vrsai · Capabilities SQL Preflight

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://api.vrsai.tech/v1/capabilities/sql_preflight", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "context": {
      "environment": "production",
      "protected_relations": [
        "customers"
      ]
    },
    "sql": "DELETE FROM customers;"
  }),
});
const data = await res.json();

curl -X POST \
  "https://api.vrsai.tech/v1/capabilities/sql_preflight" \
  -H "Content-Type: application/json" \
  -d '{"context":{"environment":"production","protected_relations":["customers"]},"sql":"DELETE FROM customers;"}' \
  -H "X-PAYMENT: <signed x402 payment>"

{
  "checks": [
    {
      "id": "parse_validity",
      "status": "PASS"
    },
    {
      "evidence": {
        "count": 1
      },
      "id": "statement_count",
      "status": "PASS"
    },
    {
      "id": "unbounded_delete",
      "reason_code": "DELETE_WITHOUT_WHERE",
      "statement_index": 0,
      "status": "BLOCK"
    },
    {
      "evidence": {
        "relations": [
          {
            "name": "customers"
          }
        ]
      },
      "id": "protected_relation_mutation",
      "reason_code": "PROTECTED_RELATION_MUTATION",
      "statement_index": 0,
      "status": "BLOCK"
    },
    {
      "id": "expected_statement_kind",
      "statement_index": 0,
      "status": "PASS"
    }
  ],
  "coverage": {
    "assessment_scope": [
      "unbounded_delete",
      "unbounded_update",
      "truncate",
      "destructive_drop",
      "destructive_cascade",
      "alter_table_hazards",
      "nonconcurrent_index",
      "create_extension",
      "protected_relation_mutation",
      "dynamic_or_procedural_sql",
      "expected_statement_kind",
      "multi_statement_evaluation"
    ],
    "checks_not_performed": [
      "privilege_change",
      "explicit_locking",
      "alter_system",
      "availability_maintenance",
      "external_program_execution",
      "drop_schema_or_database",
      "read_cost_and_row_estimation",
      "sensitive_data_access_and_exfiltration",
      "tenant_isolation",
      "semantic_correctness"
    ],
    "checks_performed": [
      "unbounded_delete",
      "unbounded_update",
      "truncate",
      "destructive_drop",
      "destructive_cascade",
      "alter_table_hazards",
      "nonconcurrent_index",
      "create_extension",
      "protected_relation_mutation",
      "dynamic_or_procedural_sql",
      "expected_statement_kind",
      "multi_statement_evaluation"
    ],
    "complete_for_declared_scope": true,
    "dialect": "postgresql"
  },
  "decision": "BLOCK",
  "input_fingerprint": "v1:4634deedb0970b042098df09e6f8bf365f2ddb635a18742c5ffa676844e4fa62",
  "machine_action": "DO_NOT_EXECUTE",
  "reason_codes": [
    "DELETE_WITHOUT_WHERE",
    "PROTECTED_RELATION_MUTATION"
  ],
  "ruleset_version": "1.0.0",
  "statement_count": 1,
  "statements": [
    {
      "administrative": false,
      "changes_privileges": false,
      "changes_schema": false,
      "decision": "BLOCK",
      "index": 0,
      "kind": "DELETE",
      "mutates_data": true,
      "reason_codes": [
        "DELETE_WITHOUT_WHERE",
        "PROTECTED_RELATION_MUTATION"
      ],
      "relations": [
        {
          "name": "customers"
        }
      ]
    }
  ]
}