Files
dbx/apps/desktop/src/lib/sql/sqlParameters.ts
T

1817 lines
59 KiB
TypeScript

import type { DatabaseType } from "@/types/database";
export type SqlParameterValueKind = "string" | "number" | "boolean" | "null" | "raw";
export interface SqlParameterInput {
kind: SqlParameterValueKind;
value: string;
}
export type SqlParameterSyntax = "positional" | "named" | "shell" | "mybatis" | "sqlserver";
export interface SqlParameterDescriptor {
key: string;
name: string;
syntax: SqlParameterSyntax;
token: string;
collection?: boolean;
}
export interface SqlBracedParameter extends SqlParameterDescriptor {
start: number;
end: number;
}
interface ParameterOccurrence extends SqlParameterDescriptor {
start: number;
end: number;
replacement?: "string-fragment" | "quoted-string" | "mybatis-foreach" | "mybatis-where";
foreach?: MyBatisForeach;
where?: MyBatisWhere;
}
interface MyBatisWhere {
body: string;
}
interface MyBatisForeach {
item: string;
index?: string;
open: string;
separator: string;
close: string;
body: string;
}
interface DuckDbStructLiteralContext {
bracketDepth: number;
parenthesisDepth: number;
separators: Set<number>;
valid: boolean;
}
type ComplexTypeDeclarationKind = "struct" | "variant";
type TriggerPseudoRecordName = "new" | "old" | "parent" | "eventinfo";
export interface SqlParameterOptions {
databaseType?: DatabaseType;
/** Database-level compatibility mode, for example openGauss A/B/C/PG. */
compatibilityMode?: string;
// Which placeholder syntaxes are recognized. Undefined enables all of them.
enabledSyntaxes?: readonly SqlParameterSyntax[];
}
const PARAMETER_NAME_RE = /^[\p{L}_][\p{L}\p{N}_]*(?:\.[\p{L}_][\p{L}\p{N}_]*)*$/u;
const PARAMETER_NAME_START_RE = /[\p{L}_]/u;
const PARAMETER_NAME_CHAR_RE = /[\p{L}\p{N}_]/u;
const SQL_SERVER_TEMP_TABLE_CONTEXT_KEYWORDS = new Set(["table", "from", "join", "into", "update", "truncate"]);
const MYSQL_ROUTINE_LABEL_STATEMENTS = new Set(["begin", "loop", "while", "repeat"]);
const MYSQL_ROUTINE_LABEL_CONTEXTS = new Set(["begin", "then", "else", "do", "loop", "repeat"]);
const MYSQL_ROUTINE_LABEL_RE = /(?:`(?:``|[^`])+`|[\p{L}_][\p{L}\p{N}_]*)$/u;
const POSTGRES_QUESTION_PARAMETER_PREFIX_KEYWORDS = new Set([
"all",
"and",
"any",
"as",
"between",
"by",
"case",
"collate",
"distinct",
"else",
"fetch",
"filter",
"first",
"for",
"from",
"group",
"groups",
"having",
"ilike",
"in",
"interval",
"into",
"is",
"like",
"limit",
"next",
"not",
"offset",
"on",
"or",
"order",
"over",
"partition",
"placing",
"range",
"returning",
"rows",
"select",
"set",
"similar",
"some",
"then",
"to",
"using",
"values",
"when",
"where",
"window",
"zone",
]);
const POSTGRES_QUESTION_OPERATOR_TRAILING_KEYWORDS = new Set([
"and",
"as",
"between",
"else",
"end",
"except",
"fetch",
"filter",
"from",
"group",
"having",
"ilike",
"in",
"intersect",
"is",
"join",
"like",
"limit",
"offset",
"on",
"or",
"order",
"over",
"returning",
"then",
"union",
"when",
"where",
"window",
]);
export function readSqlBracedParameterAt(sql: string, start: number, options?: SqlParameterOptions): SqlBracedParameter | null {
const open = sql.slice(start, start + 2);
const syntax: SqlParameterSyntax | null = open === "${" ? "shell" : open === "#{" ? "mybatis" : null;
if (!syntax || (options?.enabledSyntaxes && !options.enabledSyntaxes.includes(syntax))) return null;
const closeBrace = sql.indexOf("}", start + 2);
if (closeBrace === -1) return null;
const name = sql.slice(start + 2, closeBrace).trim();
if (!PARAMETER_NAME_RE.test(name)) return null;
return { key: name, name, syntax, token: sql.slice(start, closeBrace + 1), start, end: closeBrace + 1 };
}
export function extractSqlParameters(sql: string, options?: SqlParameterOptions): string[] {
return extractSqlParameterDescriptors(sql, options).map((descriptor) => descriptor.key);
}
export function extractSqlParameterDescriptors(sql: string, options?: SqlParameterOptions): SqlParameterDescriptor[] {
const names = new Set<string>();
const descriptors: SqlParameterDescriptor[] = [];
const appendDescriptor = (descriptor: SqlParameterDescriptor) => {
if (names.has(descriptor.key)) {
if (descriptor.collection) {
const existing = descriptors.find((item) => item.key === descriptor.key);
if (existing) Object.assign(existing, { token: descriptor.token, collection: true });
}
return;
}
names.add(descriptor.key);
descriptors.push(descriptor);
};
for (const occurrence of findSqlParameterOccurrences(sql, options)) {
if (occurrence.replacement === "mybatis-where" && occurrence.where) {
for (const nested of extractSqlParameterDescriptors(occurrence.where.body, options)) appendDescriptor(nested);
continue;
}
appendDescriptor({
key: occurrence.key,
name: occurrence.name,
syntax: occurrence.syntax,
token: occurrence.token,
...(occurrence.collection ? { collection: true } : {}),
});
if (occurrence.replacement === "mybatis-foreach" && occurrence.foreach) {
for (const nested of extractSqlParameterDescriptors(occurrence.foreach.body, options)) {
if (nested.key !== occurrence.foreach.item && nested.key !== occurrence.foreach.index) appendDescriptor(nested);
}
}
}
return descriptors;
}
export function substituteSqlParameters(sql: string, values: Record<string, SqlParameterInput>, options?: SqlParameterOptions): string {
const occurrences = findSqlParameterOccurrences(sql, options);
if (!occurrences.length) return sql;
const decodeMyBatisEntities = occurrences.some((occurrence) => occurrence.syntax === "mybatis");
let result = "";
let cursor = 0;
for (const occurrence of occurrences) {
result += sql.slice(cursor, occurrence.start);
if (occurrence.replacement === "mybatis-where" && occurrence.where) {
result += renderMyBatisWhere(occurrence.where, values, options);
cursor = occurrence.end;
continue;
}
const input = values[occurrence.key] ?? { kind: "string", value: "" };
if (occurrence.replacement === "mybatis-foreach" && occurrence.foreach) {
result += renderMyBatisForeach(occurrence.foreach, input, values, options);
cursor = occurrence.end;
continue;
}
// An empty Raw SQL value means that this placeholder is intentionally left
// unresolved, rather than replaced with an empty string or NULL.
