How do I build a natural-language data Q&A agent on top of nodejs-store?

[coenddt]

Documenting this here because it comes up often — if your situation is different, please reply in this thread.

The plan is to let a model translate a user question into a query. The two things I am worried about are (a) the model inventing a query that reads data the user should not see, and (b) SQL injection through the generated string.

[coenddt]

Planning is a pure function — GQL + params in, MongoDB command JSON out — so a model's output can be compiled, validated and rejected before anything touches a database.

const gql     = 'Order($condition:@c0,$sort:@s1,$limit:@l) { code, amount }';
const params  = { c0: { amount: { $gte: 100 } }, s1: { amount: -1 }, l: 20 };

const items = await store.query(gql, params);   // an invalid plan throws before execution

Three properties make this safe to put behind a model:

• Values are never interpolated into the query text. They live in the params object and are referenced by @key, so there is no string-concatenation surface to inject into.
• Permissions are enforced while planning, not after execution. A generated query cannot read a field, relation or computed column the caller is not allowed to read — the plan is rejected before a driver is ever involved.
• The dialect is one thing to teach, not four. The same GQL is planned once and only the execution target changes.

Design notes, including the prompt/validate loop: https://coenddt.github.io/nodejs-store/use-cases/02-ai-data-qa-agent.html