sql-dialect-master 1.1.3__tar.gz → 1.1.4__tar.gz

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-dialect-master
-Version: 1.1.3
+Version: 1.1.4
 Summary: SQL Dialect Master - Multi-database SQL conversion engine
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -21,6 +21,10 @@ Provides-Extra: qa
 Requires-Dist: ruff>=0.6; extra == "qa"
 Requires-Dist: bandit>=1.7; extra == "qa"
 Requires-Dist: pip-audit>=2.7; extra == "qa"
+Requires-Dist: build>=1.2.2; extra == "qa"
+Requires-Dist: twine>=5.1; extra == "qa"
+Requires-Dist: setuptools>=75.0.0; extra == "qa"
+Requires-Dist: wheel>=0.45; extra == "qa"
 Provides-Extra: semantic
 Requires-Dist: duckdb>=1.5.5; extra == "semantic"
 Requires-Dist: psycopg[binary]>=3.3.5; extra == "semantic"
@@ -32,7 +36,7 @@ Dynamic: license-file
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.3
+Current release: 1.1.4
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -78,16 +82,18 @@ cd sql-dialect-master
 python -m pip install -e .
 ```
 
-For development and testing, install the optional development dependencies:
+For development, testing, quality checks, and local builds, use the project's
+Python environment and install the optional tooling:
 
 ```bash
-python -m pip install -e ".[dev]"
+python -m venv .venv
+.venv/bin/python -m pip install -e ".[dev,qa]"
 ```
 
 For database-backed semantic tests:
 
 ```bash
-python -m pip install -e ".[dev,semantic]"
+.venv/bin/python -m pip install -e ".[dev,semantic]"
 ```
 
 ### Run Streamlit UI (Recommended)
@@ -113,6 +119,16 @@ uvicorn backend.api.main:app --reload
 
 API docs available at http://localhost:8000/docs
 
+Set `SDM_API_KEY` in `.env` to require credentials for `/api/*` endpoints.
+Clients may send `X-API-Key` or `Authorization: Bearer <key>`. Health probes
+use the separate `SDM_HEALTH_PROBE_TOKEN` setting. An empty API key preserves
+local access.
+
+`SDM_API_WORKERS` (default 4) and `SDM_API_QUEUE_SIZE` (default 4) bound CPU
+work. When all slots are occupied, requests receive HTTP 503 and a
+`Retry-After` header. `SDM_REQUEST_TIMEOUT` returns HTTP 504 when a request
+times out; running threads retain their capacity until they finish.
+
 ## 📖 Usage Examples
 
 ### Python SDK

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/README.md

@@ -2,7 +2,7 @@
 
 Enterprise-grade multi-database SQL conversion engine supporting 12 database dialects.
 
-Current release: 1.1.3
+Current release: 1.1.4
 
 [![Python 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -48,16 +48,18 @@ cd sql-dialect-master
 python -m pip install -e .
 ```
 
-For development and testing, install the optional development dependencies:
+For development, testing, quality checks, and local builds, use the project's
+Python environment and install the optional tooling:
 
 ```bash
-python -m pip install -e ".[dev]"
+python -m venv .venv
+.venv/bin/python -m pip install -e ".[dev,qa]"
 ```
 
 For database-backed semantic tests:
 
 ```bash
-python -m pip install -e ".[dev,semantic]"
+.venv/bin/python -m pip install -e ".[dev,semantic]"
 ```
 
 ### Run Streamlit UI (Recommended)
@@ -83,6 +85,16 @@ uvicorn backend.api.main:app --reload
 
 API docs available at http://localhost:8000/docs
 
+Set `SDM_API_KEY` in `.env` to require credentials for `/api/*` endpoints.
+Clients may send `X-API-Key` or `Authorization: Bearer <key>`. Health probes
+use the separate `SDM_HEALTH_PROBE_TOKEN` setting. An empty API key preserves
+local access.
+
+`SDM_API_WORKERS` (default 4) and `SDM_API_QUEUE_SIZE` (default 4) bound CPU
+work. When all slots are occupied, requests receive HTTP 503 and a
+`Retry-After` header. `SDM_REQUEST_TIMEOUT` returns HTTP 504 when a request
+times out; running threads retain their capacity until they finish.
+
 ## 📖 Usage Examples
 