if (input.kind === "raw" && !input.value.trim()) {
result += occurrence.token;
cursor = occurrence.end;
continue;
}
// Embedded placeholders stay inside the surrounding SQL string, so their value
// must be escaped as text instead of being wrapped in a second SQL literal.
result += occurrence.replacement === "string-fragment" ? sqlParameterStringFragment(input) : occurrence.replacement === "quoted-string" ? sqlParameterQuotedString(input) : sqlParameterLiteral(input);
cursor = occurrence.end;
}
result += sql.slice(cursor);
return decodeMyBatisEntities ? decodeMyBatisXmlComparisonEntities(result, options?.databaseType) : result;
}
const MYBATIS_WHERE_LEADING_CONJUNCTION_RE = /^(?:AND|OR)\s+/i;
function renderMyBatisWhere(where: MyBatisWhere, values: Record<string, SqlParameterInput>, options?: SqlParameterOptions): string {
const body = substituteSqlParameters(where.body, values, options).trim();
if (!body) return "";
return `WHERE ${body.replace(MYBATIS_WHERE_LEADING_CONJUNCTION_RE, "")}`;
}
function renderMyBatisForeach(foreach: MyBatisForeach, input: SqlParameterInput, values: Record<string, SqlParameterInput>, options?: SqlParameterOptions): string {
const items = parseSqlParameterList(input.value);
if (items.length === 0) return `${foreach.open}NULL${foreach.close}`;
const renderedItems = items.map((item, index) => {
const itemInput: SqlParameterInput = item === null ? { kind: "null", value: "NULL" } : { kind: input.kind, value: String(item) };
const iterationValues = { ...values, [foreach.item]: itemInput };
if (foreach.index) iterationValues[foreach.index] = { kind: "number", value: String(index) };
return substituteSqlParameters(foreach.body, iterationValues, options);
});
return `${foreach.open}${renderedItems.join(foreach.separator)}${foreach.close}`;
}
function parseSqlParameterList(raw: string): Array<string | number | boolean | null> {
const value = raw.trim();
if (!value) return [];
if (value.startsWith("[")) {
try {
const parsed = JSON.parse(value);
if (Array.isArray(parsed) && parsed.every((item) => item === null || ["string", "number", "boolean"].includes(typeof item))) return parsed;
} catch {
return [];
}
return [];
}
return splitCommaSeparatedValues(value).map(unquoteListValue);
}
function splitCommaSeparatedValues(value: string): string[] {
const items: string[] = [];
let start = 0;
let quote = "";
for (let i = 0; i < value.length; i += 1) {
const ch = value[i];
if (quote) {
if (ch === "\\" && quote === '"' && i + 1 < value.length) i += 1;
else if (ch === quote) {
if (value[i + 1] === quote) i += 1;
else quote = "";
}
continue;
}
if (ch === "'" || ch === '"') quote = ch;
else if (ch === ",") {
items.push(value.slice(start, i).trim());
start = i + 1;
}
}
items.push(value.slice(start).trim());
return items;
}
function unquoteListValue(value: string): string {
if (value.length < 2 || value[0] !== value[value.length - 1] || (value[0] !== "'" && value[0] !== '"')) return value;
const quote = value[0];
const inner = value.slice(1, -1);
if (quote === "'") return inner.replace(/''/g, "'");
try {
return JSON.parse(value);
} catch {
return inner.replace(/""/g, '"');
}
}
function decodeMyBatisXmlComparisonEntities(sql: string, databaseType?: DatabaseType): string {
let result = "";
let cursor = 0;
let i = 0;
while (i < sql.length) {
const ch = sql[i];
const next = sql[i + 1];
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "$") {
const marker = readDollarQuoteMarker(sql, i);
if (marker) {
const end = sql.indexOf(marker, i + marker.length);
i = end === -1 ? sql.length : end + marker.length;
continue;
}
}
const replacement = sql.startsWith("&lt;", i) ? "<" : sql.startsWith("&gt;", i) ? ">" : "";
if (replacement) {
result += sql.slice(cursor, i) + replacement;
i += 4;
cursor = i;
continue;
}
i += 1;
}
return result + sql.slice(cursor);
}
export function sqlParameterLiteral(input: SqlParameterInput): string {
if (input.kind === "null") return "NULL";
const raw = input.value;
if (input.kind === "raw") return raw.trim() || "NULL";
if (input.kind === "number") return raw.trim() || "NULL";
if (input.kind === "boolean") return normalizeBooleanLiteral(raw);
return quoteSqlString(raw);
}
function findSqlParameterOccurrences(sql: string, options?: SqlParameterOptions): ParameterOccurrence[] {
const occurrences: ParameterOccurrence[] = [];
const databaseType = options?.databaseType;
const nativeSqlServerParameters = collectNativeSqlServerParameters(sql, databaseType);
const supportsNamedParameters = databaseType !== "saphana";
const enabledSyntaxes = options?.enabledSyntaxes ? new Set(options.enabledSyntaxes) : null;
const isSyntaxEnabled = (syntax: SqlParameterSyntax) => !enabledSyntaxes || enabledSyntaxes.has(syntax);
const complexTypeFieldSeparators = supportsNamedParameters && isSyntaxEnabled("named") ? collectComplexTypeFieldSeparators(sql, databaseType) : new Set<number>();
const duckDbStructFieldSeparators = supportsNamedParameters && isSyntaxEnabled("named") && databaseType === "duckdb" ? collectDuckDbStructFieldSeparators(sql) : new Set<number>();
const triggerPseudoRecordFieldStarts = supportsNamedParameters && isSyntaxEnabled("named") ? collectTriggerPseudoRecordFieldStarts(sql, databaseType) : new Set<number>();
let i = 0;
let dollarQuoteEnd = "";
let positionalIndex = 0;
let parenthesisDepth = 0;
const postgresBracketStack: Array<{ constructor: boolean; parenthesisDepth: number }> = [];
while (i < sql.length) {
if (dollarQuoteEnd) {
const end = sql.indexOf(dollarQuoteEnd, i);
if (end === -1) break;
i = end + dollarQuoteEnd.length;
dollarQuoteEnd = "";
continue;
}
const ch = sql[i];
const next = sql[i + 1];
if (ch === "<" && isSyntaxEnabled("mybatis")) {
const foreach = readMyBatisForeachAt(sql, i, databaseType);
if (foreach) {
occurrences.push({
key: foreach.collection,
name: foreach.collection,
syntax: "mybatis",
token: "<foreach>",
collection: true,
replacement: "mybatis-foreach",
foreach: foreach.render,
start: i,
end: foreach.end,
});
i = foreach.end;
continue;
}
const where = readMyBatisWhereAt(sql, i);
if (where) {
occurrences.push({
key: "",
name: "",
syntax: "mybatis",
token: "<where>",
replacement: "mybatis-where",
where: { body: where.body },
start: i,
end: where.end,
});
i = where.end;
continue;
}
}
if (ch === "'" || ch === '"') {
const quoted = tryReadQuotedBracedPlaceholder(sql, i, ch, isSyntaxEnabled);
if (quoted) {
occurrences.push(quoted);
i = quoted.end;
continue;
}
const quotedEnd = skipQuoted(sql, i, ch);
// Double quotes can delimit identifiers, so only ordinary single-quoted
// values opt into embedded interpolation.
