@lunora/hyperdrive 1.0.0-alpha.2 → 1.0.0-alpha.21

package/dist/global.mjs

@@ -1,6 +1,6 @@
 import { createSqlCtxDb } from '@lunora/sql-store';
-import { postgresDialect, mysqlDialect } from './packem_shared/postgresDialect-oNhZ58s8.mjs';
-import { buildMysqlExec, buildPgExec } from './packem_shared/buildPgExec-DBbCjyq3.mjs';
+import { postgresDialect, mysqlDialect } from './packem_shared/mysqlDialect-oNhZ58s8.mjs';
+import { buildMysqlExec, buildPgExec } from './packem_shared/buildMysqlExec-DBbCjyq3.mjs';
 
 const createHyperdriveGlobalCtxDb = ({ engine, exec, ...rest }) => createSqlCtxDb({ ...rest, dialect: engine === "postgres" ? postgresDialect : mysqlDialect, exec });
 const createPostgresGlobalCtxDb = (client, options) => createHyperdriveGlobalCtxDb({ ...options, engine: "postgres", exec: buildPgExec(client) });

package/dist/index.d.mts

@@ -71,6 +71,13 @@ interface HyperdriveConnection {
 interface SqlClient {
   /**
   * Run a parameterised SQL statement and return the result rows.
+  *
+  * SECURITY: `text` is executed verbatim — the package never rewrites or
+  * escapes it. NEVER interpolate untrusted/user input into `text`; put every
+  * value in `params` and reference it with a positional placeholder (`$1`/`?`).
+  * Building `text` by string-concatenating request data is a SQL-injection
+  * sink against your own Postgres/MySQL. Identifiers (table/column names) can't
+  * be parameterised — allowlist them against a fixed set, don't interpolate.
   * @param text SQL text with driver-native positional placeholders.
   * @param params Bound parameter values, positionally matched to `text`.
   * @returns The rows the statement produced (empty for non-`SELECT`s that
@@ -162,4 +169,43 @@ declare const fromNodePg: (client: NodePgLike) => SqlClient;
 * contract the postgres.js / node-postgres adapters already honour.
 */
 declare const fromMysql2: (connection: Mysql2Like) => SqlClient;
-export { type HyperdriveConnection, type HyperdriveLike, type Mysql2Like, type NodePgLike, type PostgresJsLike, type SqlClient, createHyperdrive, fromMysql2, fromNodePg, fromPostgresJs };
+/** How an external row maps to a Lunora document. */
+interface ProjectOptions {
+  /**
+  * Column whose value becomes the Lunora `_id` (stringified). Defaults to `"id"`.
+  * With no `map`, this column is dropped from the document body (it lives on as
+  * `_id`); with a `map`, the mapper owns the body and `_id` is added from here.
+  */
+  idColumn?: string;
+  /**
+  * Transform an external row into the stored document body. Omit for the default:
+  * every selected column except `idColumn` is copied verbatim. The returned object
+  * must not include `_id` — it is set from `idColumn`.
+  */
+  map?: (row: Record<string, unknown>) => Record<string, unknown>;
+}
+/** Options for {@link pullSourceRows}: the parameterised tenant query plus the row projection. */
+interface PullSourceOptions extends ProjectOptions {
+  /** Bound parameter values, positionally matched to `query` (the tenant scope binds here). */
+  params?: ReadonlyArray<unknown>;
+  /** The full tenant-membership query with driver-native placeholders (`$1` / `?`). */
+  query: string;
+}
+/**
+* Project one external row to a Lunora document: lift `idColumn` to a stringified
+* `_id`, then either apply `map` or copy every other column verbatim. Throws when
+* the id column is missing/nullish so a misconfigured query fails loudly rather than
+* materializing rows under an `"undefined"` id.
+*
+* Delegates to `@lunora/do`'s `liftSourceId` — the single id-lift the declarative
+* `.source()` poll loop also uses — so the manual bridge and the codegen path can
+* never diverge in their missing-id handling.
+*/
+declare const projectSourceRow: (row: Record<string, unknown>, options?: ProjectOptions) => Record<string, unknown>;
+/**
+* Run a parameterised tenant query against Hyperdrive and project every row to a
+* Lunora document ready to hand to `materializeExternalRows`. Call this inside an
+* **action** (where `ctx.sql` lives); pass the result to a mutation for the write.
+*/
+declare const pullSourceRows: (sql: SqlClient, options: PullSourceOptions) => Promise<Record<string, unknown>[]>;
+export { type HyperdriveConnection, type HyperdriveLike, type Mysql2Like, type NodePgLike, type PostgresJsLike, type ProjectOptions, type PullSourceOptions, type SqlClient, createHyperdrive, fromMysql2, fromNodePg, fromPostgresJs, projectSourceRow, pullSourceRows };