 ### Python SDK

sql_dialect_master-1.1.4/backend/api/auth.py

@@ -0,0 +1,29 @@
+"""Optional shared API-key protection for business endpoints."""
+from __future__ import annotations
+
+import secrets
+
+from fastapi import HTTPException, Request
+
+from backend.core.config import settings
+
+
+async def require_api_access(request: Request) -> None:
+    """Require a configured key for /api endpoints while keeping probes separate."""
+    key = settings.api_key
+    if key is None or not request.url.path.startswith("/api/"):
+        return
+    expected = key.get_secret_value()
+    if not expected:
+        return
+    supplied = request.headers.get("X-API-Key", "")
+    if not supplied:
+        scheme, _, credential = request.headers.get("Authorization", "").partition(" ")
+        if scheme.lower() == "bearer":
+            supplied = credential
+    if not supplied or not secrets.compare_digest(supplied.encode("utf-8"), expected.encode("utf-8")):
+        raise HTTPException(
+            status_code=401,
+            detail="Invalid or missing API key",
+            headers={"WWW-Authenticate": "Bearer"},
+        )

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/api/main.py

@@ -14,13 +14,13 @@ see backend.core.metadata — and must not be restated here.
 import asyncio
 import logging
 import time
+from contextlib import asynccontextmanager
 from datetime import datetime
 from typing import Any, Dict, List, Optional
 
-from fastapi import FastAPI, HTTPException, Query, Request
+from fastapi import Depends, FastAPI, HTTPException, Query, Request
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import JSONResponse
-from starlette.concurrency import run_in_threadpool
 from pydantic import BaseModel, ConfigDict, Field
 
 from backend.core.config import get_dialect_api_info, settings, setup_logging
@@ -33,6 +33,9 @@ from backend.core.transpiler import SQLTranspiler
 from backend.core.type_mapping import TypeMapper
 
 from backend.api.readiness import health_probe_response
+from backend.api.auth import require_api_access
+from backend.api.workers import BoundedWorkerPool, WorkerCapacityError
+from backend.api.rate_limit_store import InMemoryRateLimitStore
 
 # Configure logging for the application from the validated settings object.
 # Keep an INFO fallback for defensive compatibility with custom settings
@@ -40,15 +43,28 @@ from backend.api.readiness import health_probe_response
 _log_level = getattr(logging, settings.log_level.upper(), logging.INFO)
 logger = setup_logging(level=_log_level, log_file=settings.log_file or None)
 api_logger = logging.getLogger(__name__)
+_worker_pool = BoundedWorkerPool(settings.api_workers, settings.api_queue_size)
+
+
+@asynccontextmanager
+async def lifespan(application: FastAPI):
+    """Manage the service worker pool for a normal ASGI startup/shutdown."""
+    pool = BoundedWorkerPool(settings.api_workers, settings.api_queue_size)
+    application.state.worker_pool = pool
+    try:
+        yield
+    finally:
+        pool.shutdown()
+        del application.state.worker_pool
 
 
 async def _run_cpu_bound(func, *args):
     """Run parser/transpiler work off-loop with the configured timeout."""
     try:
-        return await asyncio.wait_for(
-            run_in_threadpool(func, *args),
-            timeout=settings.request_timeout,
-        )
+        pool = getattr(app.state, "worker_pool", _worker_pool)
+        return await pool.run(func, *args, timeout=settings.request_timeout)
+    except WorkerCapacityError as exc:
+        raise HTTPException(status_code=503, detail=str(exc), headers={"Retry-After": "1"}) from exc
     except asyncio.TimeoutError as exc:
         raise HTTPException(
             status_code=504,
@@ -105,6 +121,8 @@ print(response.json()["target_sql"])
 