if (ch === "'" && !hasSqlStringLiteralPrefix(sql, i)) {
occurrences.push(...collectEmbeddedQuotedBracedPlaceholders(sql, i + 1, quotedEnd, isSyntaxEnabled));
}
i = quotedEnd;
continue;
}
if (ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (databaseType === "postgres" && ch === "(") {
parenthesisDepth += 1;
i += 1;
continue;
}
if (databaseType === "postgres" && ch === ")") {
parenthesisDepth = Math.max(0, parenthesisDepth - 1);
i += 1;
continue;
}
if (ch === "[") {
if (databaseType === "postgres") {
postgresBracketStack.push({
constructor: isPostgresArrayConstructorBracket(sql, i, postgresBracketStack[postgresBracketStack.length - 1]?.constructor ?? false),
parenthesisDepth,
});
i += 1;
continue;
}
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (databaseType === "postgres" && ch === "]") {
postgresBracketStack.pop();
i += 1;
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (ch === "?" && isSyntaxEnabled("positional")) {
if (isPostgresQuestionMarkOperator(sql, i, options?.databaseType)) {
i += 1;
continue;
}
positionalIndex += 1;
const key = `?${positionalIndex}`;
occurrences.push({ key, name: key, syntax: "positional", token: "?", start: i, end: i + 1 });
i += 1;
continue;
}
if (ch === ":" && supportsNamedParameters && isSyntaxEnabled("named")) {
const name = readParameterName(sql, i + 1);
if (
name &&
sql[i - 1] !== ":" &&
sql[i + 1] !== "=" &&
!complexTypeFieldSeparators.has(i) &&
!duckDbStructFieldSeparators.has(i) &&
!isPostgresSliceSeparator(postgresBracketStack, parenthesisDepth) &&
!isDuckDbCompactPrefixAliasSeparator(sql, i, options?.databaseType) &&
!triggerPseudoRecordFieldStarts.has(i) &&
!isMysqlRoutineLabelSeparator(sql, i, name, options?.databaseType)
) {
occurrences.push({
key: name,
name,
syntax: "named",
token: sql.slice(i, i + 1 + name.length),
start: i,
end: i + 1 + name.length,
});
i += 1 + name.length;
continue;
}
}
if ((ch === "$" || ch === "#") && next === "{") {
const parameter = readSqlBracedParameterAt(sql, i, options);
if (parameter) {
occurrences.push(parameter);
i = parameter.end;
continue;
}
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "@" && isSyntaxEnabled("sqlserver")) {
const name = readParameterName(sql, i + 1);
if (name && next !== "@" && sql[i - 1] !== "@" && !isOracleDatabaseLinkMarker(sql, i, options?.databaseType) && !isJdbcxMcpScopedPackage(sql, i, i + 1 + name.length) && !nativeSqlServerParameters.declared.has(name.toLowerCase()) && !nativeSqlServerParameters.ignoredStarts.has(i)) {
occurrences.push({
key: name,
name,
syntax: "sqlserver",
token: sql.slice(i, i + 1 + name.length),
start: i,
end: i + 1 + name.length,
});
i += 1 + name.length;
continue;
}
}
if (ch === "$") {
const marker = readDollarQuoteMarker(sql, i);
if (marker) {
dollarQuoteEnd = marker;
i += marker.length;
continue;
}
}
i += 1;
}
return occurrences;
}
function isMysqlRoutineLabelSeparator(sql: string, colonIndex: number, followingName: string, databaseType?: DatabaseType): boolean {
if (databaseType !== "mysql" || !MYSQL_ROUTINE_LABEL_STATEMENTS.has(followingName.toLowerCase())) return false;
const label = sql.slice(0, colonIndex).match(MYSQL_ROUTINE_LABEL_RE);
if (!label) return false;
const labelStart = colonIndex - label[0].length;
const prefix = sql.slice(0, labelStart).trimEnd();
return prefix.length === 0 || prefix.endsWith(";") || MYSQL_ROUTINE_LABEL_CONTEXTS.has(previousKeyword(sql, labelStart));
}
function readMyBatisForeachAt(sql: string, start: number, databaseType?: DatabaseType): { collection: string; render: MyBatisForeach; end: number } | null {
if (!/^<foreach(?:\s|>)/i.test(sql.slice(start))) return null;
const openingEnd = findXmlTagEnd(sql, start);
if (openingEnd === -1) return null;
const attributes = parseXmlAttributes(sql.slice(start + "<foreach".length, openingEnd));
if (!attributes) return null;
const collection = attributes.get("collection")?.trim() ?? "";
const item = attributes.get("item")?.trim() ?? "";
const index = attributes.get("index")?.trim();
if (!PARAMETER_NAME_RE.test(collection) || !PARAMETER_NAME_RE.test(item) || (index !== undefined && !PARAMETER_NAME_RE.test(index))) return null;
const close = findMatchingXmlTagClose(sql, openingEnd + 1, "foreach", databaseType);
if (!close) return null;
return {
collection,
render: {
item,
...(index ? { index } : {}),
open: attributes.get("open") ?? "",
separator: attributes.get("separator") ?? "",
close: attributes.get("close") ?? "",
body: sql.slice(openingEnd + 1, close.start),
},
end: close.end,
};
}
function readMyBatisWhereAt(sql: string, start: number): { body: string; end: number } | null {
if (!/^<where(?:\s|>)/i.test(sql.slice(start))) return null;
const openingEnd = findXmlTagEnd(sql, start);
if (openingEnd === -1) return null;
const close = findMatchingXmlTagClose(sql, openingEnd + 1, "where");
if (!close) return null;
return { body: sql.slice(openingEnd + 1, close.start), end: close.end };
}
function findXmlTagEnd(source: string, start: number): number {
let quote = "";
for (let i = start + 1; i < source.length; i += 1) {
const ch = source[i];
if (quote) {
if (ch === quote) quote = "";
} else if (ch === "'" || ch === '"') quote = ch;
else if (ch === ">") return i;
}
return -1;
}
function parseXmlAttributes(source: string): Map<string, string> | null {
const attributes = new Map<string, string>();
let i = 0;
while (i < source.length) {
while (/\s/.test(source[i] ?? "")) i += 1;
if (i >= source.length) break;
const nameStart = i;
while (/[\w:-]/.test(source[i] ?? "")) i += 1;
if (i === nameStart) return null;
const name = source.slice(nameStart, i).toLowerCase();
while (/\s/.test(source[i] ?? "")) i += 1;
if (source[i] !== "=") return null;
i += 1;
while (/\s/.test(source[i] ?? "")) i += 1;
const quote = source[i];
if (quote !== "'" && quote !== '"') return null;
const valueStart = ++i;
while (i < source.length && source[i] !== quote) i += 1;
if (i >= source.length) return null;
attributes.set(name, decodeXmlAttribute(source.slice(valueStart, i)));
i += 1;
}
return attributes;
}
function decodeXmlAttribute(value: string): string {
return value.replace(/&(?:lt|gt|amp|quot|apos);/g, (entity) => ({ "&lt;": "<", "&gt;": ">", "&amp;": "&", "&quot;": '"', "&apos;": "'" })[entity] ?? entity);
}
function findMatchingXmlTagClose(sql: string, start: number, tagName: string, databaseType?: DatabaseType): { start: number; end: number } | null {
