sql-dialect-master 1.1.1__tar.gz → 1.1.3__tar.gz

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: sql-dialect-master
-Version: 1.1.1
+Version: 1.1.3
 Summary: SQL Dialect Master - Multi-database SQL conversion engine
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: sqlglot>=25.0.0
+Requires-Dist: sqlglot<31.0.0,>=30.18.0
 Requires-Dist: streamlit>=1.38.0
 Requires-Dist: fastapi>=0.115.0
 Requires-Dist: uvicorn>=0.30.0
@@ -16,6 +16,7 @@ Requires-Dist: hypothesis>=6.112.0; extra == "dev"
 Requires-Dist: pytest>=8.3.0; extra == "dev"
 Requires-Dist: pytest-cov>=5.0.0; extra == "dev"
 Requires-Dist: httpx>=0.27.0; extra == "dev"
+Requires-Dist: requests>=2.31.0; extra == "dev"
 Provides-Extra: qa
 Requires-Dist: ruff>=0.6; extra == "qa"
 Requires-Dist: bandit>=1.7; extra == "qa"
@@ -31,7 +32,7 @@ Dynamic: license-file
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.1
+Current release: 1.1.3
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -95,6 +96,13 @@ python -m pip install -e ".[dev,semantic]"
 streamlit run sdm_local_v2.py
 ```
 
+After installing the package, the same workspace can be launched from any
+working directory with:
+
+```bash
+sdm-streamlit
+```
+
 Open http://localhost:8501 in your browser.
 
 ### Run FastAPI Backend

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/README.md

@@ -2,7 +2,7 @@
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.1
+Current release: 1.1.3
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -66,6 +66,13 @@ python -m pip install -e ".[dev,semantic]"
 streamlit run sdm_local_v2.py
 ```
 
+After installing the package, the same workspace can be launched from any
+working directory with:
+
+```bash
+sdm-streamlit
+```
+
 Open http://localhost:8501 in your browser.
 
 ### Run FastAPI Backend

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/backend/api/main.py

@@ -11,6 +11,7 @@ Enterprise-grade multi-database SQL conversion API:
 Exact counts are derived from the canonical data files at runtime —
 see backend.core.metadata — and must not be restated here.
 """
+import asyncio
 import logging
 import time
 from datetime import datetime
@@ -19,22 +20,41 @@ from typing import Any, Dict, List, Optional
 from fastapi import FastAPI, HTTPException, Query, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
+from starlette.concurrency import run_in_threadpool
 from pydantic import BaseModel, ConfigDict, Field
 
 from backend.core.config import get_dialect_api_info, settings, setup_logging
 from backend.core import metadata as meta
 from backend.core.functions_lookup import FunctionEncyclopedia
 from backend.core.nl2sql import NL2SQLGenerator
+from backend.core.nl2sql_pipeline.orchestrator import SAFE_TABLE_HINT
 from backend.core.parser import SUPPORTED_DIALECTS, SQLParser
 from backend.core.transpiler import SQLTranspiler
 from backend.core.type_mapping import TypeMapper
 
 from backend.api.readiness import health_probe_response
 
-# Configure logging for the application
-logger = setup_logging(level=logging.INFO)
+# Configure logging for the application from the validated settings object.
+# Keep an INFO fallback for defensive compatibility with custom settings
+# objects, while normal AppSettings values are resolved from SDM_LOG_LEVEL.
+_log_level = getattr(logging, settings.log_level.upper(), logging.INFO)
+logger = setup_logging(level=_log_level, log_file=settings.log_file or None)
 api_logger = logging.getLogger(__name__)
 