 # Initialize FastAPI app with enhanced metadata
 app = FastAPI(
+    dependencies=[Depends(require_api_access)],
+    lifespan=lifespan,
     title=API_TITLE,
     description=API_DESCRIPTION,
     version=API_VERSION,
@@ -156,7 +174,7 @@ app.add_middleware(
     allow_origins=ALLOWED_ORIGINS,
     allow_credentials=True,
     allow_methods=["GET", "POST", "OPTIONS"],  # Restrict to needed methods
-    allow_headers=["Content-Type", "Authorization", "X-Request-ID"],
+    allow_headers=["Content-Type", "Authorization", "X-API-Key", "X-Request-ID"],
 )
 
 # Add security headers
@@ -166,6 +184,7 @@ app.add_middleware(SecurityHeadersMiddleware)
 rate_limiter = RateLimiter(
     requests_per_window=settings.rate_limit_requests,
     window_seconds=settings.rate_limit_window,
+    store=None if settings.rate_limit_enabled else InMemoryRateLimitStore(),
 )
 app.add_middleware(
     RateLimitMiddleware,
@@ -192,9 +211,8 @@ async def add_process_time_header(request: Request, call_next):
     response.headers["X-API-Version"] = API_VERSION
 
     # Log request details
-    api_logger.info(
-        f"{request.method} {request.url.path} - {response.status_code} - {process_time:.4f}s"
-    )
+    api_logger.info("%s %r - %s - %.4fs", request.method, request.url.path,
+                    response.status_code, process_time)
     return response
 
 # Dialect info for enhanced responses (from centralized config)
@@ -285,6 +303,20 @@ class NL2SQLResponse(BaseModel):
     explanation: str = Field("", description="Explanation of generated SQL")
     confidence: float = Field(0.0, description="Confidence score (0.0-1.0)")
     suggestions: List[str] = Field(default_factory=list, description="Improvement suggestions")
+    parameter_style: Optional[str] = Field(
+        None,
+        description=(
+            "Placeholder style for generated DML: numeric ($1 in PostgreSQL/Redshift, "
+            ":1 in Oracle), named (@p1 in T-SQL), format (%s in MySQL), or qmark (?)"
+        ),
+    )
+    parameters: List[str] = Field(
+        default_factory=list,
+        description="Ordered placeholders that callers must bind for generated DML",
+    )
+    evidence: Optional[Dict[str, Any]] = Field(
+        None, description="Structured evidence supporting the confidence score",
+    )
 
 class ParseRequest(BaseModel):
     """SQL parse request model."""
@@ -456,10 +488,9 @@ async def parse_sql(request: ParseRequest):
     """
     dialect = normalize_dialect(request.dialect)
     parser = SQLParser(dialect)
-    parsed = await _run_cpu_bound(parser.parse, request.sql)
-    if not parsed.success:
-        raise HTTPException(status_code=422, detail=parsed.error or "SQL parsing failed")
     elements = await _run_cpu_bound(parser.extract_elements, request.sql)
+    if "error" in elements:
+        raise HTTPException(status_code=422, detail=elements["error"] or "SQL parsing failed")
     return {
         "success": True,
         "dialect": dialect,
@@ -483,10 +514,18 @@ async def list_functions(
     - `/api/functions?category=string` - List all string functions
     - `/api/functions?limit=100` - Get first 100 functions
     """
+    normalized_category = category.strip().lower() if category is not None else None
+    if category is not None:
+        if normalized_category not in func_encyclopedia.CATEGORIES:
+            raise HTTPException(
+                status_code=400,
+                detail=(f"Unknown function category: {category}. Available categories: "
+                        + ", ".join(func_encyclopedia.CATEGORIES)),
+            )
     if search:
         functions = func_encyclopedia.search(search, limit)
     elif category:
-        functions = func_encyclopedia.list_by_category(category)[:limit]
+        functions = func_encyclopedia.list_by_category(normalized_category)[:limit]
     else:
         functions = func_encyclopedia.functions[:limit]
 
@@ -640,7 +679,10 @@ async def generate_sql(request: NL2SQLRequest):
         dialect=dialect,
         explanation=result.explanation,
         confidence=result.confidence,
-        suggestions=list(result.suggestions[: settings.nl2sql_max_suggestions])
+        suggestions=list(result.suggestions[: settings.nl2sql_max_suggestions]),
+        parameter_style=result.parameter_style,
+        parameters=list(result.parameters),
+        evidence=result.evidence.to_dict() if result.evidence is not None else None,
     )
 
