@flowblade/sqlduck 0.13.0 → 0.15.0

package/README.md

@@ -29,7 +29,7 @@ import { conn } from "./db.config.ts";
 
 const dbManager = new DuckDatabaseManager(conn);
 const database = await dbManager.attach({
-    type: 'memory', // can be 'duckdb', ...
+    type: 'memory', // can be 'filesystem', ...
     alias: 'mydb',
     options: { COMPRESS: 'false' },
 });

package/dist/duck-reserved-keywords-B8XUjnaY.mjs

@@ -0,0 +1,126 @@
+//#region src/validation/core/base-validators.ts
+const duckIdentifierNameRegex = /^[a-z_]\w*$/i;
+const duckStorageVersionRegexp = /^v?\d{1,4}\.\d{1,4}\.\d{1,4}$/;
+//#endregion
+//#region src/validation/core/duck-connections-options.ts
+const duckConnectionsOptions = {
+	types: [
+		"DUCKDB",
+		"SQLITE",
+		"MYSQL",
+		"PostgreSQL"
+	],
+	accessModes: ["READ_ONLY", "READ_WRITE"],
+	encryptionCiphers: [
+		"CBC",
+		"CTR",
+		"GCM"
+	]
+};
+//#endregion
+//#region src/validation/core/duck-reserved-keywords.ts
+/**
+* DuckDB reserved keywords that cannot be used as unquoted identifiers.
+* @see https://duckdb.org/docs/sql/keywords-and-identifiers.html
+*/
+const duckReservedKeywords = [
+	"ALL",
+	"ANALYSE",
+	"ANALYZE",
+	"AND",
+	"ANY",
+	"ARRAY",
+	"AS",
+	"ASC",
+	"ASYMMETRIC",
+	"BOTH",
+	"CASE",
+	"CAST",
+	"CHECK",
+	"COLLATE",
+	"COLUMN",
+	"CONSTRAINT",
+	"CREATE",
+	"CROSS",
+	"CURRENT_CATALOG",
+	"CURRENT_DATE",
+	"CURRENT_ROLE",
+	"CURRENT_SCHEMA",
+	"CURRENT_TIME",
+	"CURRENT_TIMESTAMP",
+	"CURRENT_USER",
+	"DEFAULT",
+	"DEFERRABLE",
+	"DESC",
+	"DISTINCT",
+	"DO",
+	"ELSE",
+	"END",
+	"EXCEPT",
+	"EXISTS",
+	"EXTRACT",
+	"FALSE",
+	"FETCH",
+	"FOR",
+	"FOREIGN",
+	"FROM",
+	"GRANT",
+	"GROUP",
+	"HAVING",
+	"IF",
+	"ILIKE",
+	"IN",
+	"INITIALLY",
+	"INNER",
+	"INTERSECT",
+	"INTO",
+	"IS",
+	"ISNULL",
+	"JOIN",
+	"LATERAL",
+	"LEADING",
+	"LEFT",
+	"LIKE",
+	"LIMIT",
+	"LOCALTIME",
+	"LOCALTIMESTAMP",
+	"NATURAL",
+	"NOT",
+	"NOTNULL",
+	"NULL",
+	"OFFSET",
+	"ON",
+	"ONLY",
+	"OR",
+	"ORDER",
+	"OUTER",
+	"OVERLAPS",
+	"PLACING",
+	"PRIMARY",
+	"REFERENCES",
+	"RETURNING",
+	"RIGHT",
+	"ROW",
+	"SELECT",
+	"SESSION_USER",
+	"SIMILAR",
+	"SOME",
+	"SYMMETRIC",
+	"TABLE",
+	"THEN",
+	"TO",
+	"TRAILING",
+	"TRUE",
+	"UNION",
+	"UNIQUE",
+	"USING",
+	"VARIADIC",
+	"VERBOSE",
+	"WHEN",
+	"WHERE",
+	"WINDOW",
+	"WITH"
+];
+const duckdbReservedKeywordsSet = new Set(duckReservedKeywords);
+//#endregion
+export { duckStorageVersionRegexp as a, duckIdentifierNameRegex as i, duckdbReservedKeywordsSet as n, duckConnectionsOptions as r, duckReservedKeywords as t };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { n as DuckConnectionParams } from "./types-DCqYqEsa.mjs";
+import { n as DuckConnectionParams } from "./types-dnhcognF.mjs";
 import * as _$_duckdb_node_api0 from "@duckdb/node-api";
 import { DuckDBConnection, DuckDBType } from "@duckdb/node-api";
 import * as _$_logtape_logtape0 from "@logtape/logtape";
@@ -143,6 +143,13 @@ type ToTableParams<TSchema extends TableSchemaZod> = {
    * @default true
    */
   autoCheckpoint?: boolean;
+  /**
+   * Checkpoint the table after 'n' chunks have been appended
+   *
+   * For example if the chunkSize is 2048, setting frequency to 2
+   * will checkpoint the table every 4096 rows (2x chunksize)
+   */
+  checkpointChunksFrequency?: number;
 };
 type ToTableResult = {
   /**
@@ -251,7 +258,7 @@ declare class DuckDatabaseManager {
    * ```typescript
    * const dbManager = new DuckDatabaseManager(conn);
    * const database = dbManager.attach({
-   *   type: 'memory', // can be 'duckdb', 's3'...
+   *   type: 'memory', // can be 'filesystem'...
    *   alias: 'mydb',
    *   options: { COMPRESS: 'true' }
    * });
@@ -276,6 +283,15 @@ declare class DuckDatabaseManager {
   analyze: () => Promise<boolean>;
   checkpoint: (dbAlias: string) => Promise<boolean>;
   vacuum: () => Promise<boolean>;
+  /**
+   * Helper to create an initial database file.
+   */
+  createDatabaseFile: (params: {
+    path: string;
+    createDirectory?: boolean;
+  }) => Promise<{
+    status: "exists" | "created";
+  }>;
 }
 //#endregion
 //#region src/config/flowblade-logtape-sqlduck.config.d.ts

