfig @> array['default_transaction_read_only=on', 'statement_timeout=${STATEMENT_TIMEOUT}'], false)
+  and not exists (
+    select 1 from pg_namespace n
+    where ${GRANTABLE_SCHEMA}
+      and (not has_schema_privilege(r.oid, n.oid, 'USAGE')
+        or not exists (
+          select 1 from pg_default_acl d, aclexplode(d.defaclacl) a
+          where d.defaclnamespace = n.oid and d.defaclobjtype = 'r'
+            and d.defaclrole = (select oid from pg_roles where rolname = current_user)
+            and a.grantee = r.oid and a.privilege_type = 'SELECT')))
+  and not exists (
+    select 1 from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where ${GRANTABLE_SCHEMA} and c.relkind in ('r', 'v', 'm', 'p', 'f')
+      and pg_has_role(c.relowner, 'USAGE')
+      and not has_table_privilege(r.oid, c.oid, 'SELECT')) as ready
+from pg_roles r where r.rolname = $1`;
+const quote = (s) => `"${s.replaceAll('"', '""')}"`;
+export const readOnlyRoleName = (db) => `ff_readonly_${db.toLowerCase().replace(NON_IDENT, '_')}`.slice(0, MAX_IDENT);
+/** The app's own password: every instance derives the same role password, nothing to store. */
+function appSecret(options) {
+    if (options.connectionString) {
+        const url = new URL(options.connectionString);
+        const pw = url.searchParams.get('password') || decodeURIComponent(url.password);
+        if (pw)
+            return pw;
+    }
+    if (typeof options.password === 'string' && options.password)
+        return options.password;
+    return process.env.PGPASSWORD || undefined;
+}
+function withCredentials(options, user, password) {
+    const { connectionString, ...rest } = options;
+    // pg lets the connection string win over `user`/`password`, so rewrite the URL itself.
+    // Query params, not userinfo: a hostless URL (unix socket) silently drops userinfo, and pg reads params first.
+    if (connectionString) {
+        const url = new URL(connectionString);
+        url.username = '';
+        url.password = '';
+        url.searchParams.set('user', user);
+        url.searchParams.set('password', password);
+        return { ...rest, connectionString: url.toString(), max: 2 };
+    }
+    return { ...rest, user, password, max: 2 };
+}
+/**
+ * Returns a pool connected as a login role that can only SELECT in this
+ * database. Per-database grants rather than `pg_read_all_data`: that one
+ * reaches every database of the cluster. A boot where the role is already
+ * right costs one login and one catalog query; anything off (new schema,
+ * rotated app password, missing grant) re-runs the full setup. Needs
+ * CREATEROLE on the app role.
+ */
+export async function ensureReadOnlyPool(app) {
+    const pool = app;
+    if (typeof pool.query !== 'function' || !pool.options)
+        throw new Error('not a pg pool');
+    const { rows } = await pool.query('select current_database() as db');
+    const db = rows[0].db;
+    const role = readOnlyRoleName(db);
+    const secret = appSecret(pool.options);
+    const password = secret
+        ? createHmac('sha256', secret).update(role).digest('hex')
+        : randomBytes(32).toString('hex');
+    const Pool = pool.constructor;
+    const ro = new Pool(withCredentials(pool.options, role, password));
+    const state = await readState(pool, ro, role);
+    // A role with the same name made by someone else must not become our reader.
+    if (state?.extra)
+        throw new Error(`role ${role} has more than read rights, refusing it`);
+    if (state?.ready)
+        return { pool: ro, role, updated: false };
+    await setup(pool, db, role, password);
+    // Handing back a pool that cannot log in would break every read instead of falling back.
+    if (!(await connectsAs(ro, role))) {
+        await ro.end?.().catch(() => { });
+        throw new Error(`role ${role} was set up but cannot log in (pg_hba, pooler user naming?)`);
+    }
+    return { pool: ro, role, updated: true };
+}
+async function readState(app, ro, role) {
+    const row = (await app.query(STATE_SQL, [role])).rows[0];
+    if (!row)
+        return undefined;
+    // Logging in proves the derived password still matches (the app's may have rotated).
+    const loggedIn = !row.extra && (await connectsAs(ro, role));
+    return { extra: row.extra, ready: loggedIn && row.ready === true };
+}
+/** As `role`, not merely connected: a dropped credential would log in as the app. */
+const connectsAs = (ro, role) => ro.query('select current_user as u').then((r) => r.rows[0]?.u === role, () => false);
+async function setup(pool, db, role, password) {
+    const r = quote(role);
+    try {
+        await pool.query(`CREATE ROLE ${r} LOGIN`);
+    }
+    catch (err) {
+        if (err?.code !== DUPLICATE_OBJECT)
+            throw err;
+    }
+    // Only a superuser may set NOSUPERUSER & co, hence the `extra` check instead.
+    await pool.query(`ALTER ROLE ${r} WITH LOGIN PASSWORD '${password}'`);
+    await pool.query(`ALTER ROLE ${r} SET default_transaction_read_only = on`);
+    await pool.query(`ALTER ROLE ${r} SET statement_timeout = '${STATEMENT_TIMEOUT}'`);
+    await pool.query(`GRANT CONNECT ON DATABASE ${quote(db)} TO ${r}`);
+    const schemas = await pool.query(`select n.nspname from pg_namespace n where ${GRANTABLE_SCHEMA}`);
+    for (const { nspname } of schemas.rows) {
+        const s = quote(nspname);
+        await pool.query(`GRANT USAGE ON SCHEMA ${s} TO ${r}`);
+        await pool.query(`GRANT SELECT ON ALL TABLES IN SCHEMA ${s} TO ${r}`);
+        // Tables the app creates later (remult ensureSchema, migrations).
+        await pool.query(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT SELECT ON TABLES TO ${r}`);
+    }
+}

