feat: upgrade parser stack to PG18 (pgsql-parser 18.1.1, libpg-query 18.1.2)

- bump pgsql-parser/deparser, plpgsql-*, @pgsql/* deps to the 18.1.x line
- regenerate pg-ast from the PG18 pg_query.proto (returningClause, ReturningOption, ATAlterConstraint, etc.)
- query-builder: emit InsertStmt/UpdateStmt/DeleteStmt returningClause instead of removed returningList
- sql-expression-validator: narrow PG18 Node union before member access

Author: pyramation

graphile/graphile-bucket-provisioner-plugin/package.json

@@ -1,7 +1,7 @@
 {
   "name": "graphile-bucket-provisioner-plugin",
   "version": "0.14.0",
-  "description": "Bucket provisioning plugin for PostGraphile v5 — auto-provisions S3 buckets on bucket table mutations",
+  "description": "Bucket provisioning plugin for PostGraphile v5 \u2014 auto-provisions S3 buckets on bucket table mutations",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
   "license": "MIT",
@@ -42,7 +42,7 @@
   "dependencies": {
     "@constructive-io/bucket-provisioner": "workspace:^",
     "@pgpmjs/logger": "workspace:^",
-    "@pgsql/quotes": "^17.1.0"
+    "@pgsql/quotes": "^18.1.0"
   },
   "peerDependencies": {
     "grafast": "1.0.2",

graphile/graphile-presigned-url-plugin/package.json

@@ -1,7 +1,7 @@
 {
   "name": "graphile-presigned-url-plugin",
   "version": "0.22.1",
-  "description": "Presigned URL upload plugin for PostGraphile v5 — requestUploadUrl mutation and downloadUrl computed field",
+  "description": "Presigned URL upload plugin for PostGraphile v5 \u2014 requestUploadUrl mutation and downloadUrl computed field",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
   "license": "MIT",
@@ -43,7 +43,7 @@
     "@aws-sdk/client-s3": "^3.1052.0",
     "@aws-sdk/s3-request-presigner": "^3.1052.0",
     "@pgpmjs/logger": "workspace:^",
-    "@pgsql/quotes": "^17.1.0",
+    "@pgsql/quotes": "^18.1.0",
     "lru-cache": "^11.2.7"
   },
   "peerDependencies": {

graphile/graphile-realtime-subscriptions/package.json

@@ -1,7 +1,7 @@
 {
   "name": "graphile-realtime-subscriptions",
   "version": "0.10.0",
-  "description": "Realtime subscription plugin for PostGraphile v5 — per-table GraphQL subscriptions via LISTEN/NOTIFY",
+  "description": "Realtime subscription plugin for PostGraphile v5 \u2014 per-table GraphQL subscriptions via LISTEN/NOTIFY",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
   "license": "MIT",
@@ -41,7 +41,7 @@
   },
   "dependencies": {
     "@pgpmjs/logger": "workspace:^",
-    "@pgsql/quotes": "^17.1.0"
+    "@pgsql/quotes": "^18.1.0"
   },
   "peerDependencies": {
     "grafast": "1.0.2",

graphile/graphile-settings/package.json

@@ -41,7 +41,7 @@
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
     "@pgpmjs/logger": "workspace:^",
     "@pgpmjs/types": "workspace:^",
-    "@pgsql/quotes": "^17.1.0",
+    "@pgsql/quotes": "^18.1.0",
     "cors": "^2.8.6",
     "express": "^5.2.1",
     "grafast": "1.0.2",

graphile/graphile-sql-expression-validator/package.json

@@ -42,8 +42,8 @@
     "url": "https://github.com/constructive-io/constructive/issues"
   },
   "dependencies": {
-    "pgsql-deparser": "^17.18.5",
-    "pgsql-parser": "^17.9.17"
+    "pgsql-deparser": "^18.1.1",
+    "pgsql-parser": "^18.1.1"
   },
   "peerDependencies": {
     "grafast": "1.0.2",

graphile/graphile-sql-expression-validator/src/validator.ts

@@ -382,7 +382,7 @@ export async function parseAndValidateSqlExpression(
     }
 
     const stmt = parseResult.stmts[0]?.stmt;
-    if (!stmt?.SelectStmt) {
+    if (!stmt || !('SelectStmt' in stmt) || !stmt.SelectStmt) {
       return { valid: false, error: 'Unexpected parse result structure' };
     }
 
@@ -394,7 +394,7 @@ export async function parseAndValidateSqlExpression(
       'lockingClause', 'distinctClause'
     ];
     for (const dangerousKey of DANGEROUS_SELECT_KEYS) {
-      if (selectStmt[dangerousKey] !== undefined) {
+      if ((selectStmt as Record<string, unknown>)[dangerousKey] !== undefined) {
         return {
           valid: false,
           error: `Expression contains disallowed SQL clause: ${dangerousKey}`
@@ -407,7 +407,8 @@ export async function parseAndValidateSqlExpression(
       return { valid: false, error: 'Expected single expression' };
     }
 
-    const resTarget = targetList[0]?.ResTarget;
+    const targetNode = targetList[0];
+    const resTarget = targetNode && 'ResTarget' in targetNode ? targetNode.ResTarget : undefined;
     if (!resTarget || !resTarget.val) {
       return {
         valid: false,