package/dist/index.mjs

@@ -1,6 +1,9 @@
-import { c as duckValidatorsZod, l as duckReservedKeywords, r as assertValidAliasName, s as duckConnectionParamsZodSchema } from "./zod-DcIc8xQC.mjs";
-import { BIGINT, BOOLEAN, DOUBLE, DuckDBDataChunk, DuckDBTimestampValue, FLOAT, HUGEINT, INTEGER, SMALLINT, TIMESTAMP, TINYINT, UBIGINT, UHUGEINT, UINTEGER, USMALLINT, UTINYINT, UUID, VARCHAR } from "@duckdb/node-api";
+import { t as duckReservedKeywords } from "./duck-reserved-keywords-B8XUjnaY.mjs";
+import { n as assertValidAliasName, o as duckConnectionParamsZodSchema, s as duckValidatorsZod } from "./zod-CuPjTLv8.mjs";
+import { BIGINT, BOOLEAN, DOUBLE, DuckDBDataChunk, DuckDBInstanceCache, DuckDBTimestampValue, FLOAT, HUGEINT, INTEGER, SMALLINT, TIMESTAMP, TINYINT, UBIGINT, UHUGEINT, UINTEGER, USMALLINT, UTINYINT, UUID, VARCHAR } from "@duckdb/node-api";
 import { getLogger } from "@logtape/logtape";
+import fs from "node:fs";
+import { basename, dirname } from "node:path";
 import * as z from "zod";
 import { assertNever } from "@httpx/assert";
 import { isPlainObject } from "@httpx/plain-object";
@@ -127,6 +130,81 @@ const flowbladeLogtapeSqlduckConfig = { categories: ["flowblade", "sqlduck"] };
 //#region src/logger/sqlduck-default-logtape-logger.ts
 const sqlduckDefaultLogtapeLogger = getLogger(flowbladeLogtapeSqlduckConfig.categories);
 //#endregion
+//#region src/filesystem/file-system-utils.ts
+var FileSystemUtils = class {
+	#logger;
+	constructor(params) {
+		this.#logger = params?.logger ?? sqlduckDefaultLogtapeLogger.with({ source: "FileSystemUtils" });
+	}
+	/**
+	* Create a directory recursively if it doesn't exist
+	*
+	* @throws Error if it can't be created
+	*/
+	createDirectory = (path) => {
+		try {
+			fs.mkdirSync(path, { recursive: true });
+		} catch (err) {
+			if (err.code !== "EEXIST") throw err;
+		}
+	};
+	/**
+	* Create a directory recursively if it doesn't exist and ensure it's writable
+	*/
+	createAndEnsureWritableDirectory = (label, path) => {
+		if (path === void 0) return;
+		if (!fs.existsSync(path)) try {
+			this.createDirectory(path);
+		} catch (e) {
+			throw new Error(`Failed to create ${label} '${path}' - ${e?.message ?? ""}`);
+		}
+		if (!fs.statSync(path).isDirectory()) throw new Error(`${label} '${path}' must be a directory`);
+		try {
+			fs.accessSync(path, fs.constants.W_OK);
+		} catch {
+			throw new Error(`${label} '${path}' must be writable`);
+		}
+	};
+	/**
+	* Check if a path is a regular file and exists
+	*/
+	isFile = (path) => {
+		try {
+			return fs.statSync(path).isFile();
+		} catch {
+			return false;
+		}
+	};
+	/**
+	* Check if a path is a directory and exists
+	*/
+	isDirectory = (path) => {
+		try {
+			return fs.statSync(path).isDirectory();
+		} catch {
+			return false;
+		}
+	};
+	parsePath = (path) => {
+		const dir = dirname(path);
+		if (dir.trim() === "") throw new Error(`Invalid path, missing directory '${path}'`);
+		const base = basename(path);
+		if (base.trim() === "") throw new Error(`Invalid path, missing filename '${path}'`);
+		return {
+			directory: dir,
+			filename: base
+		};
+	};
+	removeFileIfExists = (path) => {
+		try {
+			fs.rmSync(path);
+			return true;
+		} catch {
+			return false;
+		}
+	};
+};
+//#endregion
 //#region src/objects/database.ts
 var Database = class {
 	#params;
@@ -163,7 +241,7 @@ var DuckDatabaseAttachCommand = class {
 			case "memory":
 				parts.push("':memory:'");
 				break;
-			case "duckdb":
+			case "filesystem":
 				parts.push(`'${dbParams.path}'`);
 				break;
 			default: assertNever(type);
@@ -206,6 +284,7 @@ var DuckDatabaseAttachCommand = class {
 var DuckDatabaseManager = class {
 	#conn;
 	#logger;
+	#fs;
 	constructor(conn, params) {
 		this.#conn = conn;
 		this.#logger = params?.logger ?? sqlduckDefaultLogtapeLogger.with({ source: "DuckDatabaseManager" });
@@ -217,7 +296,7 @@ var DuckDatabaseManager = class {
 	* ```typescript
 	* const dbManager = new DuckDatabaseManager(conn);
 	* const database = dbManager.attach({
-	*   type: 'memory', // can be 'duckdb', 's3'...
+	*   type: 'memory', // can be 'filesystem'...
 	*   alias: 'mydb',
 	*   options: { COMPRESS: 'true' }
 	* });
@@ -228,7 +307,12 @@ var DuckDatabaseManager = class {
 	attach = async (dbParams, options) => {
 		const params = duckConnectionParamsZodSchema.parse(dbParams);
 		const rawSql = new DuckDatabaseAttachCommand(params, options).getRawSql();
-		await this.#executeRawSqlCommand(`attach(${params.alias})`, rawSql);
+		const { behaviour } = options ?? {};
+		await this.#executeRawSqlCommand([
+			`attach(${params.alias}`,
+			behaviour ?? null,
+			")"
+		].filter(Boolean).join(","), rawSql);
 		return new Database({ alias: params.alias });
 	};
 	attachOrReplace = async (dbParams) => {
@@ -271,13 +355,39 @@ var DuckDatabaseManager = class {
 		await this.#executeRawSqlCommand("vacuum()", "VACUUM");
 		return true;
 	};
+	/**
+	* Helper to create an initial database file.
+	*/
+	createDatabaseFile = async (params) => {
+		const startTime = Date.now();
+		const { path, createDirectory = true } = params;
+		const fs = this.#getFs();
+		if (fs.isFile(path)) return { status: "exists" };
+		if (createDirectory) {
+			const { directory } = fs.parsePath(path);
+			fs.createAndEnsureWritableDirectory("database file directory", directory);
+		}
+		const instanceCache = new DuckDBInstanceCache();
+		try {
+			(await (await instanceCache.getOrCreateInstance(path)).connect()).closeSync();
+			const timeMs = Math.round(Date.now() - startTime);
+			this.#logger.info(`DuckDatabaseManager.createDatabaseFile('${path}') in ${timeMs}ms`, {
+				timeMs,
+				path
+			});
+		} catch (e) {
+			this.#logger.error(`DuckDatabaseManager.createDatabaseFile('${path}') failed - ${e?.message ?? ""}`, { path });
+			throw e;
+		}
+		return { status: "created" };
+	};
 	#executeRawSqlCommand = async (name, rawSql) => {
 		const startTime = Date.now();
 		try {
 			const result = await this.#conn.runAndReadAll(rawSql);
 			const timeMs = Math.round(Date.now() - startTime);
 			const data = result.getRowObjectsJS();
-			this.#logger.info(`DuckDatabaseManager.${name} in ${timeMs}ms`, { timeMs });
+			this.#logger.debug(`DuckDatabaseManager.${name} in ${timeMs}ms`, { timeMs });
 			return data;
 		} catch (e) {
 			const msg = `DuckDatabaseManager: failed to run "${name}" - ${e?.message ?? ""}`;
@@ -290,6 +400,10 @@ var DuckDatabaseManager = class {
 			throw new Error(msg, { cause: e });
 		}
 	};
+	#getFs = () => {
+		if (this.#fs === void 0) this.#fs = new FileSystemUtils({ logger: this.#logger });
+		return this.#fs;
+	};
 };
 //#endregion
 //#region src/table/get-duckdb-number-column-type.ts
@@ -514,9 +628,11 @@ var SqlDuck = class {
 	* ```
 	*/
 	toTable = async (params) => {
-		const { table, schema, chunkSize = 2048, rowStream, createOptions, onDataAppended, autoCheckpoint = true } = params;
+		const { table, schema, chunkSize = 2048, rowStream, createOptions, onDataAppended, autoCheckpoint = true, checkpointChunksFrequency = 10 } = params;
 		if (!Number.isSafeInteger(chunkSize) || chunkSize < 1 || chunkSize > 2048) throw new Error("chunkSize must be a number between 1 and 2048");
 		if (autoCheckpoint && typeof table.databaseName !== "string") throw new Error("autoCheckpoint requires table.databaseName to be provided.");
+		if (checkpointChunksFrequency && typeof table.databaseName !== "string") throw new Error("checkpointChunksFrequency requires table.databaseName to be provided.");
+		if (checkpointChunksFrequency !== void 0 && checkpointChunksFrequency < 1) throw new Error("checkpointChunksFrequency must be a positive number.");
 		const dbManager = new DuckDatabaseManager(this.#conn);
 		const timeStart = Date.now();
 		const { columnTypes, ddl } = await createTableFromZod({
@@ -533,6 +649,7 @@ var SqlDuck = class {
 			rows: rowStream,
 			chunkSize
 		});
+		let appendedChunkCount = 0;
 		try {
 			for await (const dataChunk of columnStream) {
 				const chunk = DuckDBDataChunk.create(chunkTypes);
@@ -541,12 +658,13 @@ var SqlDuck = class {
 				chunk.setColumns(dataChunk);
 				appender.appendDataChunk(chunk);
 				appender.flushSync();
+				appendedChunkCount += 1;
 				if (onDataAppended !== void 0) {
 					const payload = dataAppendedCollector(totalRows);
 					if (isOnDataAppendedAsyncCb(onDataAppended)) await onDataAppended(payload);
 					else onDataAppended(payload);
 				}
-				if (autoCheckpoint && typeof table.databaseName === "string") try {
+				if (checkpointChunksFrequency !== void 0 && appendedChunkCount % checkpointChunksFrequency === 0 && typeof table.databaseName === "string") try {
 					await dbManager.checkpoint(table.databaseName);
 				} catch (e) {
 					this.#logger.warning(`Failed to checkpoint database '${table.databaseName}' after appending chunk into table '${table.getFullName()}' - ${e?.message ?? ""}`, { table: table.getFullName() });