let depth = 1;
let i = start;
while (i < sql.length) {
const ch = sql[i];
const next = sql[i + 1];
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "$") {
const marker = readDollarQuoteMarker(sql, i);
if (marker) {
const end = sql.indexOf(marker, i + marker.length);
i = end === -1 ? sql.length : end + marker.length;
continue;
}
}
if (ch === "<") {
const tag = readXmlTagAt(sql, i, tagName);
if (tag) {
depth += tag.closing ? -1 : 1;
if (depth === 0) return { start: i, end: tag.end };
i = tag.end;
continue;
}
}
i += 1;
}
return null;
}
function readXmlTagAt(sql: string, start: number, tagName: string): { closing: boolean; end: number } | null {
const closing = sql[start + 1] === "/";
const nameStart = start + (closing ? 2 : 1);
if (sql.slice(nameStart, nameStart + tagName.length).toLowerCase() !== tagName) return null;
const boundary = sql[nameStart + tagName.length];
if (boundary !== ">" && !/\s/.test(boundary ?? "")) return null;
const tagEnd = findXmlTagEnd(sql, start);
return tagEnd === -1 ? null : { closing, end: tagEnd + 1 };
}
function isDuckDbCompactPrefixAliasSeparator(sql: string, index: number, databaseType?: DatabaseType): boolean {
if (databaseType !== "duckdb") return false;
const previous = sql[index - 1] ?? "";
return PARAMETER_NAME_CHAR_RE.test(previous) || previous === '"';
}
function isOracleDatabaseLinkMarker(sql: string, index: number, databaseType: DatabaseType | undefined): boolean {
if (databaseType !== "oracle" || index === 0) return false;
const previous = sql[index - 1];
return PARAMETER_NAME_CHAR_RE.test(previous) || previous === "$" || previous === "#" || previous === '"';
}
function isPostgresQuestionMarkOperator(sql: string, index: number, databaseType: DatabaseType | undefined): boolean {
if (databaseType !== "postgres") return false;
if (sql[index - 1] === "@" || sql[index + 1] === "|" || sql[index + 1] === "&") return true;
const previousIndex = previousSqlSignificantIndex(sql, index);
if (previousIndex < 0 || !canEndPostgresExpression(sql, previousIndex)) return false;
const nextIndex = skipSqlWhitespaceAndComments(sql, index + 1);
if (nextIndex >= sql.length) return false;
const next = sql[nextIndex];
if (next === "'" || next === '"' || next === "`" || next === "[" || next === "(" || next === "$" || next === ":" || next === "#" || next === "@" || next === "?" || next === "+" || next === "-") return true;
if (!PARAMETER_NAME_CHAR_RE.test(next)) return false;
let end = nextIndex + 1;
while (end < sql.length && PARAMETER_NAME_CHAR_RE.test(sql[end])) end += 1;
return !POSTGRES_QUESTION_OPERATOR_TRAILING_KEYWORDS.has(sql.slice(nextIndex, end).toLowerCase());
}
function previousSqlSignificantIndex(sql: string, start: number): number {
let index = start - 1;
while (index >= 0) {
while (index >= 0 && /\s/.test(sql[index])) index -= 1;
if (index >= 1 && sql[index - 1] === "*" && sql[index] === "/") {
const commentStart = sql.lastIndexOf("/*", index - 1);
if (commentStart >= 0) {
index = commentStart - 1;
continue;
}
}
return index;
}
return -1;
}
function canEndPostgresExpression(sql: string, end: number): boolean {
const previous = sql[end];
if (previous === ")" || previous === "]" || previous === "}" || previous === "'" || previous === '"' || previous === "`" || previous === "$") return true;
if (!PARAMETER_NAME_CHAR_RE.test(previous)) return false;
let start = end;
while (start > 0 && PARAMETER_NAME_CHAR_RE.test(sql[start - 1])) start -= 1;
return !POSTGRES_QUESTION_PARAMETER_PREFIX_KEYWORDS.has(sql.slice(start, end + 1).toLowerCase());
}
function collectDuckDbStructFieldSeparators(sql: string): Set<number> {
const separators = new Set<number>();
const contexts: DuckDbStructLiteralContext[] = [];
let cursor = 0;
let dollarQuoteEnd = "";
while (cursor < sql.length) {
if (dollarQuoteEnd) {
const end = sql.indexOf(dollarQuoteEnd, cursor);
if (end === -1) break;
cursor = end + dollarQuoteEnd.length;
dollarQuoteEnd = "";
continue;
}
const ch = sql[cursor];
const next = sql[cursor + 1];
if (ch === "'" || ch === '"' || ch === "`") {
cursor = skipQuoted(sql, cursor, ch);
continue;
}
if (ch === "-" && next === "-") {
cursor = skipLine(sql, cursor + 2);
continue;
}
if (ch === "/" && next === "*") {
cursor = skipBlockComment(sql, cursor + 2);
continue;
}
if (isHashLineComment(sql, cursor)) {
cursor = skipLine(sql, cursor + 1);
continue;
}
if (ch === "$") {
const marker = readDollarQuoteMarker(sql, cursor);
if (marker) {
dollarQuoteEnd = marker;
cursor += marker.length;
continue;
}
}
if (ch === "{") {
const separator = readDuckDbStructFieldSeparator(sql, cursor + 1);
contexts.push({
bracketDepth: 0,
parenthesisDepth: 0,
separators: new Set(separator === null ? [] : [separator]),
valid: separator !== null,
});
cursor += 1;
continue;
}
if (ch === "}") {
const context = contexts.pop();
if (context?.valid) {
const parent = contexts[contexts.length - 1];
const destination = parent ? parent.separators : separators;
for (const separator of context.separators) destination.add(separator);
}
cursor += 1;
continue;
}
const context = contexts[contexts.length - 1];
if (!context) {
cursor += 1;
continue;
}
if (ch === "(") context.parenthesisDepth += 1;
else if (ch === ")" && context.parenthesisDepth > 0) context.parenthesisDepth -= 1;
else if (ch === "[") context.bracketDepth += 1;
else if (ch === "]" && context.bracketDepth > 0) context.bracketDepth -= 1;
else if (ch === "," && context.valid && context.parenthesisDepth === 0 && context.bracketDepth === 0) {
const separator = readDuckDbStructFieldSeparator(sql, cursor + 1);
if (separator !== null) context.separators.add(separator);
}
cursor += 1;
}
return separators;
}
function readDuckDbStructFieldSeparator(sql: string, start: number): number | null {
const fieldStart = skipSqlWhitespaceAndComments(sql, start);
const ch = sql[fieldStart];
let fieldNameEnd = fieldStart;
if (ch === "'" || ch === '"' || ch === "`") fieldNameEnd = skipQuoted(sql, fieldStart, ch);
else {
const fieldName = readParameterName(sql, fieldStart);
if (!fieldName) return null;
fieldNameEnd += fieldName.length;
}
const separator = skipSqlWhitespaceAndComments(sql, fieldNameEnd);
return sql[separator] === ":" ? separator : null;
}
// Oracle and Dameng expose trigger rows through colon-prefixed pseudo-records,
// unlike PostgreSQL's unprefixed NEW/OLD records. Keep ordinary :name binds enabled.