package/esm/sqlAdmin/sqlWire.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Reversible wire encoding for SQL and its results. Not a secret (TLS + roles
+ * are the security): it only keeps WAF rule sets from pattern-matching
+ * `SELECT ... FROM` or Postgres error text in requests and responses.
+ * The version suffix leaves room for another scheme if a WAF learns to decode this one.
+ */
+export declare const SQL_WIRE_PREFIX = "ffsql1:";
+export declare const isSqlWire: (s: unknown) => s is string;
+export declare function encodeSqlWire(s: string): string;
+/** Anything without the prefix passes through: plain SQL keeps working. */
+export declare function decodeSqlWire(s: string): string;

package/esm/sqlAdmin/sqlWire.js

@@ -0,0 +1,28 @@
+/**
+ * Reversible wire encoding for SQL and its results. Not a secret (TLS + roles
+ * are the security): it only keeps WAF rule sets from pattern-matching
+ * `SELECT ... FROM` or Postgres error text in requests and responses.
+ * The version suffix leaves room for another scheme if a WAF learns to decode this one.
+ */
+export const SQL_WIRE_PREFIX = 'ffsql1:';
+/** Spreading a huge array into fromCharCode overflows the stack. */
+const CHUNK = 0x8000;
+export const isSqlWire = (s) => typeof s === 'string' && s.startsWith(SQL_WIRE_PREFIX);
+export function encodeSqlWire(s) {
+    const bytes = new TextEncoder().encode(s);
+    let bin = '';
+    for (let i = 0; i < bytes.length; i += CHUNK) {
+        bin += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+    }
+    return SQL_WIRE_PREFIX + btoa(bin);
+}
+/** Anything without the prefix passes through: plain SQL keeps working. */
+export function decodeSqlWire(s) {
+    if (!isSqlWire(s))
+        return s;
+    const bin = atob(s.slice(SQL_WIRE_PREFIX.length));
+    const bytes = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        bytes[i] = bin.charCodeAt(i);
+    return new TextDecoder().decode(bytes);
+}

package/esm/sqlAdmin/ui/SqlAdmin.svelte

@@ -11,14 +11,15 @@
 	 * can read them with `list_console_messages`.
 	 */
 	import { log } from '../index'
-	import { SqlAdminController } from '../SqlAdminController'
+	import { SqlAdminController, type SqlResult } from '../SqlAdminController'
+	import { decodeSqlWire, encodeSqlWire } from '../sqlWire'
 