package/dist/{types-DCqYqEsa.d.mts → types-dnhcognF.d.mts}

@@ -10,6 +10,8 @@ declare const duckAllConnectionOptionsZodSchema: z.ZodObject<{
   type: z.ZodOptional<z.ZodEnum<{
     DUCKDB: "DUCKDB";
     SQLITE: "SQLITE";
+    MYSQL: "MYSQL";
+    PostgreSQL: "PostgreSQL";
   }>>;
   blockSize: z.ZodOptional<z.ZodInt32>;
   rowGroupSize: z.ZodOptional<z.ZodInt32>;
@@ -33,6 +35,8 @@ declare const duckConnectionParamsZodSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
     type: z.ZodOptional<z.ZodEnum<{
       DUCKDB: "DUCKDB";
       SQLITE: "SQLITE";
+      MYSQL: "MYSQL";
+      PostgreSQL: "PostgreSQL";
     }>>;
     blockSize: z.ZodOptional<z.ZodInt32>;
     rowGroupSize: z.ZodOptional<z.ZodInt32>;
@@ -45,7 +49,7 @@ declare const duckConnectionParamsZodSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
     }>>;
   }, z.core.$strict>>;
 }, z.core.$strict>, z.ZodObject<{
-  type: z.ZodLiteral<"duckdb">;
+  type: z.ZodLiteral<"filesystem">;
   path: z.ZodString;
   alias: z.ZodString;
   options: z.ZodOptional<z.ZodObject<{
@@ -57,6 +61,8 @@ declare const duckConnectionParamsZodSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
     type: z.ZodOptional<z.ZodEnum<{
       DUCKDB: "DUCKDB";
       SQLITE: "SQLITE";
+      MYSQL: "MYSQL";
+      PostgreSQL: "PostgreSQL";
     }>>;
     blockSize: z.ZodOptional<z.ZodInt32>;
     rowGroupSize: z.ZodOptional<z.ZodInt32>;