function collectTriggerPseudoRecordFieldStarts(sql: string, databaseType?: DatabaseType): Set<number> {
const starts = new Set<number>();
const defaults = triggerPseudoRecordDefaults(databaseType);
if (!defaults) return starts;
let aliases: Set<string> | null = null;
let i = 0;
let dollarQuoteEnd = "";
while (i < sql.length) {
if (dollarQuoteEnd) {
const end = sql.indexOf(dollarQuoteEnd, i);
if (end === -1) break;
i = end + dollarQuoteEnd.length;
dollarQuoteEnd = "";
continue;
}
const ch = sql[i];
const next = sql[i + 1];
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "$") {
const marker = readDollarQuoteMarker(sql, i);
if (marker) {
dollarQuoteEnd = marker;
i += marker.length;
continue;
}
}
if (aliases && ch === "/" && isStandaloneSlashDelimiter(sql, i)) {
aliases = null;
i += 1;
continue;
}
if (!aliases && matchesWord(sql, i, "create")) {
const triggerStart = readCreateTriggerEnd(sql, i);
if (triggerStart !== null) {
aliases = new Set(defaults);
i = triggerStart;
continue;
}
}
if (aliases && matchesWord(sql, i, "referencing")) {
i = collectTriggerReferencingAliases(sql, i + "referencing".length, aliases, defaults);
continue;
}
if (aliases && ch === ":") {
const name = readParameterName(sql, i + 1);
if (name && aliases.has(name.toLowerCase()) && isTriggerPseudoRecordFieldReference(sql, i + 1 + name.length)) {
starts.add(i);
i += 1 + name.length;
continue;
}
}
i += 1;
}
return starts;
}
function triggerPseudoRecordDefaults(databaseType?: DatabaseType): readonly TriggerPseudoRecordName[] | null {
if (databaseType === "oracle") return ["new", "old", "parent"];
if (databaseType === "dameng") return ["new", "old", "eventinfo"];
return null;
}
function readCreateTriggerEnd(sql: string, start: number): number | null {
let keyword = readNextKeyword(sql, start + "create".length);
if (!keyword) return null;
if (keyword.word === "or") {
keyword = readNextKeyword(sql, keyword.end);
if (keyword?.word !== "replace") return null;
keyword = readNextKeyword(sql, keyword.end);
}
return keyword?.word === "trigger" ? keyword.end : null;
}
function collectTriggerReferencingAliases(sql: string, start: number, aliases: Set<string>, defaults: readonly TriggerPseudoRecordName[]): number {
const supported = new Set<string>(defaults);
let i = start;
while (i < sql.length) {
const source = readNextKeyword(sql, i);
if (!source || isTriggerReferencingBoundary(source.word)) return i;
if (!supported.has(source.word)) {
i = source.end;
continue;
}
let alias = readNextKeyword(sql, source.end);
if (alias?.word === "row") alias = readNextKeyword(sql, alias.end);
if (alias?.word === "as") alias = readNextKeyword(sql, alias.end);
if (!alias || supported.has(alias.word) || isTriggerReferencingBoundary(alias.word)) {
i = source.end;
continue;
}
aliases.add(alias.word);
i = alias.end;
}
return i;
}
function isTriggerReferencingBoundary(word: string): boolean {
return ["before", "after", "instead", "for", "when", "begin", "declare", "call", "enable", "disable"].includes(word);
}
function isTriggerPseudoRecordFieldReference(sql: string, nameEnd: number): boolean {
if (sql[nameEnd] !== ".") return false;
const fieldStart = nameEnd + 1;
return PARAMETER_NAME_START_RE.test(sql[fieldStart] ?? "") || sql[fieldStart] === '"';
}
function isStandaloneSlashDelimiter(sql: string, start: number): boolean {
let before = start - 1;
while (before >= 0 && (sql[before] === " " || sql[before] === "\t" || sql[before] === "\r")) before -= 1;
if (before >= 0 && sql[before] !== "\n") return false;
let after = start + 1;
while (after < sql.length && (sql[after] === " " || sql[after] === "\t" || sql[after] === "\r")) after += 1;
return after === sql.length || sql[after] === "\n";
}
// JDBCX MCP commands accept npm scoped packages in their unquoted args value,
// for example `args=-y @modelcontextprotocol/server-everything`. The `@scope`
// prefix is command data, not a SQL Server-style template parameter.
function isJdbcxMcpScopedPackage(sql: string, start: number, nameEnd: number): boolean {
if (sql[nameEnd] !== "/" || !/[\p{L}\p{N}_.-]/u.test(sql[nameEnd + 1] ?? "")) return false;
const blockStart = sql.lastIndexOf("{{", start);
if (blockStart === -1 || sql.lastIndexOf("}}", start) > blockStart) return false;
const extensionPrefix = sql.slice(blockStart + 2, start);
return /^\s*mcp\s*\(/i.test(extensionPrefix) && /(?:^|[,\s])args\s*=[^,]*$/i.test(extensionPrefix);
}
// Doris-style complex types use colons between field names and types; those are not bind parameters.