 @app.get("/health", tags=["system"])
@@ -707,6 +749,7 @@ async def get_stats():
 async def custom_http_exception_handler(request: Request, exc: HTTPException):
     return JSONResponse(
         status_code=exc.status_code,
+        headers=exc.headers,
         content={
             "success": False,
             "error": {

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/api/middleware.py

@@ -14,10 +14,11 @@ from typing import Dict
 from fastapi import Request, Response
 from fastapi.responses import JSONResponse
 from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.concurrency import run_in_threadpool
 
 from backend.core.exceptions import ErrorCode
 
-from .rate_limit_store import RateLimitStore, create_rate_limit_store
+from .rate_limit_store import InMemoryRateLimitStore, RateLimitStore, create_rate_limit_store
 from .readiness import health_probe_response
 
 logger = logging.getLogger(__name__)
@@ -69,7 +70,7 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
         super().__init__(app)
         if max_body_bytes <= 0:
             raise ValueError("max_body_bytes must be positive")
-        self.limiter = limiter or RateLimiter()
+        self.limiter = limiter or RateLimiter(store=None if enabled else InMemoryRateLimitStore())
         self.enabled = enabled
         self.max_body_bytes = max_body_bytes
 
@@ -115,7 +116,9 @@ class RateLimitMiddleware(BaseHTTPMiddleware):
         remaining = reset_time = None
         if self.enabled and not is_health_probe:
             client_id = self._get_client_id(request)
-            is_allowed, remaining, reset_time = self.limiter.is_allowed(client_id)
+            # Redis checks use a synchronous client; a stalled store must not
+            # block the event loop used by unrelated liveness/API requests.
+            is_allowed, remaining, reset_time = await run_in_threadpool(self.limiter.is_allowed, client_id)
             rate_limit_checked = True
             if not is_allowed:
                 logger.warning("Rate limit exceeded for client: %s", _sanitize_log_value(client_id))
@@ -186,14 +189,19 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
         """Normalize standard HTTP 4xx JSON responses while preserving domain-specific codes."""
         code_by_status = {
             400: ErrorCode.BAD_REQUEST.value,
+            401: ErrorCode.UNAUTHORIZED.value,
             404: ErrorCode.NOT_FOUND.value,
             405: ErrorCode.METHOD_NOT_ALLOWED.value,
             413: ErrorCode.PAYLOAD_TOO_LARGE.value,
             422: ErrorCode.VALIDATION_FAILED.value,
             429: ErrorCode.RATE_LIMITED.value,
+            503: ErrorCode.SERVICE_UNAVAILABLE.value,
+            504: ErrorCode.REQUEST_TIMEOUT.value,
         }
         if response.status_code not in code_by_status:
             return response
+        if "json" not in response.headers.get("content-type", "").lower():
+            return response
 
         try:
             if hasattr(response, "body"):
@@ -207,6 +215,16 @@ class StructuredLoggingMiddleware(BaseHTTPMiddleware):
         except (AttributeError, UnicodeDecodeError, json.JSONDecodeError):
             return response
 
+        if response.status_code == 503 and isinstance(payload, dict) and "checks" in payload:
+            # Readiness has a public diagnostics schema of its own. Preserve
+            # status/checks when the service is unhealthy, including after
+            # consuming the downstream streaming response to decode JSON.
+            headers = dict(response.headers)
+            headers.pop("content-length", None)
+            headers.pop("content-type", None)
+            payload.setdefault("request_id", request_id)
+            return JSONResponse(status_code=503, content=payload, headers=headers)
+
         error = payload.get("error") if isinstance(payload, dict) else None
         expected_code = code_by_status[response.status_code]
         if not isinstance(error, dict):