package/dist/validation/valibot/index.d.mts

@@ -0,0 +1,127 @@
+import * as v from "valibot";
+
+//#region src/validation/valibot/duck-connection-params-valibot-schema.d.ts
+declare const duckAllConnectionOptionsValibotSchema: v.ObjectSchema<{
+  readonly accessMode: v.OptionalSchema<v.PicklistSchema<readonly ["READ_ONLY", "READ_WRITE"], undefined>, undefined>;
+  readonly compress: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+  readonly type: v.OptionalSchema<v.PicklistSchema<readonly ["DUCKDB", "SQLITE", "MYSQL", "PostgreSQL"], undefined>, undefined>;
+  readonly blockSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 16384, undefined>, v.MaxValueAction<number, 262144, undefined>]>, undefined>;
+  readonly rowGroupSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+  readonly storageVersion: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.StartsWithAction<string, "v", undefined>, v.RegexAction<string, undefined>]>, undefined>;
+  readonly encryptionKey: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>]>, undefined>;
+  readonly encryptionCipher: v.OptionalSchema<v.PicklistSchema<readonly ["CBC", "CTR", "GCM"], undefined>, undefined>;
+}, undefined>;
+type DuckAllConnectionOptionsValibotSchema = v.InferOutput<typeof duckAllConnectionOptionsValibotSchema>;
+declare const duckConnectionParamsValibotSchema: v.VariantSchema<"type", [v.ObjectSchema<{
+  readonly type: v.LiteralSchema<"memory", undefined>;
+  readonly alias: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>, v.RegexAction<string, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores">, v.CheckAction<string, "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier">]>;
+  readonly options: v.OptionalSchema<v.ObjectSchema<{
+    readonly accessMode: v.OptionalSchema<v.PicklistSchema<readonly ["READ_ONLY", "READ_WRITE"], undefined>, undefined>;
+    readonly compress: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    readonly type: v.OptionalSchema<v.PicklistSchema<readonly ["DUCKDB", "SQLITE", "MYSQL", "PostgreSQL"], undefined>, undefined>;
+    readonly blockSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 16384, undefined>, v.MaxValueAction<number, 262144, undefined>]>, undefined>;
+    readonly rowGroupSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    readonly storageVersion: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.StartsWithAction<string, "v", undefined>, v.RegexAction<string, undefined>]>, undefined>;
+    readonly encryptionKey: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>]>, undefined>;
+    readonly encryptionCipher: v.OptionalSchema<v.PicklistSchema<readonly ["CBC", "CTR", "GCM"], undefined>, undefined>;
+  }, undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+  readonly type: v.LiteralSchema<"filesystem", undefined>;
+  readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "Invalid database filename - it must be a safe filename (no path traversal, no absolute paths, no reserved names, etc.)">, v.CheckAction<string, "Invalid database pathname - it must be an absolute path with no traversal">]>;
+  readonly alias: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>, v.RegexAction<string, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores">, v.CheckAction<string, "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier">]>;
+  readonly options: v.OptionalSchema<v.ObjectSchema<{
+    readonly accessMode: v.OptionalSchema<v.PicklistSchema<readonly ["READ_ONLY", "READ_WRITE"], undefined>, undefined>;
+    readonly compress: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    readonly type: v.OptionalSchema<v.PicklistSchema<readonly ["DUCKDB", "SQLITE", "MYSQL", "PostgreSQL"], undefined>, undefined>;
+    readonly blockSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 16384, undefined>, v.MaxValueAction<number, 262144, undefined>]>, undefined>;
+    readonly rowGroupSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    readonly storageVersion: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.StartsWithAction<string, "v", undefined>, v.RegexAction<string, undefined>]>, undefined>;
+    readonly encryptionKey: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>]>, undefined>;
+    readonly encryptionCipher: v.OptionalSchema<v.PicklistSchema<readonly ["CBC", "CTR", "GCM"], undefined>, undefined>;
+  }, undefined>, undefined>;
+}, undefined>], undefined>;
+//#endregion
+//#region src/validation/valibot/duck-dsn-valibot-schema.d.ts
+declare const duckDsnValibotSchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, (input: v.CheckIssue<string>) => string>, v.TransformAction<string, {
+  type: "memory";
+  alias: string;
+  options?: {
+    accessMode?: "READ_ONLY" | "READ_WRITE" | undefined;
+    compress?: boolean | undefined;
+    type?: "DUCKDB" | "SQLITE" | "MYSQL" | "PostgreSQL" | undefined;
+    blockSize?: number | undefined;
+    rowGroupSize?: number | undefined;
+    storageVersion?: string | undefined;
+    encryptionKey?: string | undefined;
+    encryptionCipher?: "CBC" | "CTR" | "GCM" | undefined;
+  } | undefined;
+} | {
+  type: "filesystem";
+  path: string;
+  alias: string;
+  options?: {
+    accessMode?: "READ_ONLY" | "READ_WRITE" | undefined;
+    compress?: boolean | undefined;
+    type?: "DUCKDB" | "SQLITE" | "MYSQL" | "PostgreSQL" | undefined;
+    blockSize?: number | undefined;
+    rowGroupSize?: number | undefined;
+    storageVersion?: string | undefined;
+    encryptionKey?: string | undefined;
+    encryptionCipher?: "CBC" | "CTR" | "GCM" | undefined;
+  } | undefined;
+}>, v.VariantSchema<"type", [v.ObjectSchema<{
+  readonly type: v.LiteralSchema<"memory", undefined>;
+  readonly alias: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>, v.RegexAction<string, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores">, v.CheckAction<string, "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier">]>;
+  readonly options: v.OptionalSchema<v.ObjectSchema<{
+    readonly accessMode: v.OptionalSchema<v.PicklistSchema<readonly ["READ_ONLY", "READ_WRITE"], undefined>, undefined>;
+    readonly compress: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    readonly type: v.OptionalSchema<v.PicklistSchema<readonly ["DUCKDB", "SQLITE", "MYSQL", "PostgreSQL"], undefined>, undefined>;
+    readonly blockSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 16384, undefined>, v.MaxValueAction<number, 262144, undefined>]>, undefined>;
+    readonly rowGroupSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    readonly storageVersion: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.StartsWithAction<string, "v", undefined>, v.RegexAction<string, undefined>]>, undefined>;
+    readonly encryptionKey: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>]>, undefined>;
+    readonly encryptionCipher: v.OptionalSchema<v.PicklistSchema<readonly ["CBC", "CTR", "GCM"], undefined>, undefined>;
+  }, undefined>, undefined>;
+}, undefined>, v.ObjectSchema<{
+  readonly type: v.LiteralSchema<"filesystem", undefined>;
+  readonly path: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.CheckAction<string, "Invalid database filename - it must be a safe filename (no path traversal, no absolute paths, no reserved names, etc.)">, v.CheckAction<string, "Invalid database pathname - it must be an absolute path with no traversal">]>;
+  readonly alias: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>, v.RegexAction<string, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores">, v.CheckAction<string, "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier">]>;
+  readonly options: v.OptionalSchema<v.ObjectSchema<{
+    readonly accessMode: v.OptionalSchema<v.PicklistSchema<readonly ["READ_ONLY", "READ_WRITE"], undefined>, undefined>;
+    readonly compress: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    readonly type: v.OptionalSchema<v.PicklistSchema<readonly ["DUCKDB", "SQLITE", "MYSQL", "PostgreSQL"], undefined>, undefined>;
+    readonly blockSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 16384, undefined>, v.MaxValueAction<number, 262144, undefined>]>, undefined>;
+    readonly rowGroupSize: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>]>, undefined>;
+    readonly storageVersion: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.StartsWithAction<string, "v", undefined>, v.RegexAction<string, undefined>]>, undefined>;
+    readonly encryptionKey: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>]>, undefined>;
+    readonly encryptionCipher: v.OptionalSchema<v.PicklistSchema<readonly ["CBC", "CTR", "GCM"], undefined>, undefined>;
+  }, undefined>, undefined>;
+}, undefined>], undefined>]>;
+//#endregion
+//#region src/validation/valibot/duck-identifier-valibot-schema.d.ts
+/**
+ * Check whether a table name identifier is valid
+ */
+declare const duckIdentifierValibotSchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>, v.RegexAction<string, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores">, v.CheckAction<string, "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier">]>;
+//#endregion
+//#region src/validation/valibot/duck-validators-valibot.d.ts
+/**
+ * Common validators for duckdb parameters, tables...
+ *
+ * @example
+ * ```typescript
+ * import { duckValidatorsValibot } from '@flowblade/sqlduck/valibot';
+ *
+ * ```
+ */
+declare const duckValidatorsValibot: {
+  /**
+   * Validate duckdb objects names like table, alias, and schemas
+   * for validity.
+   */
+  readonly aliasName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>, v.RegexAction<string, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores">, v.CheckAction<string, "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier">]>;
+  readonly schemaName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>, v.RegexAction<string, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores">, v.CheckAction<string, "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier">]>;
+  readonly tableName: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>, v.RegexAction<string, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores">, v.CheckAction<string, "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier">]>;
+};
+//#endregion
+export { type DuckAllConnectionOptionsValibotSchema, duckAllConnectionOptionsValibotSchema, duckConnectionParamsValibotSchema, duckDsnValibotSchema, duckIdentifierValibotSchema, duckValidatorsValibot };

