@lunora/hyperdrive 1.0.0-alpha.17 → 1.0.0-alpha.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.d.mts +7 -0
  2. package/dist/index.d.ts +7 -0
  3. package/package.json +3 -3
package/dist/index.d.mts CHANGED
@@ -71,6 +71,13 @@ interface HyperdriveConnection {
71
71
  interface SqlClient {
72
72
  /**
73
73
  * Run a parameterised SQL statement and return the result rows.
74
+ *
75
+ * SECURITY: `text` is executed verbatim — the package never rewrites or
76
+ * escapes it. NEVER interpolate untrusted/user input into `text`; put every
77
+ * value in `params` and reference it with a positional placeholder (`$1`/`?`).
78
+ * Building `text` by string-concatenating request data is a SQL-injection
79
+ * sink against your own Postgres/MySQL. Identifiers (table/column names) can't
80
+ * be parameterised — allowlist them against a fixed set, don't interpolate.
74
81
  * @param text SQL text with driver-native positional placeholders.
75
82
  * @param params Bound parameter values, positionally matched to `text`.
76
83
  * @returns The rows the statement produced (empty for non-`SELECT`s that
package/dist/index.d.ts CHANGED
@@ -71,6 +71,13 @@ interface HyperdriveConnection {
71
71
  interface SqlClient {
72
72
  /**
73
73
  * Run a parameterised SQL statement and return the result rows.
74
+ *
75
+ * SECURITY: `text` is executed verbatim — the package never rewrites or
76
+ * escapes it. NEVER interpolate untrusted/user input into `text`; put every
77
+ * value in `params` and reference it with a positional placeholder (`$1`/`?`).
78
+ * Building `text` by string-concatenating request data is a SQL-injection
79
+ * sink against your own Postgres/MySQL. Identifiers (table/column names) can't
80
+ * be parameterised — allowlist them against a fixed set, don't interpolate.
74
81
  * @param text SQL text with driver-native positional placeholders.
75
82
  * @param params Bound parameter values, positionally matched to `text`.
76
83
  * @returns The rows the statement produced (empty for non-`SELECT`s that
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lunora/hyperdrive",
3
- "version": "1.0.0-alpha.17",
3
+ "version": "1.0.0-alpha.18",
4
4
  "description": "Bring-your-own Postgres/MySQL for Lunora via Cloudflare Hyperdrive: a driver-agnostic, action-only ctx.sql",
5
5
  "keywords": [
6
6
  "cloudflare",
@@ -50,8 +50,8 @@
50
50
  "access": "public"
51
51
  },
52
52
  "dependencies": {
53
- "@lunora/do": "1.0.0-alpha.17",
54
- "@lunora/sql-store": "1.0.0-alpha.17",
53
+ "@lunora/do": "1.0.0-alpha.18",
54
+ "@lunora/sql-store": "1.0.0-alpha.18",
55
55
  "drizzle-orm": "^0.45.2"
56
56
  },
57
57
  "peerDependencies": {