sql_dialect_master-1.1.4/backend/api/workers.py

@@ -0,0 +1,44 @@
+"""Bound synchronous work even when an HTTP caller times out."""
+from __future__ import annotations
+
+import asyncio
+from concurrent.futures import ThreadPoolExecutor
+from threading import BoundedSemaphore
+
+
+class WorkerCapacityError(RuntimeError):
+    """All execution and queue slots are occupied."""
+
+
+class BoundedWorkerPool:
+    """Keep a slot until its underlying future finishes, including timeouts.
+
+    Cancelling an HTTP wait cannot interrupt Python threads. Holding capacity
+    until completion prevents a stream of timed-out requests from creating an
+    unbounded executor queue. Slots cover executing and queued work together.
+    """
+
+    def __init__(self, workers: int, queue_size: int = 0):
+        if workers <= 0 or queue_size < 0:
+            raise ValueError("workers must be positive and queue_size non-negative")
+        self._slots = BoundedSemaphore(workers + queue_size)
+        self._executor = ThreadPoolExecutor(max_workers=workers, thread_name_prefix="sdm-api")
+
+    async def run(self, function, *args, timeout: float):
+        if not self._slots.acquire(blocking=False):
+            raise WorkerCapacityError("Request processing capacity is exhausted")
+        try:
+            future = self._executor.submit(function, *args)
+        except BaseException:
+            self._slots.release()
+            raise
+        future.add_done_callback(lambda _future: self._slots.release())
+        wrapped = asyncio.wrap_future(future)
+        # A timed-out caller no longer awaits this result. Retrieve exceptions
+        # to avoid an unhandled-future warning when background work later fails.
+        wrapped.add_done_callback(lambda completed: None if completed.cancelled() else completed.exception())
+        return await asyncio.wait_for(asyncio.shield(wrapped), timeout=timeout)
+
+    def shutdown(self) -> None:
+        """Cancel queued work; already-running calls retain their slots."""
+        self._executor.shutdown(wait=False, cancel_futures=True)

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/core/config.py

@@ -216,6 +216,9 @@ class AppSettings(BaseSettings):
     # API settings
     api_version: str = _METADATA_API_VERSION
     api_title: str = "SQL Dialect Master API"
+    api_key: Optional[SecretStr] = None
+    api_workers: int = Field(4, gt=0)
+    api_queue_size: int = Field(4, ge=0)
     allowed_origins: str = (
         "http://localhost:8501,http://localhost:8000,"
         "http://127.0.0.1:8501,http://127.0.0.1:8000"
@@ -248,6 +251,9 @@ class AppSettings(BaseSettings):
     nl2sql_confidence_threshold: float = Field(0.6, ge=0.0, le=1.0)
     nl2sql_max_suggestions: int = Field(5, ge=0)
     nl2sql_max_input_length: int = Field(8192, gt=0)
+    # Maximum natural-language date window accepted by NL2SQL.  Keeping this
+    # bounded prevents enormous interval literals from reaching renderers.
+    nl2sql_max_date_interval_days: int = Field(36525, gt=0)
 
     # SQL Transpiler / Parser settings
     #

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/core/exceptions.py

@@ -13,6 +13,9 @@ class ErrorCode(str, Enum):
     SECURITY_VIOLATION = "SECURITY_VIOLATION"
     VALIDATION_FAILED = "VALIDATION_FAILED"
     BAD_REQUEST = "BAD_REQUEST"
+    UNAUTHORIZED = "UNAUTHORIZED"
+    SERVICE_UNAVAILABLE = "SERVICE_UNAVAILABLE"
+    REQUEST_TIMEOUT = "REQUEST_TIMEOUT"
     NOT_FOUND = "NOT_FOUND"
     METHOD_NOT_ALLOWED = "METHOD_NOT_ALLOWED"
     PAYLOAD_TOO_LARGE = "PAYLOAD_TOO_LARGE"

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/core/functions_lookup.py

@@ -9,6 +9,7 @@ Provides comprehensive SQL function lookup with:
 - Function examples and parameter documentation
 """
 import json
+import copy
 import logging
 from pathlib import Path
 from typing import Optional, List, Dict, Any
@@ -112,11 +113,13 @@ class FunctionEncyclopedia:
         Returns:
             List of matching functions sorted by relevance
         """
-        limit = limit or settings.function_search_limit
+        # ``0`` is a valid explicit request for no results.  Treat only
+        # ``None`` as asking for the configured default.
+        limit = settings.function_search_limit if limit is None else max(0, limit)
         query = query.upper().strip()
         
         if not query:
-            return self.functions[:limit]
+            return copy.deepcopy(self.functions[:limit])
         
         results: List[tuple] = []
         