+
+async def _run_cpu_bound(func, *args):
+    """Run parser/transpiler work off-loop with the configured timeout."""
+    try:
+        return await asyncio.wait_for(
+            run_in_threadpool(func, *args),
+            timeout=settings.request_timeout,
+        )
+    except asyncio.TimeoutError as exc:
+        raise HTTPException(
+            status_code=504,
+            detail="Request processing timed out",
+        ) from exc
+
 # API metadata
 API_VERSION = settings.api_version
 API_TITLE = settings.api_title
@@ -198,7 +218,10 @@ class ConvertRequest(BaseModel):
     sql: str = Field(..., description="Source SQL statement to convert")
     source_dialect: str = Field(..., description="Source database dialect")
     target_dialect: str = Field(..., description="Target database dialect")
-    pretty: bool = Field(True, description="Format output SQL with indentation")
+    pretty: bool = Field(
+        settings.transpiler_pretty_default,
+        description="Format output SQL with indentation",
+    )
 
     model_config = ConfigDict(json_schema_extra={
         "example": {
@@ -401,11 +424,14 @@ async def convert_sql(request: ConvertRequest):
             detail=f"Unsupported target dialect: {request.target_dialect}. Supported: {SUPPORTED_DIALECTS}"
         )
 
-    result = transpiler.transpile(
+    # sqlglot parsing/transpilation is CPU-bound.  Keep it off the event loop
+    # so one large request cannot stall unrelated async requests.
+    result = await _run_cpu_bound(
+        transpiler.transpile,
         request.sql,
         source_dialect,
         target_dialect,
-        request.pretty
+        request.pretty,
     )
     return ConvertResponse(
         success=result.success,
@@ -430,7 +456,10 @@ async def parse_sql(request: ParseRequest):
     """
     dialect = normalize_dialect(request.dialect)
     parser = SQLParser(dialect)
-    elements = parser.extract_elements(request.sql)
+    parsed = await _run_cpu_bound(parser.parse, request.sql)
+    if not parsed.success:
+        raise HTTPException(status_code=422, detail=parsed.error or "SQL parsing failed")
+    elements = await _run_cpu_bound(parser.extract_elements, request.sql)
     return {
         "success": True,
         "dialect": dialect,
@@ -457,7 +486,7 @@ async def list_functions(
     if search:
         functions = func_encyclopedia.search(search, limit)
     elif category:
-        functions = func_encyclopedia.list_by_category(category)
+        functions = func_encyclopedia.list_by_category(category)[:limit]
     else:
         functions = func_encyclopedia.functions[:limit]
 
@@ -568,7 +597,7 @@ async def map_type(request: TypeMapRequest):
         target_dialect,
     )
     return {
-        "success": True,
+        "success": result.get("success", False),
         **result,
         "timestamp": datetime.now().isoformat()
     }
@@ -586,7 +615,19 @@ async def generate_sql(request: NL2SQLRequest):
     - "Get top 10 users by score" → SELECT * FROM users ORDER BY score DESC LIMIT 10
     """
     dialect = normalize_dialect(request.dialect)
-    result = nl2sql_generator.generate(
+    # Validate table_hint at the API boundary: an illegal identifier is
+    # a client error (4xx), never an internal ValueError → 500.  The
+    # same rule backs the orchestrator's direct-caller ValueError.
+    if request.table_hint and not SAFE_TABLE_HINT.fullmatch(request.table_hint.strip()):
+        raise HTTPException(
+            status_code=400,
+            detail=(
+                "Invalid table_hint: must be a simple SQL identifier or "
+                "dotted identifier"
+            ),
+        )
+    result = await _run_cpu_bound(
+        nl2sql_generator.generate,
         request.text,
         dialect,
         request.table_hint,
@@ -599,7 +640,7 @@ async def generate_sql(request: NL2SQLRequest):
         dialect=dialect,
         explanation=result.explanation,
         confidence=result.confidence,
-        suggestions=result.suggestions
+        suggestions=list(result.suggestions[: settings.nl2sql_max_suggestions])
     )
 
 @app.get("/health", tags=["system"])