function collectComplexTypeFieldSeparators(sql: string, databaseType?: DatabaseType): Set<number> {
const separators = new Set<number>();
let i = 0;
let dollarQuoteEnd = "";
while (i < sql.length) {
if (dollarQuoteEnd) {
const end = sql.indexOf(dollarQuoteEnd, i);
if (end === -1) break;
i = end + dollarQuoteEnd.length;
dollarQuoteEnd = "";
continue;
}
const ch = sql[i];
const next = sql[i + 1];
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "$") {
const marker = readDollarQuoteMarker(sql, i);
if (marker) {
dollarQuoteEnd = marker;
i += marker.length;
continue;
}
}
const declaration = readComplexTypeDeclaration(sql, i);
if (declaration) {
i = collectComplexTypeFieldSeparatorsInDeclaration(sql, declaration.openingBracket + 1, declaration.kind, separators, databaseType) + 1;
continue;
}
i += 1;
}
return separators;
}
function collectComplexTypeFieldSeparatorsInDeclaration(sql: string, start: number, kind: ComplexTypeDeclarationKind, separators: Set<number>, databaseType?: DatabaseType): number {
let i = start;
let genericDepth = 0;
let parenthesisDepth = 0;
let expectsFieldName = true;
while (i < sql.length) {
if (expectsFieldName && genericDepth === 0 && parenthesisDepth === 0) {
const fieldStart = skipSqlWhitespaceAndComments(sql, i);
if (fieldStart !== i) {
i = fieldStart;
continue;
}
if (isLineStatementStart(sql, i) && isSqlStatementKeyword(sql, i)) return i;
const fieldNameEnd = readComplexTypeFieldNameEnd(sql, i, kind, databaseType);
if (fieldNameEnd > i) {
const separator = skipSqlWhitespaceAndComments(sql, fieldNameEnd);
if (sql[separator] === ":") {
separators.add(separator);
i = separator + 1;
expectsFieldName = false;
continue;
}
i = fieldNameEnd;
expectsFieldName = false;
continue;
}
}
const ch = sql[i];
const next = sql[i + 1];
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
const declaration = readComplexTypeDeclaration(sql, i);
if (declaration) {
i = collectComplexTypeFieldSeparatorsInDeclaration(sql, declaration.openingBracket + 1, declaration.kind, separators, databaseType) + 1;
continue;
}
if (ch === ";" && genericDepth === 0 && parenthesisDepth === 0) return i;
if (ch === "<") {
genericDepth += 1;
i += 1;
continue;
}
if (ch === ">") {
if (genericDepth === 0 && parenthesisDepth === 0) return i;
if (genericDepth > 0) genericDepth -= 1;
i += 1;
continue;
}
if (ch === "(") {
parenthesisDepth += 1;
i += 1;
continue;
}
if (ch === ")") {
if (parenthesisDepth > 0) parenthesisDepth -= 1;
i += 1;
continue;
}
if (ch === "," && genericDepth === 0 && parenthesisDepth === 0) {
expectsFieldName = true;
}
i += 1;
}
return sql.length;
}
function readComplexTypeDeclaration(sql: string, start: number): { kind: ComplexTypeDeclarationKind; openingBracket: number } | null {
const kind: ComplexTypeDeclarationKind | null = matchesWord(sql, start, "struct") ? "struct" : matchesWord(sql, start, "variant") ? "variant" : null;
if (!kind) return null;
const openingBracket = skipSqlWhitespaceAndComments(sql, start + kind.length);
return sql[openingBracket] === "<" ? { kind, openingBracket } : null;
}
function readComplexTypeFieldNameEnd(sql: string, start: number, kind: ComplexTypeDeclarationKind, databaseType?: DatabaseType): number {
if (kind === "variant") return readVariantFieldNameEnd(sql, start);
const ch = sql[start];
if (ch === '"' || ch === "`") return skipQuoted(sql, start, ch);
if (ch === "[") return skipBracketIdentifier(sql, start, databaseType);
if (!PARAMETER_NAME_START_RE.test(ch ?? "")) return start;
let i = start + 1;
while (i < sql.length && PARAMETER_NAME_CHAR_RE.test(sql[i])) i += 1;
return i;
}
function readVariantFieldNameEnd(sql: string, start: number): number {
let i = start;
const modifier = matchesWord(sql, i, "match_name") ? "match_name" : matchesWord(sql, i, "match_name_glob") ? "match_name_glob" : "";
if (modifier) i = skipSqlWhitespaceAndComments(sql, i + modifier.length);
return sql[i] === "'" ? skipQuoted(sql, i, "'") : start;
}
function skipSqlWhitespaceAndComments(sql: string, start: number): number {
let i = start;
while (i < sql.length) {
while (i < sql.length && /\s/.test(sql[i])) i += 1;
if (sql[i] === "-" && sql[i + 1] === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (sql[i] === "/" && sql[i + 1] === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
break;
}
return i;
}
function collectNativeSqlServerParameters(sql: string, databaseType?: DatabaseType): { declared: Set<string>; ignoredStarts: Set<number> } {
const declared = new Set<string>();
const ignoredStarts = new Set<number>();
let i = 0;
let dollarQuoteEnd = "";
while (i < sql.length) {
if (dollarQuoteEnd) {
const end = sql.indexOf(dollarQuoteEnd, i);
if (end === -1) break;
i = end + dollarQuoteEnd.length;
dollarQuoteEnd = "";
continue;
}
const ch = sql[i];
const next = sql[i + 1];
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (ch === "$") {
const marker = readDollarQuoteMarker(sql, i);
if (marker) {
dollarQuoteEnd = marker;
i += marker.length;
continue;
}
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (matchesWord(sql, i, "declare")) {
i = collectDeclareStatementVariables(sql, i + "declare".length, declared, databaseType);
continue;
}
if (matchesWord(sql, i, "set")) {
i = collectSetStatementVariables(sql, i + "set".length, declared, databaseType);
continue;
}
if (matchesWord(sql, i, "select")) {
i = collectSelectAssignmentVariables(sql, i + "select".length, declared, databaseType);
continue;
}
if (matchesWord(sql, i, "get")) {
const diagnosticsEnd = readGetDiagnosticsEnd(sql, i);
if (diagnosticsEnd !== null) {
i = collectSetStatementVariables(sql, diagnosticsEnd, declared, databaseType);
continue;
}
}
if ((matchesWord(sql, i, "create") || matchesWord(sql, i, "alter")) && isRoutineDefinitionStart(sql, i)) {
i = collectRoutineDefinitionVariables(sql, i, declared, databaseType);
continue;
}
if (matchesWord(sql, i, "exec") || matchesWord(sql, i, "execute")) {
i = collectExecNamedArgumentStarts(sql, i + (matchesWord(sql, i, "exec") ? "exec".length : "execute".length), ignoredStarts, databaseType);
continue;
}
i += 1;
}
return { declared, ignoredStarts };
}
function collectDeclareStatementVariables(sql: string, start: number, declared: Set<string>, databaseType?: DatabaseType): number {
let i = start;
while (i < sql.length) {
const ch = sql[i];
const next = sql[i + 1];
if (ch === ";") return i + 1;
if (isLineStatementStart(sql, i) && isSqlStatementKeyword(sql, i)) return i;
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "@") {
const name = readParameterName(sql, i + 1);
if (name && next !== "@" && sql[i - 1] !== "@") {
declared.add(name.toLowerCase());
i += 1 + name.length;
continue;
}
}
i += 1;
}
return i;
}
function collectSetStatementVariables(sql: string, start: number, declared: Set<string>, databaseType?: DatabaseType): number {
let i = start;
while (i < sql.length) {
const ch = sql[i];
const next = sql[i + 1];
if (ch === ";") return i + 1;
if (isLineStatementStart(sql, i) && isSqlStatementKeyword(sql, i)) return i;
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "@") {