 	const defaultQuery = `SELECT *
 FROM "public"."users"
 LIMIT 10`
 
 	let sqlInput = $state(defaultQuery)
-	let result: { rows: any[]; rowCount: number; took: number } | undefined = $state()
+	let result: SqlResult | undefined = $state()
 	let error = $state('')
 	let isLoading = $state(false)
 	let allowWrites = $state(false)
@@ -64,10 +65,19 @@ ORDER BY tablename, indexname`,
 		try {
 			error = ''
 			isLoading = true
-			result = await SqlAdminController.exec(sqlInput, allowWrites ? ['read', 'write'] : ['read'])
-			log.info('for AI:', JSON.stringify(result.rows))
-			log.info('for humans:', result)
-		} catch (e) {
+			// Encoded both ways: WAF rules block SQL text in requests and Postgres errors in responses.
+			const res = await SqlAdminController.exec(
+				encodeSqlWire(sqlInput),
+				allowWrites ? ['read', 'write'] : ['read'],
+			)
+			const r: SqlResult = typeof res === 'string' ? JSON.parse(decodeSqlWire(res)) : res
+			result = r
+			log.info('for AI:', JSON.stringify(r.rows))
+			log.info('for humans:', r)
+		} catch (e: any) {
+			if (typeof e?.message === 'string') e.message = decodeSqlWire(e.message)
+			// A stale table under a new error reads as this query's result.
+			result = undefined
 			error = JSON.stringify(e, null, 2)
 		} finally {
 			isLoading = false
@@ -171,13 +181,6 @@ ORDER BY tablename, indexname`,
 					Allow writes
 				</label>
 
-				{#if error}
-					<pre
-						class="flex-1 overflow-auto border border-destructive bg-destructive/10 p-3 text-sm text-destructive">{error.replaceAll(
-							'\\n',
-							'\n',
-						)}</pre>
-				{/if}
 				{#if result}
 					<div
 						class="flex flex-1 items-center justify-between gap-3 border border-border bg-muted p-3 text-sm text-muted-foreground"
@@ -187,6 +190,13 @@ ORDER BY tablename, indexname`,
 					</div>
 				{/if}
 			</div>
+			{#if error}
+				<pre
+					class="overflow-auto border border-destructive bg-destructive/10 p-3 text-sm text-destructive">{error.replaceAll(
+						'\\n',
+						'\n',
+					)}</pre>
+			{/if}
 		</form>
 		{#if result}
 			{#if result.rows && result.rows.length > 0}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firstly",
-  "version": "0.10.6",
+  "version": "0.10.8",
   "type": "module",
   "description": "Firstly, an opinionated Remult setup!",
   "bin": {
@@ -34,19 +34,18 @@
     }
   },
   "dependencies": {
-    "@kitql/helpers": "0.8.15",
-    "@layerstack/utils": "1.0.0",
-    "@mdi/js": "7.4.47",
-    "@types/nodemailer": "8.0.0",
-    "clsx": "2.1.1",
-    "cron": "4.4.0",
-    "esm-env": "1.2.2",
-    "nodemailer": "10.0.10",
-    "svelte-sonner": "1.2.1",
-    "tailwind-merge": "3.7.0",
-    "tailwindcss": "4.3.0",
-    "vite-plugin-kit-routes": "1.0.6",
-    "vite-plugin-stripper": "0.10.4"
+    "@kitql/helpers": "^0.8.15",
+    "@layerstack/utils": "^1.0.0",
+    "@mdi/js": "^7.4.47",
+    "@types/nodemailer": "^8.0.0",
+    "clsx": "^2.1.1",
+    "cron": "^4.4.0",
+    "esm-env": "^1.2.2",
+    "nodemailer": "^10.0.10",
+    "svelte-sonner": "^1.2.1",
+    "tailwind-merge": "^3.7.0",
+    "vite-plugin-kit-routes": "^1.1.1",
+    "vite-plugin-stripper": "^0.10.6"
   },
   "sideEffects": false,
   "exports": {