@lunora/bindings 1.0.0-alpha.55 → 1.0.0-alpha.56

package/dist/r2sql/index.d.mts

@@ -18,6 +18,22 @@ declare const isSql: (value: unknown) => value is Sql;
 declare const raw: (text: string) => Sql;
 /** Resolve a `string | Sql` to its raw text. A bare string is taken as trusted SQL (callers pass identifiers/fragments here). */
 declare const toText: (value: Sql | string) => string;
+/**
+ * Validate a table/namespace/database identifier that will be spliced into R2 SQL
+ * text (which has no parameter binding and no identifier quoting we can rely on).
+ * Accepts only dotted `\w` segments and throws otherwise, so a client-supplied
+ * `describe`/`showTables` argument can't inject SQL. For a genuinely dynamic
+ * identifier you built yourself, wrap it with {@link raw}.
+ */
+declare const ident: (name: string) => string;
+/**
+ * Validate a table REFERENCE for a `FROM`/`JOIN` position: a dotted identifier
+ * plus an optional `[AS] alias`. Broader than {@link ident} (which forbids the
+ * alias) but still an allowlist — no whitespace beyond the single alias, no
+ * punctuation — so a caller-supplied table string can't inject SQL. Use
+ * {@link raw} for anything more dynamic that you built yourself.
+ */
+declare const tableRef: (ref: string) => string;
 /**
  * Render a JS value as an R2 SQL literal:
  *
@@ -408,4 +424,4 @@ export { type Condition, type OrderTerm, type OverSpec, type QueryExecutor, type
  * not tracked by Lunora live queries (see the `r2sql_outside_action` advisor
  * lint). See the README and `createR2Sql` JSDoc.
  */
-SelectBuilder, SetOperation, Sql, WindowExpression, WindowFunction, asc, createR2Sql, desc, fn, isSql, joinSql, lit, raw, renderOrderTerm, sql, toText };
+SelectBuilder, SetOperation, Sql, WindowExpression, WindowFunction, asc, createR2Sql, desc, fn, ident, isSql, joinSql, lit, raw, renderOrderTerm, sql, tableRef, toText };

package/dist/r2sql/index.d.ts

@@ -18,6 +18,22 @@ declare const isSql: (value: unknown) => value is Sql;
 declare const raw: (text: string) => Sql;
 /** Resolve a `string | Sql` to its raw text. A bare string is taken as trusted SQL (callers pass identifiers/fragments here). */
 declare const toText: (value: Sql | string) => string;
+/**
+ * Validate a table/namespace/database identifier that will be spliced into R2 SQL
+ * text (which has no parameter binding and no identifier quoting we can rely on).
+ * Accepts only dotted `\w` segments and throws otherwise, so a client-supplied
+ * `describe`/`showTables` argument can't inject SQL. For a genuinely dynamic
+ * identifier you built yourself, wrap it with {@link raw}.
+ */
+declare const ident: (name: string) => string;
+/**
+ * Validate a table REFERENCE for a `FROM`/`JOIN` position: a dotted identifier
+ * plus an optional `[AS] alias`. Broader than {@link ident} (which forbids the
+ * alias) but still an allowlist — no whitespace beyond the single alias, no
+ * punctuation — so a caller-supplied table string can't inject SQL. Use
+ * {@link raw} for anything more dynamic that you built yourself.
+ */
+declare const tableRef: (ref: string) => string;
 /**
  * Render a JS value as an R2 SQL literal:
  *
@@ -408,4 +424,4 @@ export { type Condition, type OrderTerm, type OverSpec, type QueryExecutor, type
  * not tracked by Lunora live queries (see the `r2sql_outside_action` advisor
  * lint). See the README and `createR2Sql` JSDoc.
  */
-SelectBuilder, SetOperation, Sql, WindowExpression, WindowFunction, asc, createR2Sql, desc, fn, isSql, joinSql, lit, raw, renderOrderTerm, sql, toText };
+SelectBuilder, SetOperation, Sql, WindowExpression, WindowFunction, asc, createR2Sql, desc, fn, ident, isSql, joinSql, lit, raw, renderOrderTerm, sql, tableRef, toText };

package/dist/r2sql/index.mjs

@@ -1 +1 @@
-import{default as o}from"../packem_shared/SelectBuilder-DJXNSdqC.mjs";import{R2SqlError as l,createR2Sql as f}from"../packem_shared/R2SqlError-ZHgOWClB.mjs";import{asc as d,desc as i,renderOrderTerm as n}from"../packem_shared/asc-DP_WFiAE.mjs";import{default as s}from"../packem_shared/SetOperation-kiI5Wnlm.mjs";import{Sql as m,isSql as S,joinSql as q,lit as c,raw as u,sql as w,toText as E}from"../packem_shared/Sql-BfnxRway.mjs";import{WindowFunction as R,fn as T}from"../packem_shared/WindowFunction-CL4jYy2l.mjs";import{default as j}from"../packem_shared/WindowExpression-VX7EEV3h.mjs";export{l as R2SqlError,o as SelectBuilder,s as SetOperation,m as Sql,j as WindowExpression,R as WindowFunction,d as asc,f as createR2Sql,i as desc,T as fn,S as isSql,q as joinSql,c as lit,u as raw,n as renderOrderTerm,w as sql,E as toText};
+import{default as o}from"../packem_shared/SelectBuilder-DJXNSdqC.mjs";import{R2SqlError as l,createR2Sql as f}from"../packem_shared/R2SqlError-ZHgOWClB.mjs";import{asc as d,desc as i,renderOrderTerm as n}from"../packem_shared/asc-DP_WFiAE.mjs";import{default as s}from"../packem_shared/SetOperation-kiI5Wnlm.mjs";import{Sql as m,ident as S,isSql as q,joinSql as c,lit as u,raw as w,sql as R,tableRef as E,toText as O}from"../packem_shared/Sql-BfnxRway.mjs";import{WindowFunction as W,fn as b}from"../packem_shared/WindowFunction-CL4jYy2l.mjs";import{default as B}from"../packem_shared/WindowExpression-VX7EEV3h.mjs";export{l as R2SqlError,o as SelectBuilder,s as SetOperation,m as Sql,B as WindowExpression,W as WindowFunction,d as asc,f as createR2Sql,i as desc,b as fn,S as ident,q as isSql,c as joinSql,u as lit,w as raw,n as renderOrderTerm,R as sql,E as tableRef,O as toText};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/bindings",
-  "version": "1.0.0-alpha.55",
+  "version": "1.0.0-alpha.56",
   "description": "Lightweight Cloudflare binding helpers for Lunora — ctx.kv, ctx.images, ctx.analytics, ctx.pipelines, ctx.vectors, ctx.r2sql — one install, per-binding subpaths",
   "keywords": [
     "analytics",
@@ -65,7 +65,7 @@
   },
   "dependencies": {
     "@lunora/errors": "1.0.0-alpha.35",
-    "@lunora/platform": "1.0.0-alpha.28"
+    "@lunora/platform": "1.0.0-alpha.29"
   },
   "engines": {
     "node": "^22.15.0 || >=24.11.0"