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/backend/api/middleware.py

@@ -75,7 +75,11 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
 
     async def _read_bounded_body(self, request: Request) -> Response | None:
         """Consume and cache request bodies without trusting Content-Length."""
-        if request.method in {"GET", "HEAD"}:
+        # HEAD has no response body by definition and some ASGI servers do
+        # not expose a request stream for it.  GET bodies are unusual but
+        # still need the same bound so an oversized payload cannot bypass
+        # request-size protection by changing the HTTP method.
+        if request.method == "HEAD":
             return None
         content_length = request.headers.get("content-length")
         if content_length:
@@ -83,6 +87,8 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
                 declared_length = int(content_length)
             except ValueError:
                 return JSONResponse(status_code=400, content={"success": False, "error": {"code": 400, "message": "Invalid Content-Length"}, "timestamp": datetime.now().isoformat()})
+            if declared_length < 0:
+                return JSONResponse(status_code=400, content={"success": False, "error": {"code": 400, "message": "Invalid Content-Length"}, "timestamp": datetime.now().isoformat()})
             if declared_length > self.max_body_bytes:
                 return JSONResponse(status_code=413, content={"success": False, "error": {"code": 413, "message": "Request body exceeds the maximum allowed size", "max_bytes": self.max_body_bytes}, "timestamp": datetime.now().isoformat()})
 
@@ -97,6 +103,28 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
         return None
 
     async def dispatch(self, request: Request, call_next) -> Response:
+        is_health_probe = (
+            request.url.path in {"/health", "/", "/ready", "/health/deep"}
+            and request.method in {"GET", "HEAD"}
+        )
+
+        # Apply rate limiting before JSON/body parsing.  This prevents a
+        # client from spending unbounded CPU on invalid payloads while still
+        # keeping the request-size guard active when rate limiting is disabled.
+        rate_limit_checked = False
+        remaining = reset_time = None
+        if self.enabled and not is_health_probe:
+            client_id = self._get_client_id(request)
+            is_allowed, remaining, reset_time = self.limiter.is_allowed(client_id)
+            rate_limit_checked = True
+            if not is_allowed:
+                logger.warning("Rate limit exceeded for client: %s", _sanitize_log_value(client_id))
+                return JSONResponse(
+                    status_code=429,
+                    content={"success": False, "error": {"code": 429, "message": "Rate limit exceeded", "retry_after": reset_time}, "timestamp": datetime.now().isoformat()},
+                    headers={"X-RateLimit-Limit": str(self.limiter._requests_per_window), "X-RateLimit-Remaining": "0", "X-RateLimit-Reset": str(reset_time), "Retry-After": str(reset_time)},
+                )
+
         body_error = await self._read_bounded_body(request)
         if body_error is not None:
             return body_error
@@ -118,24 +146,15 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
 
         if not self.enabled:
             return await call_next(request)
-        if request.url.path in {"/health", "/", "/ready", "/health/deep"} and request.method in {"GET", "HEAD"}:
+        if is_health_probe:
             if request.url.path in {"/ready", "/health/deep"}:
                 return await health_probe_response(request)
             return await call_next(request)
-
-        client_id = self._get_client_id(request)
-        is_allowed, remaining, reset_time = self.limiter.is_allowed(client_id)
-        if not is_allowed:
-            logger.warning("Rate limit exceeded for client: %s", _sanitize_log_value(client_id))
-            return JSONResponse(
-                status_code=429,
-                content={"success": False, "error": {"code": 429, "message": "Rate limit exceeded", "retry_after": reset_time}, "timestamp": datetime.now().isoformat()},
-                headers={"X-RateLimit-Limit": str(self.limiter._requests_per_window), "X-RateLimit-Remaining": "0", "X-RateLimit-Reset": str(reset_time), "Retry-After": str(reset_time)},
-            )
         response = await call_next(request)
-        response.headers["X-RateLimit-Limit"] = str(self.limiter._requests_per_window)
-        response.headers["X-RateLimit-Remaining"] = str(remaining)
-        response.headers["X-RateLimit-Reset"] = str(reset_time)
+        if rate_limit_checked:
+            response.headers["X-RateLimit-Limit"] = str(self.limiter._requests_per_window)
+            response.headers["X-RateLimit-Remaining"] = str(remaining)
+            response.headers["X-RateLimit-Reset"] = str(reset_time)
         return response
 
     def _get_client_id(self, request: Request) -> str:

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/backend/api/rate_limit_store.py

@@ -5,10 +5,11 @@ Redis is opt-in. The in-memory backend remains the default for local/single-proc
 
 from __future__ import annotations
 
-import os
 import time
 from threading import Lock
-from typing import Protocol
+from typing import Optional, Protocol
+
+from backend.core.config import AppSettings, settings as _default_settings
 
 
 class RateLimitStore(Protocol):
@@ -64,6 +65,8 @@ class InMemoryRateLimitStore:
 class RedisRateLimitStore:
     """Atomic fixed-window store backed by Redis for multi-worker deployments."""
 
+    DEFAULT_TIMEOUT_SECONDS = 3.0
+
     _SCRIPT = """
     local count = redis.call('INCR', KEYS[1])
     if count == 1 then
@@ -73,14 +76,29 @@ class RedisRateLimitStore:
     return {count, ttl}
     """
 
-    def __init__(self, url: str, namespace: str = "sdm:rate-limit:") -> None:
+    def __init__(
+        self,
+        url: str,
+        namespace: str = "sdm:rate-limit:",
+        timeout_seconds: float = DEFAULT_TIMEOUT_SECONDS,
+    ) -> None:
         if not url:
             raise ValueError("Redis URL is required when rate-limit backend is redis")
+        if timeout_seconds <= 0:
+            raise ValueError("timeout_seconds must be positive")
         try:
             import redis
         except ImportError as exc:
             raise RuntimeError("Redis rate limiting requires the optional 'redis' package") from exc
-        self._client = redis.Redis.from_url(url, decode_responses=False)
+        # Bound both connection establishment and command execution.  A
+        # stalled Redis node must not block API startup or every request that
+        # checks the distributed rate-limit store.
+        self._client = redis.Redis.from_url(
+            url,
+            decode_responses=False,
+            socket_connect_timeout=timeout_seconds,
+            socket_timeout=timeout_seconds,
+        )
         self._client.ping()
         self._script = self._client.register_script(self._SCRIPT)
         self._namespace = namespace
@@ -95,11 +113,28 @@ class RedisRateLimitStore:
         return {"backend": "redis", "namespace": self._namespace}
 
 
-def create_rate_limit_store() -> RateLimitStore:
-    """Create the configured store; never silently downgrade Redis to memory."""
-    backend = os.getenv("SDM_RATE_LIMIT_BACKEND", "memory").strip().lower()
+def create_rate_limit_store(config: Optional[AppSettings] = None) -> RateLimitStore:
+    """Create the configured store; never silently downgrade Redis to memory.
+
+    Reads configuration from ``config``, or from the unified
+    ``backend.core.config.settings`` singleton when ``config`` is None.
+    The factory never reads raw environment variables — all deployment
+    configuration flows through AppSettings (SDM_ prefix), so backend
+    selection and the Redis URL share one validated configuration path.
+
+    The Redis URL is a SecretStr in AppSettings; its actual value is
+    read here only to construct the Redis client, and it is never
+    embedded in error messages or logs.
+    """
+    settings_obj = config if config is not None else _default_settings
+    backend = settings_obj.rate_limit_backend
     if backend == "memory":
         return InMemoryRateLimitStore()
     if backend == "redis":
-        return RedisRateLimitStore(os.getenv("SDM_REDIS_URL", ""))
-    raise ValueError("Unsupported SDM_RATE_LIMIT_BACKEND; expected 'memory' or 'redis'")
+        url = settings_obj.redis_url
+        url_value = url.get_secret_value() if url is not None else ""
+        return RedisRateLimitStore(url_value)
+    # Boundary guard for untyped callers: only reachable when a caller
+    # passes a non-AppSettings object with an unexpected backend value
+    # (typed AppSettings validation rejects it earlier).
+    raise ValueError("Unsupported rate_limit_backend; expected 'memory' or 'redis'")