@@ -138,16 +141,17 @@ class FunctionEncyclopedia:
                     results.append((func, ratio))
         
         results.sort(key=lambda x: x[1], reverse=True)
-        return [r[0] for r in results[:limit]]
+        return copy.deepcopy([r[0] for r in results[:limit]])
     
     def get_function(self, name: str) -> Optional[FunctionInfo]:
         """Get detailed function information by exact name."""
-        return self.name_index.get(name.upper())
+        result = self.name_index.get(name.upper())
+        return copy.deepcopy(result) if result is not None else None
     
     def list_by_category(self, category: str) -> List[FunctionInfo]:
         """List all functions in a category."""
         category = category.lower()
-        return self.category_index.get(category, [])
+        return copy.deepcopy(self.category_index.get(category, []))
     
     def get_dialect_syntax(self, func_name: str, dialect: str) -> Optional[str]:
         """Get function syntax for specific dialect."""

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/core/metadata.py

@@ -17,8 +17,8 @@ Design rules:
 from __future__ import annotations
 
 # ── Release version facts (sole source of truth) ────────────────────────
-PROJECT_VERSION = "1.1.3"
-API_VERSION = "1.1.3"
+PROJECT_VERSION = "1.1.4"
+API_VERSION = "1.1.4"
 # Frontend v2 architecture — independent of the product release version.
 FRONTEND_ARCHITECTURE_VERSION = 2
 

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/core/nl2sql_components/core_extract.py

@@ -8,6 +8,8 @@ from ``backend.core.nl2sql_components.mappings``).
 import re
 from typing import Dict, List, Optional
 
+from ..p1_sql_scanner import mask_non_executable
+
 
 # Generated SQL is intended to be reviewed and parameterized by a caller.
 # Refuse unbounded/absurd row counts before integer conversion (which can
@@ -15,6 +17,19 @@ from typing import Dict, List, Optional
 MAX_NL2SQL_LIMIT = 1_000_000
 
 
+def _pattern_match(text: str, pattern: str) -> Optional[re.Match]:
+    """Match an NL2SQL mapping as a token when it is an English identifier.
+
+    Substring matching turns ``update`` into the ``date`` column and can
+    similarly match ``order`` inside unrelated words.  Chinese phrases do
+    not have whitespace boundaries, so those retain substring semantics.
+    """
+    expression = re.escape(pattern)
+    if not re.search(r"[\u4e00-\u9fff]", pattern):
+        expression = rf"(?<![\w$]){expression}(?![\w$])"
+    return re.search(expression, text, re.IGNORECASE)
+
+
 def detect_operation(text: str, keywords: Dict[str, str]) -> str:
     """Detect SQL operation type from text.
 
@@ -22,8 +37,9 @@ def detect_operation(text: str, keywords: Dict[str, str]) -> str:
     and returns the first matching operation (SELECT/INSERT/UPDATE/DELETE).
     Defaults to SELECT.
     """
+    intent_text = mask_non_executable(text)
     for keyword, op in keywords.items():
-        if keyword in text and op in ["SELECT", "INSERT", "UPDATE", "DELETE"]:
+        if _pattern_match(intent_text, keyword) and op in ["SELECT", "INSERT", "UPDATE", "DELETE"]:
             return op
     return "SELECT"
 
