
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@prisma-next/psl-parser
Advanced tools
Reusable PSL parser for Prisma Next.
@prisma-next/psl-parser parses Prisma Schema Language (PSL) source into a deterministic CST with source spans and stable machine-readable diagnostics, then offers shared symbol-table resolution for the target-agnostic semantics every PSL interpreter needs. Normalization to contract IR and emit integration stay in downstream target packages.
In the provider-based authoring model, PSL providers call parse to obtain the CST and then buildSymbolTable to obtain a scope-aware view, before returning Result<Contract, ContractSourceDiagnostics> to the framework emit pipeline.
schema + sourceId) with deterministic ordering.types { ... }.Cascade) without semantic normalization.code, message, span, sourceId) for invalid and unsupported constructs.field / model / namedType), attribute name, and parsed argument list with spans.@prisma-next/psl-parser parses attributes generically:
@id) or namespaced (for example @vendor.option).@default(uuid(7)) is preserved as a positional argument value uuid(7); semantic lowering is handled downstream.Interpretation/validation (for example @prisma-next/sql-contract-psl) is responsible for:
@<ns>.* without composing the pack fails), andparse(schema) in src/parse.ts (also at @prisma-next/psl-parser/syntax) — the CST parser: returns the DocumentAst, its backing SourceFile, and syntactic diagnostics. The recursive-descent / lossless-CST path supersedes the legacy parsePslDocument.buildSymbolTable({ document, sourceFile, scalarTypes, pslBlockDescriptors }) in src/symbol-table.ts — a pure, fault-tolerant pass over a parsed CST DocumentAst that returns a scope-aware SymbolTable (top-level namespaces / scalars / type-aliases / blocks / models / composite-types as keyed records discriminated by kind, namespace members and block fields nested under their owner, every symbol carrying its CST AST node plus its declaration span) plus its own duplicate-name diagnostics (PSL_DUPLICATE_DECLARATION, first-wins, colliding across kinds within one scope). scalarTypes is supplied by the target to classify types { ... } bindings, while pslBlockDescriptors is supplied from authoring contributions so generic/extension blocks can be reconstructed once into BlockSymbol.block. The pass also resolves the field/named-type read set once: each FieldSymbol carries the split type (typeName/typeNamespaceId/typeContractSpaceId), optional/list, typeConstructor?, rendered attributes, and malformedType? (set, with a PSL_INVALID_QUALIFIED_TYPE diagnostic, when the type is over-qualified); ScalarSymbol/TypeAliasSymbol carry the resolved binding (baseType/typeConstructor/isConstructor). Interpreters consume this resolved shape directly — there is no per-package field/attribute view layer.readResolvedAttribute(s) / readResolvedConstructorCall + the span maps
(nodePslSpan, rangeToPslSpan, keywordPslSpan) in src/resolve.ts — the
shared CST read helpers buildSymbolTable uses and that consumers (e.g.
enum-block reconstruction) reuse, with PslSpan spans.reconstructExtensionBlock / findBlockDescriptor /
validateExtensionBlockFromSymbol in src/extension-block.ts — reconstruct a
descriptor-driven PslExtensionBlock from a CST GenericBlockDeclarationAst
(a BlockSymbol) and run the framework's standalone validateExtensionBlock
over it, building the ref-resolution context from the symbol table.parseQuotedStringLiteral / getPositionalArgument in src/attribute-helpers.ts.@prisma-next/framework-components/psl-ast
and are re-exported from this package's root entry for convenience.@prisma-next/psl-parser/syntax@prisma-next/psl-parser/tokenizerflowchart LR
PSL[PSL source text] --> Parse[parse]
Parse --> CST[DocumentAst + SourceFile]
Parse --> ParseDiagnostics[Parser diagnostics]
CST --> Symbols[buildSymbolTable]
Scalars[target scalarTypes] --> Symbols
Descriptors[pslBlockDescriptors] --> Symbols
Symbols --> SymbolTable[SymbolTable]
Symbols --> SymbolDiagnostics[Symbol-table diagnostics]
SymbolTable --> Interpreter[Target PSL interpreter]
ParseDiagnostics --> Provider[Provider diagnostic seeding]
SymbolDiagnostics --> Provider
contract.json or contract.d.ts.docs/Architecture Overview.mddocs/architecture docs/subsystems/2. Contract Emitter & Types.mddocs/architecture docs/adrs/ADR 163 - Provider-invoked source interpretation packages.mdFAQs
Reusable parser for Prisma Schema Language (PSL)
We found that @prisma-next/psl-parser demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.