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/backend/api/readiness.py

@@ -7,6 +7,7 @@ import logging
 import os
 import secrets
 import time
+import uuid
 import weakref
 from datetime import datetime
 from typing import Any
@@ -16,6 +17,8 @@ from fastapi.responses import JSONResponse
 
 logger = logging.getLogger(__name__)
 
+from backend.core.config import settings
+
 _READINESS_CACHE_TTL_SECONDS = 5.0
 _READINESS_TIMEOUT_SECONDS = 3.0
 _READINESS_LOCKS: weakref.WeakKeyDictionary[asyncio.AbstractEventLoop, asyncio.Lock] = weakref.WeakKeyDictionary()
@@ -26,22 +29,37 @@ _HEALTH_PROBE_PATHS = {"/ready", "/health/deep"}
 
 def _probe_allowed(request: Request) -> bool:
     """Allow health probes only from loopback or with the configured probe secret."""
-    token = os.getenv("SDM_HEALTH_PROBE_TOKEN", "").strip()
+    configured = settings.health_probe_token
+    token = configured.get_secret_value().strip() if configured else ""
+    # Keep process-level test/dev overrides effective after module import;
+    # production configuration still comes from the validated singleton above
+    # (including values loaded from .env).
+    if not token:
+        token = os.environ.get("SDM_HEALTH_PROBE_TOKEN", "").strip()
     supplied = request.headers.get("X-Health-Probe-Token", "")
     if token and supplied and secrets.compare_digest(supplied, token):
         return True
+    # Once a token is configured, require it even for loopback callers.  This
+    # avoids trusting an unverified X-Forwarded-For chain in front of a proxy.
+    if token:
+        return False
     client = request.client
     return bool(client and client.host in {"127.0.0.1", "::1", "localhost"})
 
 
-def _health_probe_denied_response() -> JSONResponse:
+def _health_probe_denied_response(request: Request) -> JSONResponse:
     """Return a stable denial response for public health probe requests."""
+    request_id = getattr(request.state, "request_id", None) or str(uuid.uuid4())
+    headers = {"X-Request-ID": request_id}
+    content = {
+        "success": False,
+        "error": {"code": 403, "message": "health probe access denied"},
+    }
+    content["request_id"] = request_id
     return JSONResponse(
         status_code=403,
-        content={
-            "success": False,
-            "error": {"code": 403, "message": "health probe access denied"},
-        },
+        content=content,
+        headers=headers,
     )
 
 
@@ -50,7 +68,7 @@ async def health_probe_response(request: Request) -> JSONResponse:
     if request.url.path not in _HEALTH_PROBE_PATHS or request.method not in {"GET", "HEAD"}:
         raise ValueError("health_probe_response called for a non-probe request")
     if not _probe_allowed(request):
-        return _health_probe_denied_response()
+        return _health_probe_denied_response(request)
     if request.url.path == "/ready":
         return await readiness_response(request)
     return await deep_health_response(request)

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/backend/core/cache.py

@@ -48,6 +48,8 @@ class TTLCache:
         """
         if max_size <= 0:
             raise ValueError("max_size must be greater than 0")
+        if ttl < 0:
+            raise ValueError("ttl must be greater than or equal to 0")
         self._cache: OrderedDict[str, CacheEntry] = OrderedDict()
         self._max_size = max_size
         self._ttl = ttl
@@ -222,10 +224,18 @@ class TTLCache:
                 except Exception as e:
                     logger.error(f"Background cleanup error: {e}")
 