@@ -36,8 +52,9 @@ def extract_table(text: str, table_patterns: Dict[str, str]) -> str:
     """
     tables_found = []
     for pattern, table in table_patterns.items():
-        if pattern in text:
-            tables_found.append((text.find(pattern), table, len(pattern)))
+        match = _pattern_match(text, pattern)
+        if match:
+            tables_found.append((match.start(), table, len(pattern)))
     if tables_found:
         tables_found.sort(key=lambda item: (-item[2], item[0]))
         return tables_found[0][1]
@@ -62,7 +79,8 @@ def extract_table_subject(
     for pattern, table in table_patterns.items():
         if relational_context and table == relational_context:
             continue
-        pos = text.find(pattern)
+        match = _pattern_match(text, pattern)
+        pos = match.start() if match else -1
         if pos != -1:
             if table in [t for _, t in candidates]:
                 continue
@@ -80,7 +98,8 @@ def named_tables(text: str, table_patterns: Dict[str, str]) -> List[str]:
     for pattern, table in table_patterns.items():
         if table in seen:
             continue
-        pos = text.find(pattern)
+        match = _pattern_match(text, pattern)
+        pos = match.start() if match else -1
         if pos != -1:
             occurrences.append((pos, table))
             seen.add(table)
@@ -94,8 +113,9 @@ def extract_columns(text: str, column_patterns: Dict[str, str]) -> List[str]:
     keyword is present.
     """
     columns = []
+    text = mask_non_executable(text)
     for pattern, column in column_patterns.items():
-        if pattern in text and column not in columns:
+        if _pattern_match(text, pattern) and column not in columns:
             columns.append(column)
     return columns if columns else ["*"]
 
@@ -121,11 +141,14 @@ def extract_limit(text: str) -> Optional[int]:
             # query.
             if raw_value.startswith("-"):
                 raise ValueError("LIMIT cannot be negative")
-            if len(raw_value) > len(str(MAX_NL2SQL_LIMIT)):
+            if len(raw_value) > 64:
+                raise ValueError("LIMIT number representation exceeds the maximum supported length")
+            normalized_value = raw_value.lstrip("0") or "0"
+            if len(normalized_value) > len(str(MAX_NL2SQL_LIMIT)):
                 raise ValueError(
                     f"LIMIT exceeds maximum supported value of {MAX_NL2SQL_LIMIT}"
                 )
-            value = int(raw_value)
+            value = int(normalized_value)
             if value > MAX_NL2SQL_LIMIT:
                 raise ValueError(
                     f"LIMIT exceeds maximum supported value of {MAX_NL2SQL_LIMIT}"

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/core/nl2sql_components/mappings.py

@@ -13,13 +13,13 @@ KEYWORDS: Dict[str, str] = {
     "select": "SELECT", "get": "SELECT", "find": "SELECT", "show": "SELECT", "list": "SELECT", "fetch": "SELECT",
     # Insert operations
     "插入": "INSERT", "添加": "INSERT", "新增": "INSERT", "创建": "INSERT",
-    "insert": "INSERT", "add": "INSERT", "create": "INSERT",
+    "insert": "INSERT", "add": "INSERT",
     # Update operations
     "更新": "UPDATE", "修改": "UPDATE", "改变": "UPDATE", "设置": "UPDATE",
     "update": "UPDATE", "modify": "UPDATE", "change": "UPDATE", "set": "UPDATE",
     # Delete operations
     "删除": "DELETE", "移除": "DELETE", "清除": "DELETE",
-    "delete": "DELETE", "remove": "DELETE", "drop": "DELETE",
+    "delete": "DELETE", "remove": "DELETE",
     # Aggregations
     "统计": "COUNT", "计数": "COUNT", "数量": "COUNT", "多少": "COUNT", "几个": "COUNT",
     "count": "COUNT", "total": "COUNT", "how many": "COUNT",

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/core/nl2sql_pipeline/dialect.py

@@ -127,7 +127,9 @@ def apply_dialect_adjustments(sql: str, dialect: str) -> str:
     for pattern, replacement in replacements:
         parts = []
         cursor = 0
-        for start, end in executable_segments(sql):
+        # Pass the target dialect so MySQL ``#`` comments are excluded from
+        # regex rewrites just like ``--`` and ``/* ... */`` comments.
+        for start, end in executable_segments(sql, dialect=dialect):
             parts.append(sql[cursor:start])
             segment = sql[start:end]
             segment = pattern.sub(replacement, segment)

{sql_dialect_master-1.1.3 → sql_dialect_master-1.1.4}/backend/core/nl2sql_pipeline/models.py

@@ -28,3 +28,6 @@ class NL2SQLResult:
     evidence: GenerationEvidence | None = None
     suggestions: list = field(default_factory=list)
     parsed_elements: dict = field(default_factory=dict)
+    # DML callers need to know how generated placeholders should be bound.
+    parameter_style: str | None = None
+    parameters: list = field(default_factory=list)