Skip to content

GuardSQL v0.1.0

Released: 2026-08-22

GuardSQL v0.1.0 is the initial release of the shared query language engine for Grokify analytics services. It establishes the core contract for customer-authored analytics queries: parse user text into an AST, validate it against an application schema, enforce static policy, authorize resolved requirements, then compile trusted AST nodes into backend-specific execution.

Highlights

  • Read-only query parser and AST for SQL-like analytics syntax without executing customer-authored SQL directly.
  • Schema validation and policy checks for SaaS-safe reporting, including read-only operation enforcement, field allowlists, limits, expression complexity, and backend planning requirements.
  • In-memory evaluator for single-source analytics queries.
  • Formatter and guardsqlfmt CLI for canonical query display and editor cleanup.
  • Browser-side TypeScript package for UI feedback and query-builder workflows.
  • Optional SystemForge authorization adapter in a nested module so the root Go package stays lightweight.

Supported Query Surface

The first release focuses on read-only analytics:

SELECT id, name, priority
FROM roadmap_items
WHERE status IN ("planned", "in_progress") AND score >= 50
ORDER BY score DESC
LIMIT 25

Supported clauses include SELECT, FROM, WHERE, GROUP BY, HAVING, ORDER BY, LIMIT, WITH, joins, nested query sources, and PRIORITIZE BY. Supported aggregate functions are COUNT, SUM, AVG, MIN, and MAX.

Joins, CTEs, and nested sources are represented in the AST for backend-specific compilers. The in-memory evaluator currently supports single-source execution.

Security Model

GuardSQL is designed for hosted SaaS analytics where customer-authored text must not become executable SQL. Invalid input fails as a parse error. Accepted input should still pass schema validation, policy checks, authorization, tenant scoping, row limits, timeouts, and backend compilation using parameterized calls.

For analytics endpoints, applications should normally allow only OperationRead and inject tenant scope outside the user query.

Integration Targets

This release is intended to support product dialects such as AQL for Aha Studio and ORQL for OmniRoadmap while sharing the same parser, AST, validation, and policy model underneath.

The next integration work should focus on backend compilers and application schema catalogs for OmniRoadmap, UIForge analytics, and other Grokify reporting surfaces.