const name = readParameterName(sql, i + 1);
if (name && next !== "@" && sql[i - 1] !== "@" && isSetAssignmentTarget(sql, i + 1 + name.length)) {
declared.add(name.toLowerCase());
i += 1 + name.length;
continue;
}
}
i += 1;
}
return i;
}
function collectSelectAssignmentVariables(sql: string, start: number, declared: Set<string>, databaseType?: DatabaseType): number {
let i = start;
let depth = 0;
while (i < sql.length) {
const ch = sql[i];
const next = sql[i + 1];
if (ch === ";" && depth === 0) return i + 1;
if (depth === 0 && isLineStatementStart(sql, i) && isSqlStatementKeyword(sql, i)) return i;
if (databaseType !== "mysql" && matchesWord(sql, i, "from")) return i;
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (databaseType === "mysql" && ch === "(") {
depth += 1;
i += 1;
continue;
}
if (databaseType === "mysql" && ch === ")") {
depth = Math.max(0, depth - 1);
i += 1;
continue;
}
if (databaseType === "mysql" && depth === 0 && matchesWord(sql, i, "into")) {
const targetEnd = collectMysqlSelectIntoTargets(sql, i + "into".length, declared);
if (targetEnd !== null) {
i = targetEnd;
continue;
}
}
if (ch === "@") {
const name = readParameterName(sql, i + 1);
if (name && next !== "@" && sql[i - 1] !== "@" && isSetAssignmentTarget(sql, i + 1 + name.length)) {
declared.add(name.toLowerCase());
i += 1 + name.length;
continue;
}
}
i += 1;
}
return i;
}
function collectMysqlSelectIntoTargets(sql: string, start: number, declared: Set<string>): number | null {
let i = skipSqlWhitespaceAndComments(sql, start);
let found = false;
while (i < sql.length && sql[i] === "@" && sql[i + 1] !== "@" && sql[i - 1] !== "@") {
const name = readParameterName(sql, i + 1);
if (!name) break;
declared.add(name.toLowerCase());
found = true;
i = skipSqlWhitespaceAndComments(sql, i + 1 + name.length);
if (sql[i] !== ",") break;
i = skipSqlWhitespaceAndComments(sql, i + 1);
}
return found ? i : null;
}
function collectRoutineDefinitionVariables(sql: string, start: number, declared: Set<string>, databaseType?: DatabaseType): number {
let i = start;
while (i < sql.length) {
const ch = sql[i];
const next = sql[i + 1];
if (ch === ";") return i + 1;
if (matchesWord(sql, i, "as") || matchesWord(sql, i, "returns")) return i;
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "@") {
const name = readParameterName(sql, i + 1);
if (name && next !== "@" && sql[i - 1] !== "@") {
declared.add(name.toLowerCase());
i += 1 + name.length;
continue;
}
}
i += 1;
}
return i;
}
function collectExecNamedArgumentStarts(sql: string, start: number, ignoredStarts: Set<number>, databaseType?: DatabaseType): number {
let i = start;
while (i < sql.length) {
const ch = sql[i];
const next = sql[i + 1];
if (ch === ";") return i + 1;
if (isLineStatementStart(sql, i) && isSqlStatementKeyword(sql, i)) return i;
if (ch === "'" || ch === '"' || ch === "`") {
i = skipQuoted(sql, i, ch);
continue;
}
if (ch === "[") {
i = skipBracketIdentifier(sql, i, databaseType);
continue;
}
if (ch === "-" && next === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (ch === "/" && next === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
if (isHashLineComment(sql, i)) {
i = skipLine(sql, i + 1);
continue;
}
if (ch === "@") {
const name = readParameterName(sql, i + 1);
if (name && next !== "@" && sql[i - 1] !== "@" && isSetAssignmentTarget(sql, i + 1 + name.length)) {
ignoredStarts.add(i);
i += 1 + name.length;
continue;
}
}
i += 1;
}
return i;
}
// MySQL's GET DIAGNOSTICS writes its results into the user variables on the left
// of each assignment (`GET DIAGNOSTICS CONDITION 1 @err = MESSAGE_TEXT`), exactly
// as SET and SELECT ... INTO do. Returns the offset just past the statement's
// leading keywords, or null when `start` is an ordinary `get` identifier.
function readGetDiagnosticsEnd(sql: string, start: number): number | null {
let keyword = readNextKeyword(sql, start + "get".length);
if (keyword?.word === "current" || keyword?.word === "stacked") keyword = readNextKeyword(sql, keyword.end);
return keyword?.word === "diagnostics" ? keyword.end : null;
}
function isRoutineDefinitionStart(sql: string, start: number): boolean {
const keyword = matchesWord(sql, start, "create") ? "create" : matchesWord(sql, start, "alter") ? "alter" : "";
if (!keyword) return false;
let next = readNextKeyword(sql, start + keyword.length);
if (!next) return false;
if (keyword === "create" && next.word === "or") {
const afterOr = readNextKeyword(sql, next.end);
if (!afterOr || (afterOr.word !== "alter" && afterOr.word !== "replace")) return false;
next = readNextKeyword(sql, afterOr.end);
if (!next) return false;
}
return next.word === "procedure" || next.word === "proc" || next.word === "function";
}
function readNextKeyword(sql: string, start: number): { word: string; end: number } | null {
let i = start;
while (i < sql.length) {
while (i < sql.length && /\s/.test(sql[i])) i += 1;
if (sql[i] === "-" && sql[i + 1] === "-") {
i = skipLine(sql, i + 2);
continue;
}
if (sql[i] === "/" && sql[i + 1] === "*") {
i = skipBlockComment(sql, i + 2);
continue;
}
break;
}
if (!PARAMETER_NAME_START_RE.test(sql[i] ?? "")) return null;
let end = i + 1;
while (end < sql.length && PARAMETER_NAME_CHAR_RE.test(sql[end])) end += 1;
return { word: sql.slice(i, end).toLowerCase(), end };
}
function isSetAssignmentTarget(sql: string, start: number): boolean {
let i = start;
while (i < sql.length && /\s/.test(sql[i])) i += 1;
return sql[i] === "=" || (sql[i] === ":" && sql[i + 1] === "=");
}
function isLineStatementStart(sql: string, start: number): boolean {
let i = start - 1;
while (i >= 0 && (sql[i] === " " || sql[i] === "\t" || sql[i] === "\r")) i -= 1;
return i >= 0 && sql[i] === "\n";
}
function isSqlStatementKeyword(sql: string, start: number): boolean {
return ["select", "with", "insert", "update", "delete", "merge", "exec", "execute", "set", "if", "while", "begin", "create", "alter", "drop", "truncate"].some((keyword) => matchesWord(sql, start, keyword));
}
function matchesWord(sql: string, start: number, word: string): boolean {
const value = sql.slice(start, start + word.length);
if (value.toLowerCase() !== word) return false;
return !PARAMETER_NAME_CHAR_RE.test(sql[start - 1] ?? "") && !PARAMETER_NAME_CHAR_RE.test(sql[start + word.length] ?? "");
}
function readParameterName(sql: string, start: number): string {
if (!PARAMETER_NAME_START_RE.test(sql[start] ?? "")) return "";
let i = start + 1;
while (i < sql.length && PARAMETER_NAME_CHAR_RE.test(sql[i])) i += 1;
return sql.slice(start, i);
}
/** Match only unprefixed quote + exact `${name}`/`#{name}` + same quote. Leaves skipQuoted unchanged. */
function tryReadQuotedBracedPlaceholder(sql: string, start: number, quote: "'" | '"', isSyntaxEnabled: (syntax: SqlParameterSyntax) => boolean): ParameterOccurrence | null {
if (sql[start] !== quote) return null;
// Reject E'...', U&'...', B'...', X'...', N'...' — replacing the quoted span would leave the
// prefix attached to a typed literal (e.g. E'${path}' → E'C:\new', B'${flag}' → BTRUE).