package/dist/validation/valibot/index.mjs

@@ -0,0 +1,69 @@
+import { a as duckStorageVersionRegexp, i as duckIdentifierNameRegex, n as duckdbReservedKeywordsSet, r as duckConnectionsOptions } from "../../duck-reserved-keywords-B8XUjnaY.mjs";
+import isSafeFilename from "is-safe-filename";
+import { parseDsn, parseDsnOrThrow } from "@httpx/dsn-parser";
+import * as v from "valibot";
+//#region src/validation/valibot/duck-identifier-valibot-schema.ts
+/**
+* Check whether a table name identifier is valid
+*/
+const duckIdentifierValibotSchema = v.pipe(v.string(), v.minLength(1), v.maxLength(120), v.regex(duckIdentifierNameRegex, "Identifier must start with a letter or underscore, and contain only letters, numbers and underscores"), v.check((value) => !duckdbReservedKeywordsSet.has(value.toUpperCase()), "Identifier value is a DuckDB reserved keyword and cannot be used as an identifier"));
+//#endregion
+//#region src/validation/valibot/duck-validators-valibot.ts
+/**
+* Common validators for duckdb parameters, tables...
+*
+* @example
+* ```typescript
+* import { duckValidatorsValibot } from '@flowblade/sqlduck/valibot';
+*
+* ```
+*/
+const duckValidatorsValibot = {
+	aliasName: duckIdentifierValibotSchema,
+	schemaName: duckIdentifierValibotSchema,
+	tableName: duckIdentifierValibotSchema
+};
+//#endregion
+//#region src/validation/valibot/duck-connection-params-valibot-schema.ts
+const duckAllConnectionOptionsValibotSchema = v.object({
+	accessMode: v.optional(v.picklist(duckConnectionsOptions.accessModes)),
+	compress: v.optional(v.boolean()),
+	type: v.optional(v.picklist(duckConnectionsOptions.types)),
+	blockSize: v.optional(v.pipe(v.number(), v.integer(), v.minValue(16384), v.maxValue(262144))),
+	rowGroupSize: v.optional(v.pipe(v.number(), v.integer(), v.minValue(1))),
+	storageVersion: v.optional(v.pipe(v.string(), v.startsWith("v"), v.regex(duckStorageVersionRegexp))),
+	encryptionKey: v.optional(v.pipe(v.string(), v.minLength(8))),
+	encryptionCipher: v.optional(v.picklist(duckConnectionsOptions.encryptionCiphers))
+});
+const duckConnectionParamsValibotSchema = v.variant("type", [v.object({
+	type: v.literal("memory"),
+	alias: duckValidatorsValibot.aliasName,
+	options: v.optional(duckAllConnectionOptionsValibotSchema)
+}), v.object({
+	type: v.literal("filesystem"),
+	path: v.pipe(v.string(), v.check((path) => {
+		const filename = path.replace("\\", "/").split("/").at(-1);
+		return typeof filename === "string" && isSafeFilename(filename);
+	}, "Invalid database filename - it must be a safe filename (no path traversal, no absolute paths, no reserved names, etc.)"), v.check((path) => {
+		const pathname = "/" + path.replace("\\", "/").split("/").slice(0, -1).filter(Boolean).join("/");
+		return pathname.length > 0 && pathname.startsWith("/") && !pathname.includes("..");
+	}, "Invalid database pathname - it must be an absolute path with no traversal")),
+	alias: duckValidatorsValibot.aliasName,
+	options: v.optional(duckAllConnectionOptionsValibotSchema)
+})]);
+//#endregion
+//#region src/validation/valibot/duck-dsn-valibot-schema.ts
+const duckDsnValibotSchema = v.pipe(v.string(), v.check((dsn) => parseDsn(dsn).success, (input) => {
+	return parseDsn(input.input)?.message ?? "Invalid DSN";
+}), v.transform((dsn) => {
+	const parsed = parseDsnOrThrow(dsn);
+	const { path, ...options } = parsed.params ?? {};
+	return {
+		type: parsed.host,
+		alias: parsed.db,
+		...path ? { path } : {},
+		options: { ...options }
+	};
+}), duckConnectionParamsValibotSchema);
+//#endregion
+export { duckAllConnectionOptionsValibotSchema, duckConnectionParamsValibotSchema, duckDsnValibotSchema, duckIdentifierValibotSchema, duckValidatorsValibot };

package/dist/validation/zod/index.d.mts

@@ -1,11 +1,92 @@
-import { a as duckAllConnectionOptionsZodSchema, i as DuckTableName, n as DuckConnectionParams, o as duckConnectionParamsZodSchema, r as DuckSchemaName, t as DuckAliasName } from "../../types-DCqYqEsa.mjs";
-import * as _$zod from "zod";
+import { a as duckAllConnectionOptionsZodSchema, i as DuckTableName, o as duckConnectionParamsZodSchema, r as DuckSchemaName, t as DuckAliasName } from "../../types-dnhcognF.mjs";
+import * as z from "zod";
 