package/dist/index.d.ts

@@ -71,6 +71,13 @@ interface HyperdriveConnection {
 interface SqlClient {
   /**
   * Run a parameterised SQL statement and return the result rows.
+  *
+  * SECURITY: `text` is executed verbatim — the package never rewrites or
+  * escapes it. NEVER interpolate untrusted/user input into `text`; put every
+  * value in `params` and reference it with a positional placeholder (`$1`/`?`).
+  * Building `text` by string-concatenating request data is a SQL-injection
+  * sink against your own Postgres/MySQL. Identifiers (table/column names) can't
+  * be parameterised — allowlist them against a fixed set, don't interpolate.
   * @param text SQL text with driver-native positional placeholders.
   * @param params Bound parameter values, positionally matched to `text`.
   * @returns The rows the statement produced (empty for non-`SELECT`s that
@@ -162,4 +169,43 @@ declare const fromNodePg: (client: NodePgLike) => SqlClient;
 * contract the postgres.js / node-postgres adapters already honour.
 */
 declare const fromMysql2: (connection: Mysql2Like) => SqlClient;
-export { type HyperdriveConnection, type HyperdriveLike, type Mysql2Like, type NodePgLike, type PostgresJsLike, type SqlClient, createHyperdrive, fromMysql2, fromNodePg, fromPostgresJs };
+/** How an external row maps to a Lunora document. */
+interface ProjectOptions {
+  /**
+  * Column whose value becomes the Lunora `_id` (stringified). Defaults to `"id"`.
+  * With no `map`, this column is dropped from the document body (it lives on as
+  * `_id`); with a `map`, the mapper owns the body and `_id` is added from here.
+  */
+  idColumn?: string;
+  /**
+  * Transform an external row into the stored document body. Omit for the default:
+  * every selected column except `idColumn` is copied verbatim. The returned object
+  * must not include `_id` — it is set from `idColumn`.
+  */
+  map?: (row: Record<string, unknown>) => Record<string, unknown>;
+}
+/** Options for {@link pullSourceRows}: the parameterised tenant query plus the row projection. */
+interface PullSourceOptions extends ProjectOptions {
+  /** Bound parameter values, positionally matched to `query` (the tenant scope binds here). */
+  params?: ReadonlyArray<unknown>;
+  /** The full tenant-membership query with driver-native placeholders (`$1` / `?`). */
+  query: string;
+}
+/**
+* Project one external row to a Lunora document: lift `idColumn` to a stringified
+* `_id`, then either apply `map` or copy every other column verbatim. Throws when
+* the id column is missing/nullish so a misconfigured query fails loudly rather than
+* materializing rows under an `"undefined"` id.
+*
+* Delegates to `@lunora/do`'s `liftSourceId` — the single id-lift the declarative
+* `.source()` poll loop also uses — so the manual bridge and the codegen path can
+* never diverge in their missing-id handling.
+*/
+declare const projectSourceRow: (row: Record<string, unknown>, options?: ProjectOptions) => Record<string, unknown>;
+/**
+* Run a parameterised tenant query against Hyperdrive and project every row to a
+* Lunora document ready to hand to `materializeExternalRows`. Call this inside an
+* **action** (where `ctx.sql` lives); pass the result to a mutation for the write.
+*/
+declare const pullSourceRows: (sql: SqlClient, options: PullSourceOptions) => Promise<Record<string, unknown>[]>;
+export { type HyperdriveConnection, type HyperdriveLike, type Mysql2Like, type NodePgLike, type PostgresJsLike, type ProjectOptions, type PullSourceOptions, type SqlClient, createHyperdrive, fromMysql2, fromNodePg, fromPostgresJs, projectSourceRow, pullSourceRows };

package/dist/index.mjs

@@ -1 +1,2 @@
 export { createHyperdrive, fromMysql2, fromNodePg, fromPostgresJs } from './packem_shared/createHyperdrive-DD8GoDZo.mjs';
+export { projectSourceRow, pullSourceRows } from './packem_shared/projectSourceRow-DtKuMRIm.mjs';

package/dist/packem_shared/projectSourceRow-DtKuMRIm.mjs

@@ -0,0 +1,10 @@
+import { liftSourceId } from '@lunora/do';
+
+const projectSourceRow = (row, options = {}) => liftSourceId(row, options);
+const pullSourceRows = async (sql, options) => {
+  const { idColumn, map, params, query } = options;
+  const rows = await sql.query(query, params);
+  return rows.map((row) => projectSourceRow(row, { idColumn, map }));
+};
+
+export { projectSourceRow, pullSourceRows };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/hyperdrive",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.21",
   "description": "Bring-your-own Postgres/MySQL for Lunora via Cloudflare Hyperdrive: a driver-agnostic, action-only ctx.sql",
   "keywords": [
     "cloudflare",
@@ -25,7 +25,7 @@
     "directory": "packages/hyperdrive"
   },
   "files": [
-    "dist",
+    "./dist",
     "README.md",
     "LICENSE.md",
     "__assets__"
@@ -50,8 +50,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/do": "1.0.0-alpha.2",
-    "@lunora/sql-store": "1.0.0-alpha.2",
+    "@lunora/do": "1.0.0-alpha.21",
+    "@lunora/sql-store": "1.0.0-alpha.21",
     "drizzle-orm": "^0.45.2"
   },
   "peerDependencies": {