-        thread = threading.Thread(target=cleanup_loop, daemon=True, name="CacheCleanup")
         with self._lock:
+            # Check, assign and start under the same lock.  Keeping the
+            # assignment inside the critical section closes the TOCTOU window
+            # where two concurrent callers both observe no live thread and
+            # each start a cleanup worker.
+            if self._cleanup_thread is not None and self._cleanup_thread.is_alive():
+                raise RuntimeError(
+                    "background cleanup is already running for this cache"
+                )
+            thread = threading.Thread(target=cleanup_loop, daemon=True, name="CacheCleanup")
             self._cleanup_thread = thread
-        thread.start()
+            thread.start()
         logger.info(f"Started background cache cleanup (interval={interval}s)")
         return thread
 

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/backend/core/config.py

@@ -12,9 +12,9 @@ Supports configuration via:
 import logging
 import sys
 from enum import Enum
-from typing import Any, Dict, List, Optional, TypedDict
+from typing import Any, Dict, List, Literal, Optional, TypedDict
 
-from pydantic import Field
+from pydantic import Field, SecretStr, field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 # =============================================================================
@@ -220,23 +220,34 @@ class AppSettings(BaseSettings):
         "http://localhost:8501,http://localhost:8000,"
         "http://127.0.0.1:8501,http://127.0.0.1:8000"
     )
-    max_batch_size: int = 100
-    request_timeout: int = 30
+    max_batch_size: int = Field(100, gt=0)
+    request_timeout: int = Field(30, gt=0)
     
     # Cache settings
     cache_enabled: bool = True
-    cache_ttl: int = 300
+    # Zero intentionally disables expiry (TTLCache contract); negatives are
+    # invalid because they are indistinguishable from that mode at runtime.
+    cache_ttl: int = Field(300, ge=0)
     cache_max_size: int = Field(1000, gt=0)
     
     # Rate limiting
     rate_limit_enabled: bool = True
-    rate_limit_requests: int = 100
-    rate_limit_window: int = 60
+    rate_limit_requests: int = Field(100, gt=0)
+    rate_limit_window: int = Field(60, gt=0)
+    # Storage backend selection: strict lowercase values; no case or
+    # whitespace normalization — a Literal rejects any other spelling at
+    # settings construction instead of silently coercing it.
+    rate_limit_backend: Literal["memory", "redis"] = "memory"
+    # Redis connection URL, required only when the backend is redis.
+    # SecretStr keeps the password out of repr / logs / serialization;
+    # the store factory reads the actual value only to build the Redis
+    # client.  Default None = not configured.
+    redis_url: Optional[SecretStr] = None
     
     # NL2SQL settings
-    nl2sql_confidence_threshold: float = 0.6
-    nl2sql_max_suggestions: int = 5
-    nl2sql_max_input_length: int = 8192
+    nl2sql_confidence_threshold: float = Field(0.6, ge=0.0, le=1.0)
+    nl2sql_max_suggestions: int = Field(5, ge=0)
+    nl2sql_max_input_length: int = Field(8192, gt=0)
 
     # SQL Transpiler / Parser settings
     #
@@ -245,12 +256,16 @@ class AppSettings(BaseSettings):
     # to ``transpiler_max_sql_length``.  Business code must read the
     # settings object — never ``os.getenv`` directly.
     transpiler_pretty_default: bool = True
-    transpiler_max_sql_length: int = 100000
-    parser_max_sql_length: int = 100000
+    transpiler_max_sql_length: int = Field(100000, gt=0)
+    parser_max_sql_length: Optional[int] = Field(None, gt=0)
     
     # Function encyclopedia
-    function_search_limit: int = 50
-    function_fuzzy_threshold: float = 0.4
+    function_search_limit: int = Field(50, gt=0)
+    function_fuzzy_threshold: float = Field(0.4, ge=0.0, le=1.0)
+
+    # Readiness probes.  SecretStr keeps the value out of settings reprs and
+    # structured logs while still allowing deployment through SDM_ env vars.
+    health_probe_token: Optional[SecretStr] = None
     