 //#region src/validation/zod/duck-asserts-zod.d.ts
 declare function assertValidAliasName(aliasName: string): asserts aliasName is DuckAliasName;
 declare function assertValidSchemaName(schemaName: string): asserts schemaName is DuckSchemaName;
 declare function assertValidTableName(tableName: string): asserts tableName is DuckTableName;
 //#endregion
+//#region src/validation/zod/duck-dsn-zod-schema.d.ts
+declare const duckDsnZodSchema: z.ZodPipe<z.ZodString, z.ZodPipe<z.ZodTransform<{
+  type: "memory";
+  alias: string;
+  options?: {
+    accessMode?: "READ_ONLY" | "READ_WRITE" | undefined;
+    compress?: boolean | undefined;
+    type?: "DUCKDB" | "SQLITE" | "MYSQL" | "PostgreSQL" | undefined;
+    blockSize?: number | undefined;
+    rowGroupSize?: number | undefined;
+    storageVersion?: string | undefined;
+    encryptionKey?: string | undefined;
+    encryptionCipher?: "CBC" | "CTR" | "GCM" | undefined;
+  } | undefined;
+} | {
+  type: "filesystem";
+  path: string;
+  alias: string;
+  options?: {
+    accessMode?: "READ_ONLY" | "READ_WRITE" | undefined;
+    compress?: boolean | undefined;
+    type?: "DUCKDB" | "SQLITE" | "MYSQL" | "PostgreSQL" | undefined;
+    blockSize?: number | undefined;
+    rowGroupSize?: number | undefined;
+    storageVersion?: string | undefined;
+    encryptionKey?: string | undefined;
+    encryptionCipher?: "CBC" | "CTR" | "GCM" | undefined;
+  } | undefined;
+}, string>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+  type: z.ZodLiteral<"memory">;
+  alias: z.ZodString;
+  options: z.ZodOptional<z.ZodObject<{
+    accessMode: z.ZodOptional<z.ZodEnum<{
+      READ_ONLY: "READ_ONLY";
+      READ_WRITE: "READ_WRITE";
+    }>>;
+    compress: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodOptional<z.ZodEnum<{
+      DUCKDB: "DUCKDB";
+      SQLITE: "SQLITE";
+      MYSQL: "MYSQL";
+      PostgreSQL: "PostgreSQL";
+    }>>;
+    blockSize: z.ZodOptional<z.ZodInt32>;
+    rowGroupSize: z.ZodOptional<z.ZodInt32>;
+    storageVersion: z.ZodOptional<z.ZodString>;
+    encryptionKey: z.ZodOptional<z.ZodString>;
+    encryptionCipher: z.ZodOptional<z.ZodEnum<{
+      CBC: "CBC";
+      CTR: "CTR";
+      GCM: "GCM";
+    }>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+  type: z.ZodLiteral<"filesystem">;
+  path: z.ZodString;
+  alias: z.ZodString;
+  options: z.ZodOptional<z.ZodObject<{
+    accessMode: z.ZodOptional<z.ZodEnum<{
+      READ_ONLY: "READ_ONLY";
+      READ_WRITE: "READ_WRITE";
+    }>>;
+    compress: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodOptional<z.ZodEnum<{
+      DUCKDB: "DUCKDB";
+      SQLITE: "SQLITE";
+      MYSQL: "MYSQL";
+      PostgreSQL: "PostgreSQL";
+    }>>;
+    blockSize: z.ZodOptional<z.ZodInt32>;
+    rowGroupSize: z.ZodOptional<z.ZodInt32>;
+    storageVersion: z.ZodOptional<z.ZodString>;
+    encryptionKey: z.ZodOptional<z.ZodString>;
+    encryptionCipher: z.ZodOptional<z.ZodEnum<{
+      CBC: "CBC";
+      CTR: "CTR";
+      GCM: "GCM";
+    }>>;
+  }, z.core.$strict>>;
+}, z.core.$strict>], "type">>>;
+//#endregion
 //#region src/validation/zod/duck-validators-zod.d.ts
 /**
  * Common validators for duckdb parameters, tables...
@@ -23,15 +104,9 @@ declare const duckValidatorsZod: {
    * Validate duckdb objects names like table, alias, and schemas
    * for validity.
    */
-  readonly aliasName: _$zod.ZodString;
-  readonly schemaName: _$zod.ZodString;
-  readonly tableName: _$zod.ZodString;
+  readonly aliasName: z.ZodString;
+  readonly schemaName: z.ZodString;
+  readonly tableName: z.ZodString;
 };
 //#endregion
-//#region src/validation/zod/is-parsable-duck-dsn-zod.d.ts
-declare const isParsableDuckDsnZod: (dsn: unknown) => boolean;
-//#endregion
-//#region src/validation/zod/parse-duck-dsn-zod.d.ts
-declare const parseDuckDSNZod: (dsn: string) => DuckConnectionParams;
-//#endregion
-export { assertValidAliasName, assertValidSchemaName, assertValidTableName, duckAllConnectionOptionsZodSchema, duckConnectionParamsZodSchema, duckValidatorsZod, isParsableDuckDsnZod, parseDuckDSNZod };
+export { assertValidAliasName, assertValidSchemaName, assertValidTableName, duckAllConnectionOptionsZodSchema, duckConnectionParamsZodSchema, duckDsnZodSchema, duckValidatorsZod };