if (hasSqlStringLiteralPrefix(sql, start)) return null;
const open = sql.slice(start + 1, start + 3);
let syntax: SqlParameterSyntax | null = null;
if (open === "${") syntax = "shell";
else if (open === "#{") syntax = "mybatis";
else return null;
if (!isSyntaxEnabled(syntax)) return null;
const nameStart = start + 3;
const closeBrace = sql.indexOf("}", nameStart);
if (closeBrace === -1 || sql[closeBrace + 1] !== quote) return null;
const name = sql.slice(nameStart, closeBrace).trim();
if (!PARAMETER_NAME_RE.test(name)) return null;
const end = closeBrace + 2;
// The closing quote must be a real string terminator under the same rules as skipQuoted
// (doubled quotes / backslash escapes). Otherwise '${value}''suffix' would match '${value}'.
if (skipQuoted(sql, start, quote) !== end) return null;
return {
key: name,
name,
syntax,
token: sql.slice(start, end),
...(quote === "\'" ? { replacement: "quoted-string" as const } : {}),
start,
end,
};
}
function collectEmbeddedQuotedBracedPlaceholders(sql: string, contentStart: number, quotedEnd: number, isSyntaxEnabled: (syntax: SqlParameterSyntax) => boolean): ParameterOccurrence[] {
const occurrences: ParameterOccurrence[] = [];
const contentEnd = sql[quotedEnd - 1] === "'" ? quotedEnd - 1 : quotedEnd;
let i = contentStart;
while (i < contentEnd) {
const ch = sql[i];
const next = sql[i + 1];
let syntax: SqlParameterSyntax | null = null;
if (ch === "$" && next === "{") syntax = "shell";
else if (ch === "#" && next === "{") syntax = "mybatis";
if (!syntax || !isSyntaxEnabled(syntax)) {
i += 1;
continue;
}
const closeBrace = sql.indexOf("}", i + 2);
if (closeBrace === -1 || closeBrace >= contentEnd) {
i += 1;
continue;
}
const name = sql.slice(i + 2, closeBrace).trim();
if (!PARAMETER_NAME_RE.test(name)) {
i += 1;
continue;
}
occurrences.push({
key: name,
name,
syntax,
token: sql.slice(i, closeBrace + 1),
start: i,
end: closeBrace + 1,
replacement: "string-fragment",
});
i = closeBrace + 1;
}
return occurrences;
}
/** True when `quoteStart` opens a prefixed literal such as E'...', U&'...', or MySQL _charset'...'. */
function hasSqlStringLiteralPrefix(sql: string, quoteStart: number): boolean {
if (quoteStart <= 0) return false;
if (quoteStart >= 2 && sql[quoteStart - 1] === "&" && (sql[quoteStart - 2] === "U" || sql[quoteStart - 2] === "u") && !PARAMETER_NAME_CHAR_RE.test(sql[quoteStart - 3] ?? "")) {
return true;
}
// SQL dialects attach word-like introducers directly to the quote. Reject the
// whole category so typed replacement cannot leave invalid prefixes such as
// `_utf8mb4TRUE`, and so future introducers do not require another allowlist.
return PARAMETER_NAME_CHAR_RE.test(sql[quoteStart - 1]);
}
function skipQuoted(sql: string, start: number, quote: string): number {
let i = start + 1;
while (i < sql.length) {
if (sql[i] === "\\" && quote === "'" && i + 1 < sql.length) {
i += 2;
continue;
}
if (sql[i] === quote) {
if (sql[i + 1] === quote) {
i += 2;
continue;
}
return i + 1;
}
i += 1;
}
return sql.length;
}
function skipBracketIdentifier(sql: string, start: number, databaseType?: DatabaseType): number {
// PostgreSQL uses square brackets for ARRAY constructors and subscripts, not
// for delimited identifiers. Leave the opening bracket in the lexical stream
// so quoted array elements cannot corrupt the following SQL state.
if (databaseType === "postgres") return start + 1;
let i = start + 1;
while (i < sql.length) {
if (sql[i] === "]") {
if (sql[i + 1] === "]") {
i += 2;
continue;
}
return i + 1;
}
i += 1;
}
return sql.length;
}
function skipLine(sql: string, start: number): number {
const nextNewline = sql.indexOf("\n", start);
return nextNewline === -1 ? sql.length : nextNewline + 1;
}
function skipBlockComment(sql: string, start: number): number {
const end = sql.indexOf("*/", start);
return end === -1 ? sql.length : end + 2;
}
function isHashLineComment(sql: string, start: number): boolean {
if (sql[start] !== "#" || sql[start + 1] === "{") return false;
// Keep SQL Server #temp table names parseable while treating other # tokens as MySQL-style comments.
return !isSqlServerTempTableReference(sql, start);
}
function isSqlServerTempTableReference(sql: string, start: number): boolean {
let nameStart = start + 1;
if (sql[nameStart] === "#") nameStart += 1;
if (!PARAMETER_NAME_START_RE.test(sql[nameStart] ?? "")) return false;
const previous = previousKeyword(sql, start);
return !!previous && SQL_SERVER_TEMP_TABLE_CONTEXT_KEYWORDS.has(previous);
}
function isPostgresArrayConstructorBracket(sql: string, start: number, parentIsConstructor: boolean): boolean {
if (previousKeyword(sql, start) === "array") return true;
if (!parentIsConstructor) return false;
let previous = start - 1;
while (previous >= 0 && /\s/.test(sql[previous])) previous -= 1;
return sql[previous] === "[" || sql[previous] === ",";
}
function isPostgresSliceSeparator(stack: Array<{ constructor: boolean; parenthesisDepth: number }>, parenthesisDepth: number): boolean {
const context = stack[stack.length - 1];
return !!context && !context.constructor && context.parenthesisDepth === parenthesisDepth;
}
function previousKeyword(sql: string, start: number): string {
let end = start - 1;
while (end >= 0 && /\s/.test(sql[end])) end -= 1;
let begin = end;
while (begin >= 0 && PARAMETER_NAME_CHAR_RE.test(sql[begin])) begin -= 1;
begin += 1;
if (begin > end || !PARAMETER_NAME_START_RE.test(sql[begin] ?? "")) return "";
return sql.slice(begin, end + 1).toLowerCase();
}
function readDollarQuoteMarker(sql: string, start: number): string {
const match = sql.slice(start).match(/^\$[A-Za-z_][A-Za-z0-9_]*\$|^\$\$/);
return match?.[0] ?? "";
}
function quoteSqlString(value: string): string {
return `'${value.replace(/'/g, "''")}'`;
}
function sqlParameterStringFragment(input: SqlParameterInput): string {
return input.value.replace(/'/g, "''");
}
function sqlParameterQuotedString(input: SqlParameterInput): string {
if (input.kind === "null" || ((input.kind === "number" || input.kind === "raw") && !input.value.trim())) return "NULL";
return quoteSqlString(input.value);
}
function normalizeBooleanLiteral(value: string): string {
const normalized = value.trim().toLowerCase();
if (normalized === "true" || normalized === "t" || normalized === "yes" || normalized === "y" || normalized === "1") return "TRUE";
if (normalized === "false" || normalized === "f" || normalized === "no" || normalized === "n" || normalized === "0") return "FALSE";
return quoteSqlString(value);
}