     # Security settings
     security_check_enabled: bool = True
@@ -259,6 +274,23 @@ class AppSettings(BaseSettings):
     # Logging settings
     log_level: str = "INFO"
     log_file: str = ""
+
+    @model_validator(mode="after")
+    def _apply_parser_length_fallback(self) -> "AppSettings":
+        """Keep parser and transpiler limits aligned unless explicitly set."""
+        if self.parser_max_sql_length is None:
+            self.parser_max_sql_length = self.transpiler_max_sql_length
+        return self
+
+    @field_validator("log_level", mode="before")
+    @classmethod
+    def _normalize_log_level(cls, value: str) -> str:
+        normalized = str(value).strip().upper()
+        if normalized not in {"DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"}:
+            raise ValueError(
+                "log_level must be one of DEBUG, INFO, WARNING, ERROR, CRITICAL"
+            )
+        return normalized
     
     def to_dict(self) -> Dict[str, Any]:
         """Convert settings to dictionary."""

{sql_dialect_master-1.1.1 → sql_dialect_master-1.1.3}/backend/core/metadata.py

@@ -17,8 +17,8 @@ Design rules:
 from __future__ import annotations
 
 # ── Release version facts (sole source of truth) ────────────────────────
-PROJECT_VERSION = "1.1.1"
-API_VERSION = "1.1.1"
+PROJECT_VERSION = "1.1.3"
+API_VERSION = "1.1.3"
 # Frontend v2 architecture — independent of the product release version.
 FRONTEND_ARCHITECTURE_VERSION = 2
 

sql_dialect_master-1.1.3/backend/core/nl2sql_components/aggregations.py

@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+"""NL2SQL aggregation extraction.
+
+Extracts aggregate function calls (COUNT, SUM, AVG, MAX, MIN) from
+natural-language text using keyword matching. Uses the shared
+COLUMN_PATTERNS to resolve the target column for value aggregates.
+"""
+import re
+from typing import Dict, List
+
+
+def extract_aggregations(text: str, column_patterns: Dict[str, str]) -> List[str]:
+    """Extract aggregation expressions from text.
+
+    Returns a list of SQL aggregate expressions, e.g.
+    ['COUNT(*)', 'SUM(amount)']. An empty list means no aggregation
+    was requested.
+    """
+    aggs: List[str] = []
+    text_lower = text.lower()
+    # Pick the user's named metric column, not the first pattern that
+    # happens to sit inside an aggregate keyword: the legacy first-hit
+    # walk let "average" contain "age" and produced AVG(age).
+    named_metrics = [
+        column
+        for pattern, column in column_patterns.items()
+        if pattern != "age" and pattern in text
+    ]
+    # Bare "age" is only a metric when it is not the trailing substring
+    # of "average": require a non-letter before it so "average" never
+    # self-matches, while "average age" still does.
+    if re.search(r"(?<![a-z])age", text_lower):
+        if "age" not in named_metrics:
+            named_metrics.append("age")
+    if "price" in text_lower:
+        named_metrics = [c for c in named_metrics if c != "age"]
+    agg_column = named_metrics[0] if named_metrics else None
+    col = agg_column or "amount"
+    if any(k in text for k in ["统计", "计数", "数量", "多少", "几个", "count", "total", "how many"]):
+        aggs.append("COUNT(*)")
+    if any(k in text for k in ["求和", "总和", "合计", "总计", "sum", "total of"]):
+        aggs.append(f"SUM({col})")
+    if any(k in text_lower for k in ["平均", "均值", "平均值", "average", "avg", "mean"]):
+        # "average" contains "age": the average metric is price unless
+        # the text explicitly names the age column as the target.
+        col = "price" if ("price" in text_lower and not re.search(r"(?<![a-z])age", text_lower)) else (agg_column or "amount")
+        aggs.append(f"AVG({col})")
+    if any(k in text_lower for k in ["最大", "最高", "最多", "max", "maximum", "highest", "largest"]):
+        aggs.append(f"MAX({col})")
+    if any(k in text_lower for k in ["最小", "最低", "最少", "min", "minimum", "lowest", "smallest"]):
+        aggs.append(f"MIN({col})")
+    return aggs