package/dist/validation/zod/index.mjs

@@ -1,2 +1,2 @@
-import { a as assertValidTableName, c as duckValidatorsZod, i as assertValidSchemaName, n as parseDuckDSNZod, o as duckAllConnectionOptionsZodSchema, r as assertValidAliasName, s as duckConnectionParamsZodSchema, t as isParsableDuckDsnZod } from "../../zod-DcIc8xQC.mjs";
-export { assertValidAliasName, assertValidSchemaName, assertValidTableName, duckAllConnectionOptionsZodSchema, duckConnectionParamsZodSchema, duckValidatorsZod, isParsableDuckDsnZod, parseDuckDSNZod };
+import { a as duckAllConnectionOptionsZodSchema, i as assertValidTableName, n as assertValidAliasName, o as duckConnectionParamsZodSchema, r as assertValidSchemaName, s as duckValidatorsZod, t as duckDsnZodSchema } from "../../zod-CuPjTLv8.mjs";
+export { assertValidAliasName, assertValidSchemaName, assertValidTableName, duckAllConnectionOptionsZodSchema, duckConnectionParamsZodSchema, duckDsnZodSchema, duckValidatorsZod };

package/dist/{zod-DcIc8xQC.mjs → zod-CuPjTLv8.mjs}

@@ -1,115 +1,8 @@
+import { a as duckStorageVersionRegexp, i as duckIdentifierNameRegex, n as duckdbReservedKeywordsSet, r as duckConnectionsOptions } from "./duck-reserved-keywords-B8XUjnaY.mjs";
+import isSafeFilename from "is-safe-filename";
 import * as z from "zod";
 import { parseDsn } from "@httpx/dsn-parser";
-//#region src/validation/core/base-validators.ts
-const duckIdentifierNameRegex = /^[a-z_]\w*$/i;
-const duckStorageVersionRegexp = /^v?\d{1,4}\.\d{1,4}\.\d{1,4}$/;
-//#endregion
-//#region src/validation/core/duck-reserved-keywords.ts
-/**
-* DuckDB reserved keywords that cannot be used as unquoted identifiers.
-* @see https://duckdb.org/docs/sql/keywords-and-identifiers.html
-*/
-const duckReservedKeywords = [
-	"ALL",
-	"ANALYSE",
-	"ANALYZE",
-	"AND",
-	"ANY",
-	"ARRAY",
-	"AS",
-	"ASC",
-	"ASYMMETRIC",
-	"BOTH",
-	"CASE",
-	"CAST",
-	"CHECK",
-	"COLLATE",
-	"COLUMN",
-	"CONSTRAINT",
-	"CREATE",
-	"CROSS",
-	"CURRENT_CATALOG",
-	"CURRENT_DATE",
-	"CURRENT_ROLE",
-	"CURRENT_SCHEMA",
-	"CURRENT_TIME",
-	"CURRENT_TIMESTAMP",
-	"CURRENT_USER",
-	"DEFAULT",
-	"DEFERRABLE",
-	"DESC",
-	"DISTINCT",
-	"DO",
-	"ELSE",
-	"END",
-	"EXCEPT",
-	"EXISTS",
-	"EXTRACT",
-	"FALSE",
-	"FETCH",
-	"FOR",
-	"FOREIGN",
-	"FROM",
-	"GRANT",
-	"GROUP",
-	"HAVING",
-	"IF",
-	"ILIKE",
-	"IN",
-	"INITIALLY",
-	"INNER",
-	"INTERSECT",
-	"INTO",
-	"IS",
-	"ISNULL",
-	"JOIN",
-	"LATERAL",
-	"LEADING",
-	"LEFT",
-	"LIKE",
-	"LIMIT",
-	"LOCALTIME",
-	"LOCALTIMESTAMP",
-	"NATURAL",
-	"NOT",
-	"NOTNULL",
-	"NULL",
-	"OFFSET",
-	"ON",
-	"ONLY",
-	"OR",
-	"ORDER",
-	"OUTER",
-	"OVERLAPS",
-	"PLACING",
-	"PRIMARY",
-	"REFERENCES",
-	"RETURNING",
-	"RIGHT",
-	"ROW",
-	"SELECT",
-	"SESSION_USER",
-	"SIMILAR",
-	"SOME",
-	"SYMMETRIC",
-	"TABLE",
-	"THEN",
-	"TO",
-	"TRAILING",
-	"TRUE",
-	"UNION",
-	"UNIQUE",
-	"USING",
-	"VARIADIC",
-	"VERBOSE",
-	"WHEN",
-	"WHERE",
-	"WINDOW",
-	"WITH"
-];
-//#endregion
 //#region src/validation/zod/duck-identifier-zod-schema.ts
-const duckdbReservedKeywordsSet = new Set(duckReservedKeywords.map((k) => k.toUpperCase()));
 /**
 * Check whether a table name identifier is valid
 */
@@ -135,26 +28,28 @@ const duckValidatorsZod = {
 //#endregion
 //#region src/validation/zod/duck-connection-params-zod-schema.ts
 const duckAllConnectionOptionsZodSchema = z.strictObject({
-	accessMode: z.optional(z.enum(["READ_ONLY", "READ_WRITE"])),
+	accessMode: z.optional(z.enum(duckConnectionsOptions.accessModes)),
 	compress: z.optional(z.boolean()),
-	type: z.optional(z.enum(["DUCKDB", "SQLITE"])),
+	type: z.optional(z.enum(duckConnectionsOptions.types)),
 	blockSize: z.optional(z.int32().min(16384).max(262144)),
 	rowGroupSize: z.optional(z.int32().positive()),
 	storageVersion: z.optional(z.string().startsWith("v").regex(duckStorageVersionRegexp)),
 	encryptionKey: z.optional(z.string().min(8)),
-	encryptionCipher: z.optional(z.enum([
-		"CBC",
-		"CTR",
-		"GCM"
-	]))
+	encryptionCipher: z.optional(z.enum(duckConnectionsOptions.encryptionCiphers))
 });
 const duckConnectionParamsZodSchema = z.discriminatedUnion("type", [z.strictObject({
 	type: z.literal("memory"),
 	alias: duckValidatorsZod.aliasName,
 	options: z.optional(duckAllConnectionOptionsZodSchema)
 }), z.strictObject({
-	type: z.literal("duckdb"),
-	path: z.string().min(4).endsWith(".db"),
+	type: z.literal("filesystem"),
+	path: z.string().refine((path) => {
+		const filename = path.replace("\\", "/").split("/").at(-1);
+		return typeof filename === "string" && isSafeFilename(filename);
+	}, { message: "Invalid database filename - it must be a safe filename (no path traversal, no absolute paths, no reserved names, etc.)" }).refine((path) => {
+		const pathname = "/" + path.replace("\\", "/").split("/").slice(0, -1).filter(Boolean).join("/");
+		return pathname.length > 0 && pathname.startsWith("/") && !pathname.includes("..");
+	}, { message: "Invalid database pathname - it must be an absolute path with no traversal" }),
