@blamejs/core 0.4.12 → 0.4.13

package/CHANGELOG.md

@@ -8,6 +8,7 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- **0.4.12** (2026-04-30) — b.log: multi-sink output with per-sink level filtering
 - **0.4.11** (2026-04-30) — b.cache: bytes-cap eviction, sliding TTL, tag invalidation
 - **0.4.10** (2026-04-30) — bodyParser multipart: fileFilter + per-field maxBytes/mimeTypes
 - **0.4.9** (2026-04-30) — Origin-Agent-Cluster + DNS-Prefetch-Control headers; b.auth.lockout primitive

package/lib/db-query.js

@@ -184,6 +184,37 @@ class Query {
     return out;
   }
 
+  // Streaming counterpart to all(). Each row is auto-unsealed against
+  // the bound table's sealedFields registration before it lands in the
+  // operator's pipeline. For large result sets (audit exports, backup
+  // table dumps) this avoids materializing the full rowset in memory.
+  stream() {
+    var sql = "SELECT " + this._projection() + ' FROM "' + this._table + '"' +
+              this._whereClause() + this._orderLimitOffset();
+    var stmt = this._db.prepare(sql);
+    var table = this._table;
+    var iter;
+    var Readable = require("node:stream").Readable;
+    try { iter = stmt.iterate.apply(stmt, this._whereParams); }
+    catch (e) {
+      var r = new Readable({ objectMode: true, read: function () {} });
+      setImmediate(function () { r.destroy(e); });
+      return r;
+    }
+    return new Readable({
+      objectMode: true,
+      read: function () {
+        try {
+          var step = iter.next();
+          if (step.done) { this.push(null); return; }
+          this.push(cryptoField.unsealRow(table, step.value));
+        } catch (e) {
+          this.destroy(e);
+        }
+      },
+    });
+  }
+
   count() {
     var sql = 'SELECT COUNT(*) AS n FROM "' + this._table + '"' + this._whereClause();
     var stmt = this._db.prepare(sql);

package/lib/db.js

@@ -32,6 +32,8 @@
  *
  *   db.from(tableName)                 → Query (chainable)
  *   db.prepare(sql)                    → SQLite Statement (raw escape hatch)
+ *   db.stream(sql, ...params, opts?)   → Readable (object-mode rows;
+ *                                       opts.table enables auto-unseal)
  *   db.runSql(sql)                     → raw SQL execution (DDL, BEGIN/COMMIT)
  *   db.transaction(function (db) {…})  → wraps in BEGIN/COMMIT/ROLLBACK
  *   db.hashFor(table, field, value)    → derived-hash lookup helper
@@ -746,6 +748,66 @@ function prepare(sql) {
   return database.prepare(sql);
 }
 
+// stream — Readable in object mode that yields rows as node:sqlite's
+// iterate() produces them. Unlike all(), the engine doesn't materialize
+// the result set in memory before the first row arrives, so audit
+// exports / backup table dumps / large reports can process millions of
+// rows without OOM pressure.
+//
+// Optional opts.table enables auto-unseal of sealed columns via the
+// table's registered cryptoField schema. Raw / aggregate queries omit
+// it. Mid-iteration prepare()-bound errors propagate as 'error' events.
+function stream(sql) {
+  _requireInit();
+  var opts = null;
+  var params;
+  // Last arg may be a plain {table?} options object; everything else
+  // is a SQL parameter binding. node:sqlite accepts numbers, strings,
+  // bigints, Buffers, and null — plain objects can only be opts.
+  var args = Array.prototype.slice.call(arguments, 1);
+  if (args.length > 0) {
+    var last = args[args.length - 1];
+    var isOptsShape = last !== null && typeof last === "object" &&
+      !Buffer.isBuffer(last) && !Array.isArray(last) &&
+      typeof last.length !== "number"; // exclude TypedArray-shapes
+    if (isOptsShape) {
+      opts = last;
+      params = args.slice(0, -1);
+    } else {
+      params = args;
+    }
+  } else {
+    params = [];
+  }
+  var table = opts && typeof opts.table === "string" ? opts.table : null;
+  var unseal = table ? cryptoField : null;
+
+  var Readable = require("node:stream").Readable;
+  var stmt;
+  var iter;
+  try {
+    stmt = database.prepare(sql);
+    iter = stmt.iterate.apply(stmt, params);
+  } catch (e) {
+    var r = new Readable({ objectMode: true, read: function () {} });
+    setImmediate(function () { r.destroy(e); });
+    return r;
+  }
+  return new Readable({
+    objectMode: true,
+    read: function () {
+      try {
+        var step = iter.next();
+        if (step.done) { this.push(null); return; }
+        var row = step.value;
+        this.push(unseal ? unseal.unsealRow(table, row) : row);
+      } catch (e) {
+        this.destroy(e);
+      }
+    },
+  });
+}
+
 function execRaw(sql) {
   _requireInit();
   return runSql(database, sql);
@@ -946,6 +1008,7 @@ module.exports = {
   init:                init,
   from:                from,
   prepare:             prepare,
+  stream:              stream,
   runSql:              execRaw,
   // SQLite multi-statement helper alias matching the node:sqlite
   // module's shape. Operator migration / seeder files that received

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",