@objectstack/driver-sql 7.9.0 → 8.0.0

package/dist/index.d.mts

@@ -85,6 +85,7 @@ declare class SqlDriver implements IDataDriver {
         jsonFields: boolean;
         arrayFields: boolean;
         vectorSearch: boolean;
+        autonumber: boolean;
         schemaSync: boolean;
         batchSchemaSync: boolean;
         migrations: boolean;
@@ -419,6 +420,15 @@ declare class SqlDriver implements IDataDriver {
      */
     protected coerceFilterValue(table: string | null, field: string, value: any): any;
     protected applyFilters(builder: Knex.QueryBuilder, filters: any): void;
+    /**
+     * Apply a `contains` substring match as a parameterized `LIKE '%…%'`, escaping
+     * the LIKE metacharacters `%` / `_` (and the escape char `\`) in the user value
+     * so they match literally instead of acting as wildcards — otherwise a value of
+     * `%` matches every row (a filter-bypass, P0). Binds an explicit `ESCAPE '\'`
+     * because SQLite does not honour a default escape character (MySQL/Postgres do,
+     * but the explicit clause is correct for all three).
+     */
+    private applyContainsLike;
     protected applyFilterCondition(builder: Knex.QueryBuilder, condition: any, logicalOp?: 'and' | 'or', tableHint?: string | null): void;
     protected mapSortField(field: string): string;
     protected mapAggregateFunc(func: string): string;

package/dist/index.d.ts

@@ -85,6 +85,7 @@ declare class SqlDriver implements IDataDriver {
         jsonFields: boolean;
         arrayFields: boolean;
         vectorSearch: boolean;
+        autonumber: boolean;
         schemaSync: boolean;
         batchSchemaSync: boolean;
         migrations: boolean;
@@ -419,6 +420,15 @@ declare class SqlDriver implements IDataDriver {
      */
     protected coerceFilterValue(table: string | null, field: string, value: any): any;
     protected applyFilters(builder: Knex.QueryBuilder, filters: any): void;
+    /**
+     * Apply a `contains` substring match as a parameterized `LIKE '%…%'`, escaping
+     * the LIKE metacharacters `%` / `_` (and the escape char `\`) in the user value
+     * so they match literally instead of acting as wildcards — otherwise a value of
+     * `%` matches every row (a filter-bypass, P0). Binds an explicit `ESCAPE '\'`
+     * because SQLite does not honour a default escape character (MySQL/Postgres do,
+     * but the explicit clause is correct for all three).
+     */
+    private applyContainsLike;
     protected applyFilterCondition(builder: Knex.QueryBuilder, condition: any, logicalOp?: 'and' | 'or', tableHint?: string | null): void;
     protected mapSortField(field: string): string;
     protected mapAggregateFunc(func: string): string;

package/dist/index.js

@@ -139,6 +139,10 @@ var SqlDriver = class {
       jsonFields: true,
       arrayFields: true,
       vectorSearch: false,
+      // Persistent, atomic autonumber sequences via `_objectstack_sequences`
+      // (see fillAutoNumberFields / getNextSequenceValue). The engine defers
+      // autonumber generation to this driver — it is the single source of truth.
+      autonumber: true,
       // Schema Management
       schemaSync: true,
       batchSchemaSync: false,
@@ -546,7 +550,10 @@ var SqlDriver = class {
   async bulkCreate(object, data, options) {
     this.auditMissingTenant(object, "bulkCreate", options);
     for (const row of data) {
-      if (row && typeof row === "object") this.injectTenantOnInsert(object, row, options);
+      if (row && typeof row === "object") {
+        this.injectTenantOnInsert(object, row, options);
+        await this.fillAutoNumberFields(object, row, options);
+      }
     }
     const builder = this.getBuilder(object, options);
     return await builder.insert(data).returning("*");
@@ -841,7 +848,8 @@ var SqlDriver = class {
             ((_b = this.datetimeFields)[tableName] ?? (_b[tableName] = /* @__PURE__ */ new Set())).add(name);
           }
           if (type === "auto_number" || type === "autonumber") {
-            const fmt = typeof field.format === "string" && field.format ? field.format : "{0000}";
+            const rawFmt = typeof field.autonumberFormat === "string" && field.autonumberFormat ? field.autonumberFormat : typeof field.format === "string" && field.format ? field.format : "";
+            const fmt = rawFmt || "{0000}";
             const m = fmt.match(/\{(0+)\}/);
             const padWidth = m ? m[1].length : 4;
             const prefix = m ? fmt.slice(0, m.index ?? 0) : fmt;
@@ -1229,7 +1237,7 @@ var SqlDriver = class {
             const methodIn = nextJoin === "or" ? "orWhereIn" : "whereIn";
             const methodNotIn = nextJoin === "or" ? "orWhereNotIn" : "whereNotIn";
             if (op === "contains") {
-              b[method](field, "like", `%${value}%`);
+              this.applyContainsLike(b, method, field, value);
               return;
             }
             switch (op) {
@@ -1260,6 +1268,19 @@ var SqlDriver = class {
       }
     }
   }
+  /**
+   * Apply a `contains` substring match as a parameterized `LIKE '%…%'`, escaping
+   * the LIKE metacharacters `%` / `_` (and the escape char `\`) in the user value
+   * so they match literally instead of acting as wildcards — otherwise a value of
+   * `%` matches every row (a filter-bypass, P0). Binds an explicit `ESCAPE '\'`
+   * because SQLite does not honour a default escape character (MySQL/Postgres do,
+   * but the explicit clause is correct for all three).
+   */
+  applyContainsLike(builder, method, field, value) {
+    const escaped = String(value).replace(/[\\%_]/g, "\\$&");
+    const rawMethod = method.startsWith("or") ? "orWhereRaw" : "whereRaw";
+    builder[rawMethod]("?? LIKE ? ESCAPE ?", [field, `%${escaped}%`, "\\"]);
+  }
   applyFilterCondition(builder, condition, logicalOp = "and", tableHint) {
     if (!condition || typeof condition !== "object") return;
     const table = tableHint ?? this.tableNameForBuilder(builder);
@@ -1316,7 +1337,7 @@ var SqlDriver = class {
               break;
             }
             case "$contains":
-              builder[method](field, "like", `%${opValue}%`);
+              this.applyContainsLike(builder, method, field, opValue);
               break;
             default:
               builder[method](field, coerced);