 	alias: duckValidatorsZod.aliasName,
 	options: z.optional(duckAllConnectionOptionsZodSchema)
 })]);
@@ -179,29 +74,26 @@ function assertValidTableName(tableName) {
 	if (parsed.error) throw createAssertError(`'${tableName}' is not a valid table name: ${parsed.error.message}`);
 }
 //#endregion
-//#region src/validation/zod/parse-duck-dsn-zod.ts
-const parseDuckDSNZod = (dsn) => {
+//#region src/validation/zod/duck-dsn-zod-schema.ts
+const duckDsnZodSchema = z.string().pipe(z.preprocess((dsn, ctx) => {
 	const result = parseDsn(dsn);
-	if (!result.success) throw new Error(`Invalid DuckDB DSN - ${result.message}`);
-	const parsed = result.value;
-	const { path, ...options } = parsed.params ?? {};
-	return duckConnectionParamsZodSchema.parse({
-		type: parsed.host,
-		alias: parsed.db,
-		...path ? { path } : {},
-		options: { ...options }
-	});
-};
-//#endregion
-//#region src/validation/zod/is-parsable-duck-dsn-zod.ts
-const isParsableDuckDsnZod = (dsn) => {
-	if (typeof dsn !== "string") return false;
-	try {
-		parseDuckDSNZod(dsn);
-		return true;
-	} catch {
-		return false;
+	if (result.success) {
+		const parsed = result.value;
+		const { path, ...options } = parsed.params ?? {};
+		return {
+			type: parsed.host,
+			alias: parsed.db,
+			...path ? { path } : {},
+			options: { ...options }
+		};
+	} else {
+		ctx.issues.push({
+			code: "custom",
+			message: result.message,
+			input: dsn
+		});
+		return z.NEVER;
 	}
-};
+}, duckConnectionParamsZodSchema));
 //#endregion
-export { assertValidTableName as a, duckValidatorsZod as c, assertValidSchemaName as i, duckReservedKeywords as l, parseDuckDSNZod as n, duckAllConnectionOptionsZodSchema as o, assertValidAliasName as r, duckConnectionParamsZodSchema as s, isParsableDuckDsnZod as t };
+export { duckAllConnectionOptionsZodSchema as a, assertValidTableName as i, assertValidAliasName as n, duckConnectionParamsZodSchema as o, assertValidSchemaName as r, duckValidatorsZod as s, duckDsnZodSchema as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowblade/sqlduck",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "type": "module",
   "sideEffects": false,
   "exports": {
@@ -12,6 +12,10 @@
       "types": "./dist/validation/zod/index.d.mts",
       "default": "./dist/validation/zod/index.mjs"
     },
+    "./valibot": {
+      "types": "./dist/validation/valibot/index.d.mts",
+      "default": "./dist/validation/valibot/index.mjs"
+    },
     "./package.json": "./package.json"
   },
   "author": {
@@ -49,48 +53,55 @@
     "fix-staged": "lint-staged --allow-empty",
     "check-dist": "es-check --config=.escheckrc.json",
     "check-pub": "publint",
-    "check-size": "size-limit"
+    "check-size-disabled": "size-limit"
   },
   "dependencies": {
     "@flowblade/core": "^0.2.26",
     "@flowblade/source-duckdb": "^0.20.1",
     "@flowblade/sql-tag": "^0.3.2",
-    "@httpx/assert": "^0.16.8",
+    "@httpx/assert": "^0.16.9",
     "@httpx/dsn-parser": "^1.9.9",
     "@httpx/plain-object": "^2.1.8",
     "@logtape/logtape": "^2.0.5",
     "@standard-schema/spec": "^1.1.0",
-    "p-queue": "9.1.0",
+    "is-safe-filename": "0.1.1",
+    "p-queue": "9.1.1",
     "zod": "^4.3.6"
   },
   "peerDependencies": {
-    "@duckdb/node-api": "^1.5.0-r.1"
+    "@duckdb/node-api": "^1.5.0-r.1",
+    "valibot": "^1.3.1"
+  },
+  "peerDependenciesMeta": {
+    "valibot": {
+      "optional": true
+    }
   },
   "devDependencies": {
-    "@belgattitude/eslint-config-bases": "8.10.0",
+    "@belgattitude/eslint-config-bases": "8.12.0",
     "@dotenvx/dotenvx": "1.59.1",
     "@duckdb/node-api": "1.5.1-r.1",
     "@faker-js/faker": "10.4.0",
     "@flowblade/source-kysely": "^1.3.0",
-    "@httpx/assert": "0.16.8",
+    "@httpx/assert": "0.16.9",
     "@mitata/counters": "0.0.8",
     "@size-limit/esbuild": "12.0.1",
     "@size-limit/file": "12.0.1",
     "@testcontainers/mssqlserver": "11.13.0",
     "@total-typescript/ts-reset": "0.6.1",
-    "@types/node": "25.5.0",
-    "@typescript-eslint/eslint-plugin": "8.58.0",
-    "@typescript-eslint/parser": "8.58.0",
-    "@typescript/native-preview": "7.0.0-dev.20260324.1",
-    "@vitest/coverage-v8": "4.1.2",
-    "@vitest/ui": "4.1.2",
+    "@types/node": "25.5.2",
+    "@typescript-eslint/eslint-plugin": "8.58.1",
+    "@typescript-eslint/parser": "8.58.1",
+    "@typescript/native-preview": "7.0.0-dev.20260406.1",
+    "@vitest/coverage-v8": "4.1.3",
+    "@vitest/ui": "4.1.3",
     "ansis": "4.2.0",
     "browserslist-to-esbuild": "2.1.1",
     "core-js": "3.49.0",
     "cross-env": "10.1.0",
-    "es-check": "9.6.3",
+    "es-check": "9.6.4",
     "es-toolkit": "1.45.1",
-    "esbuild": "0.27.4",
+    "esbuild": "0.28.0",
     "eslint": "8.57.1",
     "execa": "9.6.1",
     "is-in-ci": "2.0.0",
@@ -111,7 +122,8 @@
     "typedoc": "0.28.18",
     "typedoc-plugin-markdown": "4.11.0",
     "typescript": "6.0.2",
-    "vitest": "4.1.2"
+    "valibot": "1.3.1",
+    "vitest": "4.1.3"
   },
   "files": [
     "dist"